Privacy Policy

Last updated: August 29, 2026

This policy explains what happens to data when you visit wheretogonext.me. It describes the services we actually run on the site, what each of them collects, why, and what you can do about it.

The site is funded by advertising and by affiliate links. That is the reason most of the data described below is collected at all, and we would rather say so plainly than bury it.

One thing is worth saying up front: we do not keep a database of visitors. There are no user accounts, no registration, no newsletter and no visitor profiles on this site. Where personal data is processed, it is processed by the third-party services described below — advertising, analytics and the network that delivers the site — under your consent, not stored by us.

Your choices come first

Advertising and analytics on this site run through a consent management platform (CMP) provided by Snigel, built on the IAB Europe Transparency & Consent Framework (TCF). The first time you visit, it asks whether you agree to personalised advertising and related processing, and it lists every advertising partner involved, along with what each one does and how long it stores data.

Nothing that requires your consent is loaded before you give it. Analytics and advertising storage start in a denied state and are only enabled if you accept.

You can review or change your choice at any time, including withdrawing consent entirely, through the round fingerprint icon in the bottom-left corner of every page.

The same panel contains the full partner list. It is the authoritative source for who receives data and for how long they keep it — it is kept up to date automatically, which a hand-written list on this page could not be.

What we collect, and why

Advertising

Ads are served by Snigel, which acts as our advertising partner and consent manager, and by MGID, a content recommendation platform whose widgets appear alongside and below articles. With your consent, these services and their partners may set cookies or similar identifiers and process data such as your IP address, device and browser characteristics, and the pages you view, in order to select and measure ads.

If you decline, ads may still be shown, but they are not personalised and the processing is limited accordingly.

Analytics

We use Google Analytics 4 to understand which articles people read and how they find them. It is loaded with Google Consent Mode: until you accept, analytics storage is denied and no analytics cookies are set. We look at aggregate reports only; we do not attempt to identify individual visitors. Google acts as our processor and retains the data according to the retention period configured in the Google Analytics account.

Article view counts

We count how often each article is read so we can show a “trending” list. This runs on our own server and is deliberately built to avoid identifying anyone: it sets no cookie, and to avoid counting the same reader twice within half an hour it stores a one-way hash of your IP address and browser user agent, which expires automatically after 30 minutes. Your IP address itself is never written to our database. What we keep is a daily total per article — a number, with nothing attached to it.

The contact form

When you write to us through the contact form, your name, email address and message are sent straight to our inbox as an email. Nothing is stored on the website: there is no database of submissions, no mailing list, no marketing use, and nothing is sold or shared. The email lives in our mailbox only as long as the conversation is useful, and is then deleted.

Affiliate links

Some links on this site — most often to Booking.com — are affiliate links. If you follow one and make a booking, we may earn a commission at no extra cost to you. Following such a link takes you to the partner’s own site, where their privacy policy applies and where they may set cookies to attribute the referral to us. We never receive your booking details, your payment information or your personal data from them; we see only aggregate commission reports.

Hosting, delivery and security

The site is served through Cloudflare, which sits in front of our server to deliver pages quickly and to filter malicious traffic. Cloudflare processes connection data, including IP addresses, for those purposes. Our own web server keeps standard access logs — IP address, timestamp, page requested, browser user agent — which we use for security and troubleshooting and rotate regularly. Article pages also embed a Pinterest script that enables the “save to Pinterest” behaviour on images; it is provided by Pinterest and subject to their policies.

Legal bases for processing

Under the GDPR, we rely on:

Consent — Article 6(1)(a) — for advertising, personalisation and analytics. You give it, or refuse it, through the consent panel, and you can withdraw it at any time using the button above. Withdrawing is as easy as giving it.
Legitimate interests — Article 6(1)(f) — for keeping the site secure and available, for basic non-identifying measurement such as the article counters described above, and, where our advertising partners rely on it, for certain limited advertising purposes. The consent panel shows exactly which partners invoke legitimate interest and lets you object to each one.
Performing a request you made — Article 6(1)(b) and (f) — when you contact us and we reply.

How long data is kept

Consent choice — stored in your browser and honoured until it expires or you change it; the exact duration is shown in the consent panel.
Advertising and analytics data — held by the respective partners for the periods they declare in the consent panel and in their own policies.
Article view de-duplication hash — 30 minutes, then deleted automatically.
Article view totals — kept indefinitely, but they are counts only and contain no personal data.
Server access logs — rotated and discarded as part of normal server maintenance.
Contact form messages — never stored on the site; the resulting email is deleted from our mailbox once the conversation has served its purpose.

Cookies and similar technologies

Cookies on this site fall into three groups:

Strictly necessary — remembering your consent choice, and keeping the site working and secure. These are set without consent because the site cannot function without them.
Analytics — Google Analytics, only after you accept.
Advertising — set by Snigel, MGID and their partners, only after you accept.

The consent panel lists each partner individually, with its purposes and storage durations. Your browser settings can also block or delete cookies, though doing so may affect how the site works. One small thing worth mentioning: if you use the light/dark switch in the site header, your preference is stored locally in your browser and never leaves your device.

Your rights in the EEA and the UK

If you are in the European Economic Area or the United Kingdom, you have the right to access the data held about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time. You also have the right to complain to your national data protection authority.

Because much of the data described here is held by our advertising partners rather than by us, the fastest route for advertising-related requests is usually the consent panel, which lets you withdraw consent and object to legitimate-interest processing partner by partner. For anything else, write to us through the contact form and we will respond within one month.

Your rights in California and other US states

We do not sell personal information for money. However, sharing data with advertising partners for personalised advertising can qualify as a “sale” or as “sharing for cross-context behavioural advertising” under the California Consumer Privacy Act and similar state laws.

If you are a resident of California, Colorado, Connecticut, Virginia or another state with comparable legislation, you may opt out of that sharing, and you may request access to or deletion of personal information relating to you. Visitors from applicable US states can opt out through the round fingerprint icon in the bottom-left corner of every page; using it registers your opt-out signal. We also honour the Global Privacy Control (GPC) signal if your browser sends one. Requests of any other kind can be made through the contact form, and we will not discriminate against you for exercising these rights.

International transfers

Several of the services described above — including Google, Cloudflare, MGID and many advertising partners — operate globally, so data may be processed outside your country, including in the United States. Those transfers rely on the safeguards those companies put in place, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. Details for each partner are available in the consent panel and in their own privacy policies.

Children

This site is intended for adults and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We update this page when the services behind the site change. The date at the top always reflects the current version. Material changes to how we handle personal data will be reflected here before they take effect.

Contact

Questions about this policy, or a request concerning your data, can be sent through our contact form.