What we collect, and why.
This covers two groups of people: operators, who sign in to build and sell tours, and visitors, who buy and play them. We collect different things from each.
If you're a visitor
You don't need an account. Buying a tour or redeeming a code gives you an access token, stored in a cookie on your device. We keep only a one-way hash of that token, so we can check your access without being able to reproduce the token itself.
| What | Why we have it | How long |
|---|---|---|
| Payment details | Handled entirely by Stripe. Card numbers never reach our servers. We store the amount, currency, Stripe session id, and the email address you gave Stripe, so we can support the purchase. | Kept while we may need it for accounting |
| Tour progress | Which stops you opened and completed, recorded against a hashed token, not your name or email. | Kept as tour analytics |
| On your device | Your access token, which stop you reached, and display preferences, in your browser's local storage. These stay on your device and are not accounts. | Until you clear your browser data |
We don't store your IP address against your tour activity, we don't use advertising or cross-site tracking, and we don't sell anything to anyone.
One thing worth being straight about: because purchase records and tour analytics both reference the same access token, they can in principle be connected. We describe the analytics as pseudonymous rather than anonymous for that reason.
If you're an operator
| What | Why we have it | How long |
|---|---|---|
| Account | Your name, email address, and either a password hash or a Google sign-in, so you can sign in. | Until the account is deleted |
| Admin activity log | Who changed what and when, plus the IP address the change came from, which we need to investigate mistakes and misuse. | The IP is erased after 90 days; the rest of the entry is kept |
| Abuse controls | A short-lived counter keyed to an IP address on sign-in, checkout, and code redemption. | Deleted within a day |
| Content you upload | Tour text, photos, audio, and recorded routes. Note that a route recorded in the field is a GPS trace of wherever the recorder walked or rode. | Until you delete it |
If you ask for early access
The form on this site asks for your name, work email, organization, and what kind of organization it is, plus anything you write in the message box. We use it to contact you about TourLab, and for nothing else. If a notification integration is configured, the submission is also forwarded to that service. Ask us and we'll delete it.
Who else processes this data
| Service | What it handles |
|---|---|
| Cloudflare | Hosting, the database, and file storage. |
| Stripe | Payments. Their privacy policy governs your card details. |
| Google Maps | Map tiles in the player. Loading a map sends your IP address to Google, as it would on any site with an embedded map. |
| Google Sign-In | Optional sign-in for operators. Only used if an operator chooses it. |
| ElevenLabs | Generates narration audio from text an operator writes. No visitor data is sent. |
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If you're in the EU or UK, you also have the right to complain to your data protection authority.
Contact
Contact details are being finalized ahead of launch. If you need to reach us in the meantime, use the early-access form on the home page.