Ścieżkami

Privacy policy

Last updated: 3 October 2026. This is a translation; the Polish version is binding.

Ścieżkami is a free, non-commercial road-trip planner. You do not create an account and you do not give us your name or email address. The service sets no cookies of its own and shows no advertising. Aggregate visit statistics come from Cloudflare Web Analytics, which stores nothing on your device. Like any website, the service also processes the technical data needed to deliver its pages. We describe all of this below as required by Article 13 GDPR.

1. Controller

The controller is Pavel Novikau. For data protection matters write to [email protected]. No data protection officer has been appointed, because none is required.

2. What we process

  • Connection data: IP address, date and time, the address of the page you open (including a place name you type, if it is part of the address), the response code, the referring page and your browser's User-Agent.
  • Chosen places and stops: your browser sends them to our server so that it can calculate the route. We do not link them to you and do not keep them beyond the server logs described above. Routes are calculated on our own server, without third-party navigation services. A share link carries your selection in the page address.
  • Visit statistics: the Cloudflare Web Analytics script sends Cloudflare the address of the page you open, the referring page, your device type, browser and operating system, your country (derived from your IP address) and technical page-load measurements (load timings, Core Web Vitals, memory use). It uses no cookies or browser storage and gives you no persistent identifier: each page load gets a one-off random number. We receive only aggregate numbers, never data about individual visitors. The script does not run if your browser sends a Global Privacy Control or Do Not Track signal.
  • Messages: if you write to us, we process your email address and your message.

3. Purposes and legal bases

  • providing the service and calculating the routes you ask for: Article 6(1)(f) GDPR (legitimate interest in running the service);
  • security, protection against abuse and attacks, and fixing errors: Article 6(1)(f) GDPR;
  • aggregate visit statistics, to learn which pages and routes are used and to improve the service: Article 6(1)(f) GDPR;
  • answering your messages: Article 6(1)(f) GDPR.

4. Recipients

  • Cloudflare, Inc. carries traffic to the service (CDN, encryption, attack protection) and keeps the visit statistics (Cloudflare Web Analytics) as a processor under a data processing agreement. Data may be transferred to the USA. The transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which Cloudflare participates, and on standard contractual clauses. Cloudflare privacy policy.
  • UpCloud Ltd (Finland) is the provider of the virtual server in Warsaw through which connections reach our server. It acts as a processor. UpCloud privacy policy.
  • The service itself, its database and its logs run on the controller's server in Poland.
  • Your browser loads maps and photos directly from third-party servers: map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom) and photos from Wikimedia Commons (Wikimedia Foundation, Inc., USA). They receive your IP address and browser details and process them under their own policies: OSMF privacy policy, Wikimedia Foundation privacy policy.

We do not sell data or share it with advertisers.

5. How long we keep data

  • Server logs: up to 30 days, then deleted automatically.
  • Visit statistics: Cloudflare keeps the full data for 7 days, then only an aggregate sample (about 10%), which it makes available to us for 6 months.
  • Other data held by Cloudflare: under the data processing agreement.
  • Messages: as long as needed to answer and resolve the matter.

6. Cookies and browser storage

The service sets no cookies of its own and uses no advertising tools. The visit statistics script (section 2) stores no cookies or other data on your device. If you do not want it to run, turn on the Global Privacy Control or Do Not Track signal in your browser, or block static.cloudflareinsights.com. If you choose an interface language yourself, we remember the choice in your browser's storage (localStorage, key sciezkami.locale) so that the next visit uses it. This entry never leaves your device and is needed for the service you asked for. You can delete it by clearing the site data in your browser. In exceptional cases Cloudflare may set a technical cookie that only protects against attacks and automated traffic (e.g. __cf_bm, cf_clearance). It is not used for tracking or advertising.

7. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17) and restriction of processing (Article 18). You may also object to processing based on legitimate interest (Article 21). Server logs contain nothing that lets us identify you, so to exercise these rights we may need extra information from you, such as the approximate time of your visit (Article 11 GDPR). You may lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

Right to object. You may object at any time to the processing of your data for visit statistics (Article 21 GDPR): write to us, or turn on the Global Privacy Control or Do Not Track signal in your browser (section 6).

8. Voluntariness and profiling

Connection data is necessary for your browser to load the pages; the service cannot work without it. We make no automated decisions and do no profiling.

9. Changes

We announce changes on this page and give the date of the last update at the top. Data sources and licences are listed on the Data sources and licences page.