Privacy at ZikZak
Last updated: 30 October 2026.
ZikZak turns your travel photos into a map of your trips. It is private by default: your photos are read in your own browser, and nothing is sent to us unless you create an account, save your atlas to the cloud or share it.
Who runs ZikZak
ZikZak is a free, non-commercial project run by Fredrik Berggreen, Holte, Denmark, who is the data controller. Contact: hello@zikzk.com.
What stays in your browser
Without an account, your photos, places, trips and settings are kept only in your browser (IndexedDB) on your device. We never see them.
What we store if you create an account
- Your account: your email address, a hashed password and a hashed recovery code (or your Google account ID if you use “Continue with Google”), when the account was created, whether your email is confirmed and your email settings.
- Your cloud atlas, if you save it: resized copies of your photos (with camera data such as GPS removed) and your trips, places, home and notes, so you can open your atlas on another device.
- Shared atlases, if you make yours public: a separate, view-only copy for the link. It leaves out your home, exact locations (rounded to about 1 km), file names and account details. Anyone with the link can see it until you make it private. Shared pages are not indexed by search engines.
- Discover, only if you switch it on: for each place you choose, its name and country, a position rounded to about 2 km, the month, the photos you chose (re-encoded copies at up to 1280 px, with all photo metadata such as GPS, camera and time removed), the line you wrote for it, and your first name. A random code (not your email or account ID) links these to you. Nothing is stored about who looks at Discover or opens your places – we keep no visit log or view count – apart from a short-lived counter per signed-in user that limits how many searches can be made (to stop scraping).
- Plan together, if you use it: the Someday country, its places to see and each member’s display name (never an email).
- Security records: attempt counters that stop password guessing, stored under a one-way hash of the IP address and email, never in readable form.
An email sign-up that is never confirmed is deleted after 30 days, as long as nothing was saved, shared or planned with it.
Why we use your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your account, cloud save, sharing and Plan together | Email, password or Google ID, atlas, photo copies | Contract – providing the service you asked for (Art. 6(1)(b)) |
| Discover: showing the places you chose to other signed-in users | Place, rounded position, month, chosen photos, your line, first name | Consent – you switch it on per trip, photo or Someday place, and can withdraw at any time by switching it off; the data is then deleted at once (Art. 6(1)(a)) |
| Discover search limits (to stop scraping) | A short-lived counter per signed-in user | Legitimate interest in keeping the service safe (Art. 6(1)(f)) |
| Confirmation and welcome email | Contract (Art. 6(1)(b)) | |
| Memory emails (trip anniversaries, a seasonal reminder) | Email, trip names and dates | Legitimate interest in reminding you of your own trips (Art. 6(1)(f)). Object at any time with Unsubscribe in any email or in Settings. |
| “Notify me” for the poster | Consent – you asked for it (Art. 6(1)(a)) | |
| Security: rate limits, fraud and abuse | Hashed IP and email | Legitimate interest in keeping accounts safe (Art. 6(1)(f)) |
| Map tiles, place names, place search, Plan it photos, home suggestion | IP address (sent by your browser), rounded positions, words you search for | Legitimate interest in showing the map and naming places (Art. 6(1)(f)) |
| Usage statistics (Google Analytics) | Screen and feature counts, a cookie ID | Consent, only if you tap Allow (Art. 6(1)(a)) |
| Telling the owner about new sign-ups and Notify me requests | Email, time | Legitimate interest in running a small service (Art. 6(1)(f)) |
| Answering your emails and requests | Whatever you write | Legitimate interest, or a legal duty for rights requests (Art. 6(1)(f), (c)) |
You don’t have to give us anything: an account is only needed for the cloud features. We don’t make automated decisions or profiles about you, and we never sell data or show ads.
Emails
- Confirm your email: after signing up with email, one email to confirm your address.
- Welcome and memory emails: once your email is confirmed, a welcome email and occasional memory emails, for example on the anniversary of a trip (at most once a week). Every email has a one-click Unsubscribe link, and you can switch them off in Settings at any time.
- Notify me: if you ask to hear when the poster is ready, we keep your email address and the time only to send that one email, then delete it. We also delete it if we drop the poster, if you delete your account, or if you ask us to.
Who receives data
- Vercel (USA; our servers run in Frankfurt) hosts the website and the cloud API. Like every web host, it keeps short-lived technical request logs, which include IP addresses.
- Neon (database in Frankfurt, Germany) stores accounts and cloud atlases.
- Resend (USA) sends our emails and keeps delivery logs.
- ImprovMX forwards email sent to hello@zikzk.com, and Google (Gmail) holds the owner’s mailbox. That mailbox also receives a short note with the email address of each new sign-up and each Notify me request.
- Google: “Continue with Google” if you choose it, and Google Analytics only if you tap Allow. Analytics records which screens and features are used. It never records names, places, emails, photos or links, and Google signals and ad features are off.
Other ZikZak users, if you switch on Discover: other signed-in users see the places, photos, line and first name you chose. They see these in their browser and could take a screenshot – we can’t stop that.
These services also see your browser’s IP address, as any website you open would. They are independent services, not working on our behalf:
- OpenFreeMap (map labels and roads) and Esri (satellite imagery via ArcGIS Location Platform, USA) send the map tiles. Your browser fetches them directly, so these services see your IP address and the page it was loaded from, as with any website; no account data is sent.
- OpenStreetMap Nominatim gives better place names. For places the app isn’t sure about, your browser sends the position rounded to about 1 km (no photos, dates or account details), and answers are kept in your browser. When you search for a place in Someday, or press Enter in Plan it while Photon is unavailable, only the words you type are sent.
- Photon by Komoot (Komoot GmbH, Germany; OpenStreetMap-based search) suggests places as you type in Plan it’s “Add a place…” and in Discover’s search. Only the words you type and the country’s two-letter code are sent – no position, photos or account details.
- Wikipedia and Wikimedia Commons (Wikimedia Foundation, USA) supply the photos in Plan it. Only the names of well-known sights are sent.
Suggesting your home town: while no home is set, the app asks our server once for the rough city of your IP address, worked out by Vercel. We don’t store the IP address or the city, and nothing is saved unless you tap Yes.
Outside the EU: where data goes to the USA (Vercel, Resend, Google, Esri, Wikimedia), the providers rely on the EU–US Data Privacy Framework or the EU’s Standard Contractual Clauses.
Cookies and storage on your device
| Name | What it’s for | Set by | How long |
|---|---|---|---|
zz_session (cookie) | Keeps you signed in. Strictly necessary. | ZikZak | 30 days, or until you sign out |
_ga, _ga_PY4QS5DH2K (cookies) | Google Analytics: tells visits apart. Only after you tap Allow. | 2 years; deleted when you switch analytics off | |
zz-consent (local storage) | Remembers your analytics choice | ZikZak | Until you clear site data |
Other zz-… keys (local storage) | App state: cloud and sharing sync status, whether you’ve seen the “make public” note, map choices, and cached Plan it photo credits (refreshed after 30 days) | ZikZak | Until you clear site data (sync keys go when you sign out) |
| Discover keys (local storage) | If you share in Discover: the codes of photos your browser has already sent, so they aren’t sent twice. Visiting someone else’s places as a guest stores nothing on your device. | ZikZak | Until you clear site data or sign out |
zz-plan-invite (session storage) | Holds a Plan together invite while you sign in | ZikZak | Until the invite is used or the tab is closed |
| IndexedDB “zikzak” | Your atlas, photos and settings on this device | ZikZak | Until you clear site data |
Change your analytics choice at any time in Settings → Privacy. Withdrawing consent doesn’t affect what was collected before.
How long we keep it
- Your account and cloud atlas: until you delete them.
- A public copy: until you make your atlas private or delete your account. The link name stays reserved for you, so you can turn the same link back on.
- Discover copies: while that place, photo or trip is switched on; deleted at once when you switch it off, stop sharing in Discover, delete your photos or delete your account.
- Unconfirmed email sign-ups: 30 days, as above.
- Notify me: until the one email is sent.
- Google Analytics data: up to 14 months at Google.
- Emails to hello@zikzk.com: as long as needed to answer, then deleted.
Deleting your data
- Settings → Danger zone → Delete all photos removes every photo and the saved atlas from the cloud and keeps the account.
- Delete account, at the bottom of Settings, removes everything we hold about you, straight away, including Notify me requests and plans.
- Clearing your browser’s site data removes the atlas kept in your browser.
Your rights
You can ask for a copy of your data, and to have it corrected, deleted, restricted or handed over in a machine-readable format. You can object to anything based on legitimate interest, including memory emails, and withdraw consent at any time. Write to hello@zikzk.com and we’ll answer within a month. If you’re unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
Age
ZikZak is for people aged 13 and over. If you’re younger, please ask a parent or guardian to help you.
Changes
If this policy changes in a way that matters, we’ll update the date at the top.