Privacy policy
Who we are
Codemesh OÜ (“we”, “us”) operates westhighlandwayroute.com and the West Highland Way route planner. We are the data controller for personal data processed through this website.
Registered office: Tamme pst 82-2, 50405 Tartu linn, Tartu maakond, Estonia. Estonian Business Register code: 16540767.
Contact
- General enquiries: hello@westhighlandwayroute.com
- Privacy and data rights: privacy@codemesh.com
Who this policy covers
This policy applies to visitors and users of westhighlandwayroute.com, including the marketing pages and the /app planner. Shared trip pages under /trip/* are intended for people you share a link with; do not put sensitive personal data in trip notes you would not want others to see.
What we collect
Depending on how you use the site, we may process:
- Itinerary data: trip name, day stages, stops, notes, booking status, and related planning choices you enter.
- Email address: if you use “Email my plan” or save with an email address.
- Share and edit links: when you save or share a plan, we store the itinerary on our servers and issue URLs or tokens so the link works.
- Product analytics: event data about how the planner is used (e.g. opening
the app, viewing a POI), via PostHog, tagged by trail (
site_id). We do not intentionally collect the content of your notes in analytics events. - Error and performance data: technical diagnostics via Sentry when the app fails (e.g. error type, browser, page path). Session replay is disabled.
- Routing requests: when you route a plan, itinerary geometry is sent to our routing service to calculate walkable paths.
- Google Places content: when you open a POI with a Google listing, your browser loads Google Maps / Places UI Kit subject to Google’s terms.
- Browser storage: local drafts and session state until you save or share to the server.
- Server and security logs: standard hosting logs (IP address, user agent, timestamps) retained briefly for security and operations.
We do not require an account to use the planner at launch.
Why we use your data and lawful bases
Under the UK GDPR and EU GDPR (where applicable), we rely on the following bases. This table is a summary, not legal advice.
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Provide the planner, save/share trips, send edit-link email | Itinerary, email, tokens | Contract / steps at your request; legitimate interests (operate the service) |
| Product analytics (PostHog) to improve the planner | Usage events, device/browser metadata | Legitimate interests (understand use of our service). We use PostHog EU cloud with privacy-oriented settings and no advertising cookies at launch. |
| Error monitoring (Sentry) | Technical error data | Legitimate interests (security, reliability, debugging) |
| Walk routing | Itinerary coordinates | Contract / legitimate interests (deliver routing you request) |
| Hosting, security, abuse prevention | Logs, IP | Legitimate interests (secure and run the website) |
How long we keep data
- Saved trips: until you delete them or we remove inactive data as part of routine housekeeping (we may introduce a retention period for unused share links; this policy will be updated if we do).
- Email addresses: stored with the associated trip until the trip is deleted or you ask us to erase your data.
- PostHog analytics: per PostHog project retention settings (typically months, not indefinite).
- Sentry errors: per Sentry project retention (typically 90 days or less).
- Hosting logs: short operational retention (days to weeks).
- Local browser storage: until you clear site data or we change storage keys on deploy.
Email from us
When you ask us to email your plan, we send transactional messages from noreply@westhighlandwayroute.com through Resend. These emails contain your edit link, not marketing. Please do not forward edit links; anyone with the link may view or change your plan depending on the link type. For help, contact hello@westhighlandwayroute.com.
Who we share data with
We use subprocessors to run westhighlandwayroute.com. They process data on our instructions and under appropriate agreements. We do not sell your personal data.
- PostHog (EU): product analytics. posthog.com/privacy
- Sentry (EU): error monitoring. sentry.io/privacy
- Supabase: trip database. supabase.com/privacy
- Resend: transactional email. resend.com/legal/privacy-policy
- Google: Maps / Places on POI detail. policies.google.com/privacy
- Vercel: site hosting. vercel.com/legal/privacy-policy
- Cloudflare: map tile CDN (R2). cloudflare.com/privacypolicy
- Self-hosted routing (GraphHopper on our EU infrastructure): walk routing only; no separate commercial subprocessors for routing beyond our VPS provider.
International transfers
Codemesh OÜ is established in Estonia. We choose EU or UK hosting where practical (PostHog EU, Sentry EU). Some providers may process data in the United States or other countries under standard contractual clauses or equivalent safeguards. You may contact us for more information about transfers relevant to your data.
Your rights
If UK GDPR or EU GDPR applies to you, you may have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Delete your data in certain cases
- Restrict or object to certain processing
- Data portability where applicable
- Withdraw consent where processing is consent-based
- Lodge a complaint with a supervisory authority
To exercise rights, email privacy@codemesh.com. We respond within applicable time limits (typically one month). You may also complain to:
- Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
- UK: Information Commissioner’s Office (ICO), if you are in the United Kingdom
Children
The service is not directed at children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.
Changes
We may update this policy. The effective date at the top will change when we do. Significant changes may be highlighted on the site. Continued use after an update means you accept the revised policy.