Privacy Policy

KiyanoGo is a travel discovery app for Japan and South Korea. This page explains what happens to your data when you use it — in plain language first, then in the detail the GDPR requires.

The short version

• You can use the whole app without an account. If you do, your saved places and trips stay in your browser and are never sent to us.
• If you create an account, we store your email address and the places and trips you save, so they follow you to your other devices.
• We measure page views with a cookieless analytics tool. We do not build profiles, and we do not track you across other websites.
• We never sell your personal data. There is nothing to sell it for.
• You can delete your account, and everything in it, yourself from the profile screen.

Who is responsible

The controller for the processing described here is:

We are not required to appoint a data protection officer, so questions about your data come to the address above and are answered by us.

Using KiyanoGo without an account

This is the default. The places you save, the trips you build and your light or dark preference are stored in your browser’s local storage under the key kiyanogo.state.v1. That data stays on your device. It is not sent to our servers, it is not readable by us, and clearing your browser data removes it.

Storing it is technically necessary to provide the feature you asked for by tapping “save”, which is why it does not require separate consent under § 25 (2) no. 2 TDDDG. The profile screen offers a “Clear this device” control that deletes it in one step.

If you create an account

An account is optional and exists for one reason: syncing.

Accounts and their data are held by Supabase, acting as our processor under Art. 28 GDPR. Every table is protected by row level security, which means the database itself refuses to return one user’s rows to another user, rather than relying on our application code to remember to filter them.

When you sign in for the first time, anything you had saved as a guest on that device is merged into your account so you do not lose it.

Staying signed in requires a session cookie on your device. It is set only once you have an account and have signed in, it is necessary for the service to work at all, and it is listed on the cookies page.

Hosting and server logs

KiyanoGo is hosted by Vercel. Like every web server, theirs records requests — IP address, time, the page requested, the browser’s user agent — for delivery, security and troubleshooting. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in running a site that works and is not being attacked.

Analytics

We use Vercel Web Analytics to see which pages are read. It is cookieless: it does not store an identifier on your device and does not follow you to other sites. It reports page views and referrers in aggregate, and we use it to decide what to write more of.

The legal basis is Art. 6 (1) (f) GDPR. Our interest is in knowing whether the app is useful; the counterweight is small because nothing here identifies you or builds a profile. Because nothing is stored on or read from your device, § 25 (1) TDDDG does not apply.

KiyanoGo also raises an internal browser event when you open an outbound link, carrying the partner name, the page path and at most a city. That event is not sent anywhere. It exists so a measurement tool could be connected later, and it deliberately carries nothing about a person.

Things that load from other companies

When your browser fetches something from another company’s server, that company necessarily sees your IP address — that is how the internet delivers the file. Here is every case in KiyanoGo, and when it happens.

Everything in that table except the map tiles and the photographs happens only because you tapped something. KiyanoGo runs no advertising or affiliate script while you are simply reading — attribution is carried by the links themselves, so nothing has to watch you to earn it.

The flight search is the one place where a third party runs code inside a KiyanoGo page. It is confined to that page, and we block it from opening windows you did not ask for: one window per click, and nothing may push the page you are reading into the background.

The flight widget and the affiliate links are how KiyanoGo is paid for. If you book something after following one of them, we may receive a commission — at no extra cost to you, and it never changes what we recommend. See the cookies and tracking page for what these set on your device.

Transfers outside the EU

Some of the providers above are based in the United States or process data there. Where that happens, the transfer is covered by the European Commission’s standard contractual clauses, by an adequacy decision where one applies, or by the provider’s certification under the EU–US Data Privacy Framework. You can ask us which applies to a particular provider and we will tell you.

How long we keep things

• Guest data: until you clear it. It is on your device, not ours.
• Account data: until you delete your account. Deletion is immediate and cascades — removing the account removes the saved places and trips attached to it.
• Server logs: for the short period our hosting provider retains them for security and diagnostics.
• Analytics: as aggregate counts, with no record tied to a person.

Your rights

Under the GDPR you have the right to:

• ask what we hold about you and get a copy (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest, including the analytics described above (Art. 21)
• withdraw any consent you gave, at any time, without giving reasons

Two of these you do not have to ask us for. The profile screen has a Download my data button that gives you everything we hold as a JSON file, and a delete control that removes your account and its contents immediately. For anything else, write to info@theshortcutagency.de and we will act on it.

You can also complain to a supervisory authority. Ours is the Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, and you may equally complain to the authority where you live or work.

If you are outside the EU

United Kingdom. The same rights apply under the UK GDPR, and you may complain to the Information Commissioner’s Office.

California. We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. Use the same email address above.

Everywhere else. We apply the standard above to everyone rather than only to readers in Europe. If your local law gives you a right this page does not mention, write to us and we will honour it.

Children

KiyanoGo is not directed at children and we do not knowingly create accounts for anyone under 16. If you believe a child has created one, tell us and we will delete it.

Changes

If we change how any of this works, we change this page and move the date at the bottom. The date is written by hand, so it means what it says rather than tracking the last deployment.