What the app stores and sends

Browsing does not require an account. If you choose to sign in, Google verifies your identity and sends a stable provider identifier. Google may also send your name and verified email address. The provider identifier, not the email address, identifies the account.

Interesting Iceland stores the provider identifier, account timestamps, hashed, revocable session records, and any name or verified email address Google provides to recognize the account and protect its sessions. Each session expires 30 days after sign-in. The app stores no Google access, refresh, or ID tokens and no password. Signing out revokes that browser's session. Deleting the account immediately invalidates the profile and every session. A minimal deletion record containing a hashed account identifier, deletion generation, status, and timestamps remains without automatic expiry so an older account record or backup cannot restore the deleted account. Bounded maintenance removes other account records left by an interrupted cleanup.

To limit abuse, the app keeps one bounded state.json file for each authentication rate limiter. The sign-in-start and callback files contain SHA-256 hashes derived from caller IP addresses, or from one shared fallback identity when no valid address is available, and accepted-attempt timestamps from the preceding 10 minutes. The account-deletion file uses hashes derived from account identifiers instead of IP addresses and contains accepted-attempt timestamps from the preceding 24 hours. Each file is pruned on access and during readiness checks, then removed when no active timestamps remain. Signing out creates no rate-limit record. These records are pseudonymous, not anonymous. Operational backups, when enabled, can retain account and rate-limit records after live deletion until the operator's retention and deletion process removes them.

Your language, local trip recovery data, the capability used to edit your saved trip, and the keys used to remove your own photo uploads are stored in your browser. You can remove this local data through your browser's site-data controls. Removing the trip edit capability removes this browser's access to update that saved trip.

Nearby asks the browser for your location only after you choose it. This app keeps the returned coordinates in memory for the open tab, does not add them to a link or browser storage, and does not include them in its own network requests. Your browser or device may use its own location services under its settings. Clearing Nearby discards the coordinates immediately.

Interesting Iceland stores a saved trip after you personalize My trip or request its share link. The record contains the stops and their order, trip and stop notes, language, and any generated guide. Anyone with the unguessable link can view the saved trip, so do not put sensitive information in trip notes.

Saved trips do not expire automatically. The public link does not grant edit access. A browser without the matching edit capability creates a separate trip and link when it makes a change.

Route and weather features send the locations needed for the request to OpenStreetMap-based routing services and the Icelandic Met Office. When you request an AI trip guide, selected stops, order, travel estimates, relevant place facts, and language are processed through OpenRouter and Google Gemini.

When you upload a photo, a processed copy and basic place context are sent through OpenRouter and Google Gemini for suitability checks. Provider privacy policies apply to their processing.

Map views load street tiles from CARTO using OpenStreetMap data and, when you select satellite imagery, tiles from Esri. CARTO and Esri receive the network information needed to deliver tiles, including your IP address and the map area requested.

Uploaded photos are public after approval. Embedded metadata is removed, and uploads are licensed under CC BY-SA 4.0. You can remove your own upload from the same browser for 12 hours after adding it.

If you rate an AI-generated guide, the rating and limited technical context are stored for up to 90 days.

When a PostHog analytics project is configured, Interesting Iceland records a small, fixed set of anonymous product-usage events: a page's route pattern (for example /place/[id], never the specific place, trip, or link), a map filter facet, a basemap or theme change, whether a search happened, a guide's slug, a place added to a trip, a trip share, and an error boundary's error name. No event carries a resolved place id, trip id, shared-trip link, search text, or location coordinate.

Analytics sets no cookie and uses no browser storage. Each browser tab holds a random identifier in memory only, discarded on reload and never linked to a previous visit or to a signed-in account. Analytics requests reach PostHog through this site's own domain rather than a third-party host; your device's precise location never leaves this app regardless of analytics. Analytics does not run at all when your browser sends a Do Not Track or Global Privacy Control signal, and does not run when no analytics project is configured.