Privacy Policy

Data controller

The data controller for Skiddo is Emil Auranen, who currently runs the service as a private individual.

For privacy questions and requests, please get in touch by email: emil.auranen@hotmail.com. This is also the address to use for requests concerning personal data.

What data do we handle?

It helps to separate two things: the data the service itself uses, and the ordinary technical connection data that any website visit creates.

• Your device location, when you ask for location-based results and grant the browser permission.
• The location you select or search for yourself, which may be remembered in your browser.
• The child's age you select, which is stored only in your browser.
• Your language choice (Finnish, Swedish or English).
• Feedback you send through the form, plus your optional email address.
• The page path the feedback was sent from, and the technical timestamps of the entry.
• Ordinary technical connection data (such as IP address and browser request details) handled by the technical platforms and network providers behind the service.

Skiddo does not ask for a name, date of birth, address or other identifying details during normal use of the service.

Your location

You can use Skiddo in two ways: by selecting or typing a location yourself, or by asking for results based on your device's current location. Location is never required — the service works fine when you pick a place manually.

When you ask for your current location, the browser requests permission separately. Skiddo receives no location at all before you grant it. Skiddo does not request the browser's high-accuracy positioning mode, but the accuracy of the location the browser returns can still vary.

• Device coordinates are used transiently during that use.
• They are not written to browser storage (localStorage).
• They are not stored in Skiddo's database.
• They are not added to the Skiddo page URL.
• In the capital region, the area can be resolved entirely in your browser using locally bundled area outlines.
• If local resolution doesn't succeed, the coordinates may be sent transiently to a Skiddo server function, which may use Nominatim/OpenStreetMap for reverse geocoding. Skiddo does not store the coordinates at that stage either.

Location (either your device location or the place you chose) is also used to fetch weather from Open-Meteo directly from your browser, and to query nearby places and events from Supabase using map-bounds values. As part of the normal network connection, these services also see your IP address.

Your child's age

You can choose a child's age so the content fits better. It is a single whole number between 0 and 12, and it involves no identification of the child in any way.

• The age is stored only in your browser as part of your preferences.
• No child's name, date of birth or email is requested or stored.
• No account or identifier is created for a child.
• The age is not sent to Skiddo's database, not to Supabase as a preference, and not to third parties.
• The age is used locally to filter content and order recommendations.

What is the data used for?

Data is used to run the service and to improve it based on feedback.

• Showing suitable activity ideas.
• Finding places and events nearby.
• Taking the weather into account in suggestions.
• Remembering the preferences you chose, on your own device.
• Receiving, handling and replying to feedback.
• Operating, securing and debugging the service.

Recommendations are contextual: the child's age, location, weather and time of day may affect the order content appears in at that moment. Skiddo does not build a lasting behavioural profile from this and keeps no history of clicks, viewed content or interests tied to a user identifier.

Browser storage and cookies

The service uses the following data stored in your browser:

• pp.prefs.v1 – browser localStorage. Remembers the selected child's age and the location you chose (an identifier for catalogue places, and coordinates for searched locations). No automatic expiry: it stays until you change it or clear the site data in your browser.
• skiddo_locale – a first-party functional cookie that remembers your explicit language choice. Valid for roughly one year.
• __cf_bm – a Cloudflare infrastructure cookie for security and bot management. Valid for about 30 minutes.
• __dpl – a technical hosting cookie related to pinning the deployed version. Valid for about 24 hours.
• Your browser's session storage may hold ordinary technical navigation state, such as scroll position restoration.

Skiddo currently uses no analytics cookies, advertising cookies, marketing tracking or behavioural tracking. That is why there is no cookie banner: the only storage in use is the functional and technical storage described above.

Feedback and email

When you send feedback, we store what you entered in the form. The email address is optional and is used only to get back to you about your feedback — never for newsletters or marketing.

• The feedback type, i.e. the topic.
• The message you wrote.
• An optional email address.
• The page path the feedback was sent from.
• Technical timestamps and the row identifier.

Feedback is not sent together with the child's age, device coordinates, your chosen location, a browser identifier or any persistent user identifier. Feedback is kept for a maximum of 12 months: an automatic daily cleanup deletes older rows. Feedback cannot be read, edited or deleted from the browser — only administrative access can reach it. Please avoid writing unnecessary personal details into the free-text field.

External services

A few external services are needed for Skiddo to work. The ones below may receive a visitor's technical or personal data.

• Supabase – content database and feedback storage. Your browser reads public place and event data directly, and nearby queries include map-bounds values derived from a location. The database is hosted in London, United Kingdom. Skiddo does not build a visitor profile from these reads.
• Open-Meteo – weather forecasts. Your browser fetches the weather directly using coordinates passed at roughly four decimal places, and the service sees your IP address through that connection. We do not call that coordinate anonymised. Open-Meteo geocoding may also be used via Skiddo's server.
• OpenFreeMap and OpenStreetMap – map tiles. Your browser requests tiles directly from the provider, which sees ordinary connection data such as your IP address. A tile URL does not contain your exact device coordinate, but the tiles you view naturally reveal the geographic area being looked at.
• Nominatim / OpenStreetMap – place lookup and reverse geocoding. In the documented flows these calls are made through Skiddo's server, so the provider sees Skiddo's server connection. Typed searches are not stored.
• Cloudflare – traffic delivery, security and bot protection. Handles ordinary technical connection data and sets the infrastructure cookie described above.
• Lovable – the technical hosting platform. According to the provider's documentation, operational log data may include things like IP address, approximate location derived from the connection, browser and device details, pages and features accessed, timestamps and debugging information, and it may be retained for up to 90 days. This is hosting, security and troubleshooting processing — Skiddo does not build visitor analytics from it.
• Google Maps – opens only when you deliberately choose directions. The URL carries the destination place or event location; Skiddo does not add your current location to it. Once you move over to Google, Google's own privacy practices apply.

Transfers outside the EU/EEA

Skiddo's Supabase database is hosted in London, United Kingdom, which is outside the EU and EEA. The European Commission currently recognises the United Kingdom as providing an adequate level of data protection.

Some technical providers, such as hosting and network partners, may run internationally distributed infrastructure. For that reason we do not claim that all processing happens inside the EU/EEA, and we do not name a country for log processing that we have not verified ourselves.

Retention periods

Retention matches what the service actually stores:

• Current device location: not stored persistently by Skiddo.
• The location you chose: in your browser until you change it or clear site data.
• Child's age: in your browser until you change it or clear site data.
• Language cookie: about one year.
• Infrastructure cookies: __cf_bm about 30 minutes, __dpl about 24 hours.
• Feedback: a maximum of 12 months. The hosting platform's operational log data may, according to the provider, be retained for up to 90 days.

Legal bases for processing

In short, processing rests on the following grounds:

• Delivering the features you asked for: the processing is needed to give you exactly the result you requested (for example nearby places or a weather-aware suggestion).
• Receiving, handling and replying to feedback: legitimate interest.
• Operating, securing and debugging the service: legitimate interest in providing a working and protected service.
• Functional preferences stored in your browser: processing needed for the service to work, which you can change or delete yourself.

The browser's location permission is a technical permission under your control. On its own it is not a complete description of a legal basis under the GDPR, and granting it should not be read as automatic GDPR consent.

Your rights

You have the rights to your personal data that the GDPR provides. In practice, with Skiddo they mostly concern feedback, since other data stays in your own browser.

• The right of access to your data.
• The right to have data corrected.
• The right to erasure.
• The right to restriction of processing.
• The right to object to processing where applicable.
• The right to data portability where applicable.

Skiddo has no user accounts and no persistent user identifier. Preferences stored in your browser, such as the child's age or chosen location, therefore generally cannot be linked by us to an identified person, and we cannot retrieve them remotely — you can change or delete them yourself in your browser. For matters concerning feedback you have sent, contact emil.auranen@hotmail.com.

Managing the location permission

Using your location is always voluntary and you stay in control of it.

• You can decline location access when the browser asks for permission.
• You can use the service by picking a place manually, without any location permission.
• You can withdraw a permission you granted earlier in your browser or device settings.

Children's privacy

Skiddo is meant for parents and other adults looking for things to do with children. The service creates no accounts and no identifiable profiles for children.

The selected child's age is only a content preference that stays on your device. Normal use of the service never asks for a child's name, date of birth, email or other contact details.

Analytics and advertising

At the moment, Skiddo has no:

• visitor analytics,
• advertising trackers or marketing pixels,
• personalised advertising,
• marketing profiling.

The site's fonts are self-hosted, so a normal page load makes no requests to Google's font service. This policy describes the service as it works today.

Right to lodge a complaint

If you believe your personal data has been handled contrary to data protection law, you have the right to lodge a complaint with the supervisory authority. In Finland that is the Office of the Data Protection Ombudsman.

Changes to this policy

This policy is updated if the way Skiddo handles data changes. The current version can always be found on this page.