Security and privacy

This page is for anyone who needs a straight answer before trusting us with something: a guide about to upload identity documents, a traveller about to type a card number, or an association deciding whether to tell its members we exist.

Your card details never reach us

Payment fields are hosted by Stripe and the details go straight from your browser to them. They do not pass through our servers and we could not store them if we wanted to. What we keep is what Stripe tells us afterwards: that a payment succeeded, for how much, and the last four digits.

Getting into an account

Two-factor authentication is available to everyone, in three forms: an authenticator app, a code by email, or a passkey using your device's own fingerprint or face. Staff accounts cannot opt out.

Worth being plain about one thing: an account is only as strong as its weakest enabled factor. Turning on a passkey does not stop somebody attacking the email codes you also have. We say so on the settings page too, rather than implying the methods add up.

What runs in your browser

The site sends a Content-Security-Policy that browsers enforce, so a script we did not put there is refused rather than run. Our analytics are self-hosted, which means no third-party analytics company receives your visit and there is nothing to disclose in a data-processing agreement. Maps, fonts and scripts are served from our own domain rather than from someone else's CDN.

Getting your data out, or deleting it

You can ask for a copy of everything we hold about you, and you can ask us to delete your account. Both are requests you can make from your own settings rather than by writing to us and hoping. Some records survive a deletion because the law requires it: an invoice for a completed booking is an accounting record, not a preference.

If something goes wrong

Backups are encrypted and stored away from the machine that runs the site, in Switzerland, so losing the server does not mean losing your bookings.

If you find a security problem, tell us through the contact page and choose the security option. We will confirm we have read it within two working days, and we will not take action against anyone who reports something in good faith.