The short version: we keep what we need, nothing else.

01 · your email is the whole account

Buyers are created from the email on their receipt. Guides sign in the same way. Nobody has a password — ever. Your ticket link and your login link both work like one, though: whoever holds the link holds the access, so treat it that way. If you think yours got out — a screenshot, a shared device — your ticket page has a one-tap way to kill it and get a fresh one by email.

02 · what stripe sees, and what we don't

Payment goes straight to Stripe. We never see or store your card number. On our side, a purchase is just an email, an amount, and which walk it was for.

03 · guide profiles are public on purpose

Display name, tagline, bio, city, languages, portrait, and links go live the moment a guide saves them — that's the whole point, it's how a walker knows who's talking to them. Nothing else about a guide account is public: not the email, not login activity.

04 · what stays on your phone

Downloaded station videos for offline walking are cached in your browser, on your device — not on our servers. Clearing your browser's site data clears them too.

We also set a few functional cookies — one to keep a guide signed in, one for founder-only dashboard access, and a short-lived one during checkout that makes sure the right browser gets the receipt. None of them track you across other sites or feed an ad network, so there's no cookie banner here — nothing to consent to.

05 · what we measure, and what we don't

We do measure how the app gets used — which walks get opened, where a walk loses people — so we can surface the good ones and fix the rest. That's computed straight from our own database, not a third-party analytics tool, and what we look at is aggregates — counts and rates, not a feed of what any one person did. It's for improving the walks, never for advertising or profiling, and your data is never sold. Payment runs through Stripe, and the photos and videos guides upload are stored with our hosting provider — the outside services we lean on are kept to what the app actually needs.

One thing we keep precisely: a purchase records which stop you're up to, so your permanent link can pick up where you left off on any device. That's tied to your purchase for as long as the purchase exists — which, like your access, is forever.

06 · maps, without the tracking

Google Maps only ever shows up as a tap-through link to the next stop — we don't embed their SDK or share your location with them. The guide's pin-drop map runs on Leaflet, using map data from OpenStreetMap and map tiles from CARTO — no account or key involved on our end.

07 · who runs this, and how to reach us

VidWalks is operated by Yoko GmbH, Zurich, Switzerland. For anything on this page — a question, a data request, a complaint about footage you appear in — write to hello@vidwalks.com. A person reads that inbox; we aim to reply within a few days and, for a formal request under the rules below, within one month.

08 · why we're allowed to hold this

We're selling in CHF to tourists in Swiss cities, so the Swiss FADP applies to every purchase, and GDPR applies too the moment a buyer is in the EU. Buyer and guide account data (email, purchase record, guide profile, walk progress) is processed because it's necessary to perform the contract you made with us — buying or selling a walk. The aggregate usage metrics on §05 run on legitimate interest: understanding which walks work, weighed against keeping what we look at to counts and rates, never a feed of one person's activity. Nothing here is processed for marketing, profiling, or ad targeting, so there's no consent basis to ask you for.

09 · who else sees it, and where

We keep the list of outside services short: Stripe processes payment, Resend delivers our emails, Cloudflare (R2) stores guide uploads, and Vercel hosts the app. All four see some slice of your data to do that specific job — Stripe your payment details, Resend your email address, Cloudflare and Vercel whatever passes through their infrastructure — and none of them get it for any other purpose. Some of these providers process data outside Switzerland and the EEA, including in the US; where that happens we rely on their standard contractual clauses as the transfer safeguard. We don't sell data to anyone, and there's no data broker in this list.

10 · how long we keep it

A purchase and its walk progress are kept for as long as the account exists — that's what makes the permanent ticket link work. Sign-in links and share links are single-use or time-boxed and swept out automatically once they're spent or expired; nothing there outlives its own purpose. Delete your account (§11) and this all goes away on the spot, not on our schedule.

11 · your rights, and using them yourself

Under FADP/GDPR you can ask to see what we hold on you, correct it, get a copy, object to how it's used, or have it erased. For a buyer, the first and last of those are self-service: open your ticket link and use “download my data” or “delete my account & data” right there — deletion takes effect immediately, cuts off that link and any share links made from it, and covers every walk bought with that email, not just one. Anything else, or a guide account, goes to hello@vidwalks.com. If you think we've gotten this wrong, you can also complain to the Swiss FDPIC or, if you're in the EU, your local data protection authority — we'd rather you told us first, but it's your right either way.