Privacy

This privacy policy explains which personal data we process when you use WorldTrace, why, and for how long. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

Deckwerth IT
Ruben Deckwerth
8117 Fällanden, Switzerland
Email: [email protected]

Contact us at this address for any privacy question or to exercise your rights. We will give you a postal address on request.

EU representative: we have not yet appointed a representative under Art. 27 GDPR. We will appoint one once our service reaches a corresponding scale in the EU. Until then, please contact us directly; we handle requests from the EU just like all others.

2. In short

3. Visiting the website

Server logs. On every request our host processes technically required data: IP address, time, requested address, amount of data, status code, referring page and browser identifier. We use these logs only to keep the service running, fix errors and fend off attacks. They are deleted after 30 days at most, unless an entry is needed to investigate a specific security incident.

Protection and delivery network. The website runs through Cloudflare's network. Cloudflare forwards requests, blocks attacks and caches public content. In doing so it processes your IP address and the technical request data.

Visitor statistics. To understand which pages and features are used, we count visits with Matomo (stats.steady.gmbh). Matomo sets no cookies for us, shortens the IP address and respects the browser's “Do Not Track” setting. Visits are not linked to your account.

Abuse protection. We store failed sign-ins and sign-ups together with the IP address or the email address entered, to slow down automated attacks. These entries are deleted after 24 hours.

Camera allowance without an account. Without an account you can open a limited number of cameras per day. To do so, your session remembers which cameras you opened today.

Measuring advertising. If you reach us through an ad or a link with campaign tags, your session remembers where you came from: campaign tags in the link (for example utm_source, utm_campaign), the ad network's click ID (for example gclid from Google or fbclid from Meta), the referring website and the first page you opened. If you sign up or buy a plan, we store these details with your account. This shows us which channels lead to sign-ups and purchases. Matomo only receives the type, value and channel of the conversion, not linked to your account. If you came through a Google ad, we send Google Ads the click ID with the time and value of the conversion, but no email address and no other account data. We set no additional cookies for this.

4. Cookies and browser storage

We only use cookies that are needed to run the service:

The map keeps your view in your browser's local storage, for example map position, active layers, base map and camera filters. This data stays on your device and is not sent to us. You can delete it at any time in your browser settings.

The map asks for your location or for notifications only when you use the related feature ("my location", geofence alerts). You grant and withdraw that permission in your browser.

5. Account, settings and subscriptions

Account. When you sign up we store your email address, optionally your name, your password as a one-way hash, and the time of sign-up.

Sign-in with Google. If you choose “Continue with Google”, the website redirects you to Google (Google Ireland Ltd., Ireland; Google LLC, USA). After your consent, Google sends us an identifier of your Google account, your email address, whether it is verified, and your name. We store the identifier and the email address to recognise you; we never receive a Google password. You can disconnect it in your account once you have set your own password.

Settings. When you are signed in, we store your favourites, geofences (name, centre, radius and watched categories), base map, active layers and language so they are available on every device. Geofence alerts are evaluated in your browser, not on our server.

Usage counters. To apply your plan's limits we count cameras opened per day and AI briefings per month. We do not store in your account which cameras you watch.

API. If you create an API token on the Team plan, we store only its hash.

Contact form and email. If you write to us through the contact form or by email, we process your name, email address, topic and message to answer your request, and delete them once it is resolved and no retention duty applies. After a payment we send a receipt with a link to the invoice to your email address. To confirm your address, reset your password or confirm a cancellation we send you one-time links; we only store an irreversible hash of them, deleted after use or expiry.

Payments. Paid plans are processed by Stripe. You enter your payment details (such as your card number) directly with Stripe; we never receive them. Stripe sends us a customer and subscription ID, the plan purchased, the amount and the payment status. Stripe processes some payment data under its own responsibility, for example to prevent fraud and meet legal obligations. The Stripe privacy policy also applies.

Cancellations. If you cancel via "Cancel contracts here", we store your name, email address, contract, type, timing and, where given, the reason, and send a confirmation by email to you and to us. We keep this record as proof for ten years.

Deletion. You can delete your account at any time on the account page. Your account, settings and usage counters are deleted immediately and any running subscription is cancelled. We keep payment records for ten years because Swiss law requires it (Art. 958f Code of Obligations).

6. Content your browser loads directly from third parties

We serve fonts, code libraries and country borders from our own server; no connection to Google or other providers is made for them.

To keep the map fast and show images in original quality, your browser loads some content directly from the providers below. For technical reasons they receive your IP address, browser details and the requested address. We have no control over how they use this data; their own privacy policies apply.

External links (for example to MarineTraffic, LiveATC or camera websites) open the provider's own site, whose terms then apply.

7. Services we use without your personal data

Our server fetches the map data (flights, ships, earthquakes, events, news, markets and so on) from the sources. They learn nothing about you.

Place search: our server forwards search terms to OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom) without your IP address. We cache results for one day, with no link to you or your account.

AI briefing: for a briefing our server sends the selected map area or country and the related public map data to Anthropic's Claude API (Anthropic PBC, USA). No information about you or your account is sent.

8. Where the map data comes from, and people in it

We obtain the data shown from publicly accessible sources. The full list with licences is under Sources & method. The main ones:

Some of this data may relate to people: registrations, call signs and positions of privately used aircraft, names and positions of ships, people or vehicles visible in camera images, and names in headlines and market titles. We only show this data as the sources publish it. We do no face or licence-plate recognition, build no profiles of people and do not combine the data with other information.

Retention: flight positions are kept only for the live display (a few minutes), ship positions for at most 24 hours. We do not store camera images; if an image is relayed through our server it is cached briefly at most. News and markets are replaced with every update.

Legal basis: our legitimate interest, and that of the public, in presenting publicly accessible information about world events clearly (GDPR Art. 6(1)(f)). Informing each person concerned individually is impossible or would involve disproportionate effort (GDPR Art. 14(5)(b), FADP Art. 20).

Objection: if you are recognisable in a camera image, operate an aircraft or ship, or are otherwise concerned, you can object to the display. Email [email protected] naming the camera, registration or MMSI. We will review the request and hide the data unless overriding interests prevail. The operator of each source is responsible for the data at the source itself.

9. Who receives your data

Service providers that process data on our behalf are bound by contracts that oblige them to protect it.

10. Transfers abroad

Data may reach the EU/EEA, the United Kingdom and the USA, and camera images may reach other countries worldwide depending on the operator (section 6). Under Annex 1 of the Swiss Data Protection Ordinance, the EU, the EEA and the United Kingdom provide adequate protection. For the USA we rely on the recipients' certification under the Swiss-US or EU-US Data Privacy Framework and, where there is none, on the European Commission's standard contractual clauses as recognised by the Swiss FDPIC.

11. Purposes and legal bases

We process personal data to provide the website and your account and to perform our contract with you (GDPR Art. 6(1)(b)), to meet legal obligations such as keeping accounting records (Art. 6(1)(c)), and in our legitimate interest in running a secure, stable and fast service and in measuring which advertising works (Art. 6(1)(f)). You can object to advertising measurement at any time by email; we then delete the origin details stored with your account. Where we ask for your consent, for example for location or notifications in the browser, you can withdraw it at any time (Art. 6(1)(a)). We make no automated individual decisions and build no profiles.

12. Security

Connections are encrypted with HTTPS. Passwords and API tokens are stored only as hashes. When your password changes, all other sessions are signed out.

13. Your rights

You can ask for access to your data, have it corrected or deleted, object to processing, ask for it to be restricted, and receive your data in a common format. You can see and change much of it directly in your account, and delete the account there yourself. For everything else, email [email protected]. We may ask for proof of identity if we cannot otherwise match the request to an account with confidence.

We grant these rights to all users, whatever country you live in.

You can complain to a supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. In the EU it is the authority of the country you live in, elsewhere the authority responsible there.

14. Age

You must be at least 16 to create an account.

15. Changes

We update this policy when our service or the law changes. The version published on this page applies.

Last updated: 27 October 2026