What this site knows about you, and what it does not

Wejha is built and run by JCI Gremda, a volunteer chapter of Junior Chamber International in Tunisia. Nobody is paid by this site, and the site sells nothing.

Anything on this page can be asked about at the address at the bottom of it, and it is read by the people who build the site.

Signing up with an email address asks for three things: the address, a display name you choose, and a password. The password is never kept as you typed it. Only a hash of it is stored, and nobody here can read it back.

Signing in with Google asks Google for two things and nothing more: your email address and your basic profile. Google hands back your name, your address and a link to your profile picture, and those are stored on your account row together with the tokens that prove the sign-in happened. The picture is never shown anywhere on the site. Avatars here are drawn from the initials of your display name.

The name on a Google profile is usually somebody's real name, so it is never published by accident. A new Google account cannot write anything at all, no trip, no review, no vote, no upload, until its owner has been through the welcome step and either kept that name or replaced it. Whatever is chosen there is the only name this site ever shows.

Your email address is used to sign you in and to carry account messages: confirming an address, resetting a password, approving a change of address, confirming a deletion. It is never shown on a public page.

Trips, reviews, ratings, votes, photos, videos and adopted routes are public from the moment you publish them. Anyone can read them without an account and a search engine can index them. They carry the display name you chose, never your email address.

So treat a photo the way you would treat a postcard pinned to a wall. A face, a number plate, the front of a house: whatever is in the frame is visible to everybody. There is no private mode and no friends-only mode in this version of the site.

A sign-in cookie, so that the next page you ask for is still you. Signing in with Google sets two more cookies for the few seconds you are away at Google, and they are gone when you come back. One further cookie remembers which of the three languages you read in.

Every session is a row in the database, and the address and browser that opened it are stored on that row. That is what the sessions page in your account settings reads back, so that you can see where you are signed in and end a session you do not recognise. Those rows go when a session ends, and all of them go when the account does.

The site counts requests so that it cannot be hammered. Sign-in and password attempts are counted against the calling address, uploads and votes against your account. The counters are short-lived and hold no content of any kind. The servers also write ordinary logs of paths and errors, which is the one other place an address can appear in passing.

There is no analytics on this site, no advertising, and no tracking code of any kind. No page loads a third-party script. Even the fonts are served from this site rather than fetched from a font provider.

The feedback form, opened from the button on every page or from the link in the footer, is the one form on this site that works without an account. It stores the category you picked, the words you wrote, the page you were on and the language you read in, and nothing else. Sent signed in, the report is marked as your account's; sent signed out, it belongs to nobody. Signed in, you can also attach up to three images to a report. They are stored in the same place as the photos on this site, which means anybody holding the link to one can open it without signing in, even though that link is published nowhere and appears on no page, so attach nothing you would not put in a public gallery. Attachments are deleted when you delete your account, unlike the words of the report, which stay behind with the link to the account removed. Reports are read by the people who build the site and by nobody else.

The database is Neon Postgres, in Frankfurt, in the European Union. The site itself runs on Vercel, pinned to that same Frankfurt region so that a page and its data sit beside each other. Photos and videos are kept in Supabase Storage.

Media never passes through this site's servers. When you upload, your browser is handed a signed link that expires within the half hour and sends the file straight to storage. Photos come back through this site's own image optimiser, but a video plays straight from the storage host, which therefore sees the address of the browser playing it.

Account messages, when this site sends one, go through an email service that necessarily sees the address a message is addressed to. The map draws its tiles from OpenStreetMap, so opening the map means your browser asks that project for images and it sees your address. Apart from those, and Google when you choose to sign in with it, no page here sends your browser anywhere else.

What Google gives us is used for one purpose: signing you in and filling in the account that sign-in creates. It is not sold, not used for advertising, not passed to anybody, and not used to build a profile of you.

Wejha's use and transfer of information received from Google APIs to any other app follows the Google API Services User Data Policy, including its Limited Use requirements. You can review or withdraw that access at any time from your own Google account settings. Withdrawing it does not delete anything stored here, which is what the next section is for.

Any trip, review or photo can be deleted from the page it sits on, at any time, without asking anybody. Deleting a gallery deletes the files behind it from storage as well, unless another one of your own posts still shows the same photo.

The account itself can be deleted from your account settings. It asks for your password, a sign-in from the last day, and a click on a link sent to your address, in that order, because it is the one thing here that cannot be undone. What goes with it: the account, its trips, its reviews, its ratings and votes, its routes, and every photo and video file it ever uploaded. If storage refuses to delete even one of those files, the whole deletion is refused and you are told so, rather than reported as done while the files sit in a bucket.

Not everything goes, and it is fair to know what stays before you press the button. If somebody adopted one of your routes, their trip carries a credit line holding the route's title and your display name as both stood on the day they adopted it. Deleting your account takes the link away and the line then reads that the trip is no longer available, but the display name recorded at that moment stays on their page. It is a citation of something that really happened, and it is what stops an adopted route reading as its adopter's own idea.

Feedback sent through the feedback box also stays, because a report describes the site rather than the person who sent it. The moment the account goes, the report's link to it is cut, and nothing ties those words to a name any more.

If you would rather that name went too, write to the address below and ask. It has to be changed by hand in the database, so it is a message to a person and not a button.

It does not sell your data. It carries no advertising. It runs no analytics and follows you nowhere else on the web. It sends you nothing you did not ask for: the only mail it has ever been built to send is about your own account.

Nobody outside the project is handed your data. The only companies that touch it are the ones named above, which run the database, the storage, the servers and the account mail on our behalf. They are contractors, not an audience. If that list ever grows, it grows on this page first.

Write with any question about this page or about your own data, and write if you want something removed that you cannot remove yourself.

There is no export button yet. If you want a copy of what is stored about you, ask at the same address and it will be put together by hand.

When the site changes in a way that changes this page, this page changes with it and the date at the top moves. There is no mailing list to announce it, because there is no mailing list.