rideinstead

Privacy policy

Last updated 6 November 2026

The short version: this website sets no cookies of its own and has no analytics or ads. The home page can embed a Ko-fi box and two Tree-Nation widgets, which are loaded from those companies only if you accept them (see below). The extension reads flight pages on your device. Everything optional is off until you switch it on.

Who is responsible

The controller under the GDPR is RideInstead. We do not publish a postal address. Contact for any privacy question or request: hello@rideinstead.eu or the contact form.

Visiting this website

Our web server records the technical data every web server needs to deliver a page: your IP address (stored with its last part removed), the date and time, the page requested, the response code and your browser’s user-agent. We use it to keep the site secure and working (legitimate interest, Art. 6(1)(f) GDPR) and delete it automatically after 7 days. We do not use it to identify you or build profiles.

  • Cookies. This site sets none itself. Ko-fi and Tree-Nation, whose widgets load only if you accept them, may set their own. Your choice is kept in this browser (local storage).
  • No advertising and no tracking pixels. Our own visit counter is described above.
  • Third parties. Fonts, scripts, styles and images are served from this site. The Ko-fi box and the Tree-Nation widgets load only if you accept them. Our site is delivered through Cloudflare, a content-delivery and security service that processes your IP address and request data to do so.
  • Visit counter. We count visits with our own counter, hosted by us in the EU. It stores daily totals per page, the website you came from (its domain only), the page language, how long the page was open (in groups such as “10 to 30 seconds”) and how many times the .zip was downloaded. To count unique visitors it computes a short code from your IP address and browser type mixed with a random secret that changes every day. The counter does not store your IP address. The code is kept for at most 36 hours, only so that you are not counted twice, the secret is deleted within 2 days, and the code cannot be turned back into your IP address or linked from one day to the next. The counter sets no cookies, builds no profile of you, and does not run if your browser sends Do Not Track or Global Privacy Control. Legal basis: our legitimate interest in knowing whether the site works (Art. 6(1)(f) GDPR).
  • Stored in your browser only: your light/dark choice and, after you send a message, the time of that message (to prevent repeat sends). These stay on your device, are never sent to us, and are needed for features you asked for, so no consent banner is required.

The contact form

If you write to us we process your name, email address, the topic you choose and your message, to answer you. Legal basis: your consent (Art. 6(1)(a)), given by ticking the box; you can withdraw it at any time. We keep messages for 90 days after we receive them, then they are deleted automatically. Messages are stored on our own server; each one is also emailed to our inbox (through Resend and Gmail) and we do not share it with anyone else.

To keep bots out we use a small puzzle that your browser solves (no third-party captcha) and rate limits: your IP address is held for one hour to count messages, and a one-way hash of your email address for 24 hours. Messages are stored as plain text and checked for harmful content.

You may attach up to three files (PNG, JPG, WebP or PDF, 1.5 MB each). Your browser re-saves pictures without their hidden data (location, camera details), and our server checks every file by its content and refuses anything else, including PDFs with scripts. Files are stored on our own server, are not emailed, are only ever downloaded (never opened) by us, and are deleted with the message after 90 days. Please do not attach anything you do not want us to see. While you type, a draft of your name, email, topic and message is kept in your browser only (local storage on your device, nothing is sent). It is deleted when you send the message, when you press Discard draft, or after 7 days.

Newsletter

If you subscribe we process your email address to send you the newsletter. Legal basis: your consent (Art. 6(1)(a)), given by ticking the box; we record the time of your consent. We keep your address until you unsubscribe, which every email lets you do with one click, and then delete it. We do not track opens or clicks. The sign-up uses the same bot check as the contact form (a puzzle solved in your browser and rate limits, as described above). Emails are sent through Resend (EU region, Ireland), our processor.

Tree counter (Tree-Nation)

The site can show a tree counter from Tree-Nation. The tree widgets are loaded from Tree-Nation only if you accept them in the cookie banner (you can change your mind with “Cookie settings” in the footer). Then Tree-Nation processes your data, including your IP address and cookies, under its own privacy policy. The link to our Tree-Nation profile simply opens tree-nation.com in a new tab.

Supporting us (Ko-fi)

The site links to our Ko-fi page. The Ko-fi box is loaded from Ko-fi only if you accept it in the cookie banner (change it any time with “Cookie settings”); the “Open Ko-fi” link simply opens ko-fi.com in a new tab. Ko-fi (and its payment providers) process your data, including cookies, under their own privacy policies. We receive only what Ko-fi shows us about a donation, such as the name you choose to show, the amount and any message you write.

Downloading the extension

Downloading the .zip is a normal request recorded in the server log as described above. The file’s SHA-256 fingerprint is published next to the download so you can check it.

The extension

The extension has its own detailed policy (in the extension, under Privacy). In summary: route, dates and visible fares are read on your device and never sent to us; there is no account; settings and your history stay in your browser and disappear when you uninstall.

  • Optional anonymous totals (off unless you tick the box, never pre-ticked): once a day, a random install id and counts such as searches per site, train links opened and booked, and CO₂ and money totals. Legal basis: consent, withdrawable in Settings, which also deletes the stored record. Records expire after 400 days.
  • Train price lookup: to show a “from” price, the extension requests Trainline’s public route page. Trainline receives your IP address and the two city names, without cookies. You can switch this off in Settings.
  • Booking links: when you click to see tickets, Trainline processes your data, including cookies, under its own policy; the link is plain and earns us nothing. The luggage storage (Radical Storage) and tours (Klook) links, through Travelpayouts, are affiliate links: if you click one, they process your data under their own policies and we may earn a commission on bookings.

Who receives data

Our website and server run on Oracle Cloud Infrastructure servers in Milan, Italy, behind Cloudflare. Emails sent to hello@rideinstead.eu are forwarded by Cloudflare Email Routing to our Gmail inbox (Google), where we read and answer them. Emails we send from the server (contact notifications and the newsletter) go through Resend, using its EU region in Ireland. These providers process data for us under data-processing terms. We do not sell data or share it for advertising. We do not transfer personal data outside the EU/EEA ourselves; where a provider (such as Cloudflare or Google) processes data outside it, that happens under the safeguards the provider offers, such as standard contractual clauses. Trainline (UK) operates under the UK’s EU adequacy decision.

How long we keep data

Everything below is deleted automatically after the time shown (our server removes it itself; it is not left for us to remember):

  • Web server access logs: 7 days.
  • Bot-protection counters: your IP address for 1 hour, a one-way hash of your email address for 24 hours.
  • Contact messages and their attachments: 90 days after we receive them. The copy emailed to our inbox is deleted by us within the same 90 days.
  • Newsletter address: until you unsubscribe, then deleted at once.
  • Visit counter totals (no personal data): 400 days.
  • Daily unique-visitor codes: 36 hours. The daily secret behind them: 2 days.
  • Optional anonymous totals from the extension: 400 days after the last upload, or at once if you switch them off.
  • Site reports sent from the extension (no personal data): 90 days.
  • Feedback left after uninstalling: 365 days.
  • Database backups: 7 days, so deleted records also disappear from backups within 7 days.
  • Server security logs (blocked abusive addresses, administrator logins): 30 days.

Third parties outside our control

If you install RideInstead through the Chrome Web Store or another store, or use your browser’s sync features, the store, Google and your browser process data under their own policies. We do not receive that data, have no control over it and are not responsible for it. The same applies to the websites you visit, Trainline, Ko-fi and Tree-Nation. Please read their privacy policies.

Your rights

You have the right to access, correct, delete and port your data, to restrict or object to processing, and to withdraw consent at any time. Write to hello@rideinstead.eu and we will answer within one month. You can also complain to your national data protection authority (in Italy, the Garante per la protezione dei dati personali).

Children

RideInstead is not aimed at children under 16 and we do not knowingly process their data.

Changes

If this policy changes we update the date above. We will not start collecting new personal data without asking you first.

Provider: RideInstead. Email: hello@rideinstead.eu.