Privacy

Feedback and first-party counts

If you report missing information or a broken page, we store your report, its category, the page it concerns and a random submission reference used to avoid duplicate submissions. Reports are private. Please do not include names, contact details or other personal information in your report.

We also keep daily counts of completed searches, opened results and pages, related-page clicks and map failures. These counts may identify the public page and its type, but do not contain search text, full URLs, referrers, user accounts or a persistent visitor identifier.

To limit abuse, the server uses short-lived hashed rate-limit buckets kept separately from feedback and counts. The current public deployment uses a shared bucket rather than a visitor address. Raw IP addresses are not stored in those reports or counters.

Scheduled cleanup removes feedback older than 30 days and daily counters older than 90 days from the live database. Rate-limit buckets expire within two hours and are removed by scheduled cleanup.

Self-hosted analytics

We use self-hosted Umami through this website’s own-domain proxy to understand which parts of the public atlas are used. Our integration sends the public page path, a fixed page-category title and a limited set of exploration events. Events may include the entity type: region, grape or wine style.

These analytics payloads exclude URL queries and fragments, search text, raw referrers, document titles, feedback text, account identifiers and entity or submission identifiers. Admin, sign-in, API and internal pages are excluded. We do not assign a custom visitor identifier or call Umami’s identify function.

The analytics server receives connection and browser information, including the IP address and user agent, and uses this context to derive anonymous sessions and statistics such as browser, device and approximate location. Anonymous session measurement is separate from our first-party daily counts.

We have not configured automatic deletion for Umami analytics. These analytics are retained until we delete them.

The Umami tracker used here does not create analytics cookies. Signing in to the private editorial area uses necessary authentication cookies; this is separate from public analytics.

Backups and server logs

The 30-day and 90-day cleanup periods above apply to live feedback and counters. Deleting live records does not erase copies already held in backups. Backup and server access-log retention are managed separately.