Privacy

You can read every guide, story and tool on DigiTao without an account and without giving us anything. Google Analytics, which counts visits, and the Pinterest tag, which measures and targets our pins on Pinterest, each load only if you say yes to their purpose. Our affiliate network, Travelpayouts, also loads a small script on every page (see below). Apart from that and the short-lived technical logs every host keeps, the personal details we receive are the ones you choose to give us through your account: favourites, travel or installation plans you save, messages you send, and a story or photos you publish with it. The sections below explain each use, including the optional chat.

An account is free and optional. When you create one, we keep your email address, your password (stored only as a one-way hash we cannot read), the name you want us to call you, your username, and the date you confirmed you are 18 or older. If you add them, we also keep your profile photo, a short bio, the country you are from and your Instagram profile. Every story and photo you save is kept with your account too, so you find your favourites on any device.

We use these details to run your account and the features you ask for, so the legal basis is our contract with you. They are stored with Supabase, the database and sign in service we use. We never sell them and never use them for advertising.

If you choose to sign in with Google, Google shares your email address and your name with us, and we never post anything on your behalf.

Every account has a public page at digitao-nomads.com/members/ followed by your username. Anyone can see your display name, your username, your profile photo, your bio, the country you are from and your Instagram profile, but only the ones you filled in. Your email address, your saved favourites and your sign in details are never shown to anyone.

Member pages are kept out of search engines, except those of the people who write for DigiTao and of members with at least one published post, which can appear in search engines. You can change or empty any public field at any time from your settings.

Profile photos are re-encoded on our server before they are stored, which removes their location and camera details.

When you sign in, we set one cookie on DigiTao, whose name starts with sb-, to remember that you are signed in. It is strictly necessary for your account to work, so it needs no consent and it does not appear in the cookie banner. It is HttpOnly, which means scripts on the page cannot read it, it is only sent to DigiTao, and it is never used for measurement or advertising. It lasts up to 400 days after your last visit and disappears as soon as you sign out.

Our pages for reading, the tools and the gallery never set this cookie: it only comes into play on the sign in pages and in your account.

We keep your account for as long as you use it. From your settings you can download a copy of your account, profile, saved favourites, comments, upvotes, the members you have blocked, the reports you have sent, your notifications, your trips (with their ticked checklist items), your saved tool results, your conversations and messages (the messages you sent, even in a conversation you left, and those of the other member you can still read) and your stories and photo sets (whatever their status, with the captions and descriptions of their photos and our reasons for any decision, but not the photo files), as one JSON file, whenever you like.

You can also delete your account there, after typing DELETE and your password. We then delete, straight away, your profile, your username, your bio, your profile photo, your saved favourites, your sign in details, your upvotes, your blocks, your notifications, your trips, your saved tool results, the messages you sent and the posts you wrote, with their photos, their comments and their hearts, and your hearts disappear from the public counters. Your comments stay in their threads as [deleted], without your name, and any report you sent keeps its content but loses the link to you. The other member of a conversation keeps the messages they sent you, and a copy of messages attached to a report stays for the time described in Private messages below. A post under an open report leaves a copy in our moderation log, as described in Stories and photos you publish below. Only our hosting providers' encrypted backups may keep a copy for a short while before it is overwritten.

We send the emails your account needs: a link to confirm your email address when you sign up, a link to choose a new password when you ask for one, and a welcome email once your account is ready. Once you take part in the community, we also send replies to your comments, a daily digest of the upvotes and hearts you received, our answer to a post you submit, any moderation decision about your account, new messages waiting unread if someone writes to you and, if you save a Leave By Check result with a reminder, reminders before your leave by date, all described below. They go out through Brevo (Sendinblue SAS, France), which processes them in the European Union. There is no newsletter behind an account, and we never add you to one without asking.

To stop people from guessing passwords or flooding the site, we count attempts for a short time: sign ups, sign ins, password resets, saves and questions to Ask DigiTao, per account or per shortened network address (never your full IP address). We keep these counters under our legitimate interest in keeping DigiTao and your account safe. They are deleted within two days, and because they only exist to block abuse, they are not part of your data export.

Bot checks. When you sign up, sign in, ask for a new password, change your password, delete your account, submit your first post or send a report from our report page, the form loads Cloudflare Turnstile, a check that tells people from automated scripts, usually without asking you anything. It loads only on those forms, never on the pages you read. To run the check, Cloudflare receives your IP address and signals from your browser, such as its type and settings, and tells us only whether the check passed. We use it under our legitimate interest in keeping accounts and the site safe from abuse.

The cookie banner asks about two purposes separately. Accept all allows both, Measurement only allows Google Analytics alone, and Decline allows neither.

Measurement. With your okay we load Google Analytics to count visits and see which pages help people most. It sets cookies whose names start with _ga, which last up to 13 months, and Google receives your IP address, your browser details and the pages you view. Google may process this data outside the European Union under standard contractual clauses. We use it only for statistics, never for advertising, and we do not share it with anyone else.

Advertising. With Accept all we also load the Pinterest tag. It tells us which of our pins bring visitors to DigiTao, records a sign-up to our newsletter as a conversion, and lets us show our pins on Pinterest to people who already visited the site. It sets cookies and browser storage entries whose names start with _pin, _epik or _derived_epik, which last up to one year, and Pinterest receives your IP address, your browser details and the pages you view. Pinterest Europe (Ireland) uses this data under its own privacy policy to measure and target ads, and may process it outside the European Union under standard contractual clauses. We never pass Pinterest your email address or anything you type into our tools.

If you click Decline, or make no choice, neither tag loads and nothing is sent to Google or Pinterest. We remember your answer in your browser's local storage. You can change your mind at any time with the Cookie settings link at the bottom of every page; withdrawing a purpose you had allowed deletes the cookies and storage entries its tag set on our domain. Cookies Pinterest keeps on pinterest.com itself are managed from your Pinterest settings.

Every page loads a small script from Travelpayouts, our affiliate network, which can turn a link to a travel partner into an affiliate link. Loading it sends Travelpayouts your IP address, your browser details and the page you are on, like any request to another site. It sets no cookie on DigiTao and stores nothing in your browser here. When you click a partner link, Travelpayouts and the partner record the click on their own sites under their own privacy policies, so that a booking can be credited to us. More in our affiliate disclosure.

Leave By Check, Visa Check, Currency Check and Country Comparison run in your browser. What you type stays on your device and is not sent to us, unless you save a Leave By Check or Visa Check result to your account, described in Trips, presence and reminders below.

If you press Save result while signed out, what you typed is kept in this browser tab for 30 minutes at most, so the tool can fill itself in again once you are signed in. It is erased as soon as it is used, and never sent anywhere before you save.

Ask DigiTao, our travel assistant, works differently: to answer, it sends your latest messages (up to twelve; yours are 1,000 characters at most) and the country or city of the page you asked from to our server, which passes them to Anthropic, the company whose Claude model writes the answers. We do this to give you the answers you ask for, so the legal basis is providing the service you request. Anthropic is based in the United States and may process them there, under standard contractual clauses. We do not keep your messages: our server only records counts, such as how long an answer took and its size, and limits requests per shortened network address as described in Keeping accounts safe. The conversation stays in your browser's local storage until you press Start over or clear your browser data.

Currency Check asks our server for the latest exchange rate, and our server asks Frankfurter, a public rates service. Only the two currencies travel, never the amount or anything about you.

The Portugal installation preview is a practical planning checklist. Your answers stay in this browser tab until you explicitly save them to your account. You can clear the preview from the page. It asks for general plans, not identity documents, exact income, a tax number or a street address.

When account saving is available and you choose Save, we keep your project answers, task statuses and action history in Supabase, linked to your account. Only your account can read them through the application. Planning as a couple or a family does not share your plan with anyone. You can edit or delete a saved project in My installation; deleting your account also removes these projects. We keep them until you delete them or your account, and include them in your account data download even if new plan saving is later paused. Technical backups follow the hosting provider's retention and are not represented as instantly erased copies.

The task explanations and controls work without AI. If you choose to ask Anthropic about a selected step, we send the task's title, status, applicability and version, its practical preparation notes and your conversation messages to the existing Anthropic service described above. Your country of residence, citizenship answers and other project facts are not automatically included. This task conversation stays in memory while its panel is open and is not added to the public chat's browser history. Closing or changing that task clears the panel conversation. Do not type sensitive personal details. Provider retention depends on the actual account and contract; we do not promise zero retention.

Installation plans do not create legal eligibility decisions, submit applications, book housing, share documents or schedule reminders. Marketing tags do not load in My installation. On the public preview, the existing measurement consent controls the limited onboarding events; these contain fixed step names and outcomes, never your answers or chat text.

From your account, you can write a story or share a set of photos. We keep what you enter: the title, the place, the text, a short summary and, for each photo, its caption and its description for people who can't see it. Photos are re-encoded on our server before they are stored, which removes their location and camera details. The photo you upload is kept in a private store. When your post goes live, we make a public copy of each photo under a random name that says nothing about you or the post. All of it is stored with Supabase, the database and storage service we use. Public photos are served through its network, which can keep a copy in its cache for up to one minute after we delete one.

A draft is yours alone. Nobody else reads a draft, not even us. When you submit a post, Etienne and Linda read it, with its photos, to decide whether to publish it. Once it is published, anyone can read it on the blog and in the gallery, with your display name, your username and your profile photo, and your profile page lists it and can then appear in search engines. A published post also goes into our blog feed (/blog/feed.xml), our sitemap and the structured data search engines read, so feed readers, search engines and other services can keep a copy. When you take a post down or delete it, it leaves DigiTao straight away, but copies made elsewhere while it was online are out of our control.

A draft you have not changed for 180 days is deleted with its photos, unless it was published before. A post we did not accept, or took down, stays visible to you, and to Etienne and Linda for moderation, until you delete it or your account. A published post stays online until you take it down or delete it. When we take a post down, we copy its text to our moderation log, which only Etienne and Linda can read, and keep it there for 24 months as evidence of our decision.

If you delete or take back a post while it is under an open report, we first copy its title, its text and the captions and descriptions of its photos to our moderation log, read only by Etienne and Linda and deleted 24 months later, so that removing a post cannot erase what was reported. While a post is hidden, taken back or taken down, its comments are no longer shown to anyone but their authors and us, and they come back if the post is published again. The hearts your published posts receive are counted in the daily digest we email you, which you can turn off in your settings.

You can take a post down or delete it at any time, even while your account is paused. Deleting a post deletes its photos, its comments and its hearts. Your posts are part of the copy you can download from your settings, and deleting your account deletes them too.

We publish your posts because you ask us to, so the legal basis is our contract with you. Reviewing them, the moderation log and reports rest on our legitimate interest in keeping DigiTao safe and lawful.

Before accounts could publish, stories and photos were proposed by email through a form. Those emails stay in our team mailbox and are never published without your agreement. You can ask us to delete yours at any time.

Like every website, our host records technical access logs, which include IP addresses, to keep the site running and secure. They are kept for 30 days at most and are never used to identify you.

The little game keeps your best score in your browser's local storage so it is still there next time. It never leaves your device, and clearing your browser data removes it.

When you comment, your comment, your display name, your username and your photo are public under the story. Your upvotes, the members you block and the reports you send are private: only you and, when needed for moderation, Etienne and Linda can see them. If you report something from our report page without an account, we keep a scrambled version of your email (a keyed hash), never the address itself, and use the address once to confirm we received your report. Legal basis: our contract with you for the community features, our legitimate interest for moderation and safety.

We show you replies, upvote summaries, our answer to a post you submit, moderation decisions and reminders before a leave by date in your account, and email them to you through Brevo, the email service we use in the European Union. You can turn off reply, summary and reminder emails in your settings or with the link in each email. Moderation decisions are always emailed: the law requires us to tell you. New private messages have their own counter under Messages rather than in the notifications, and their emails are described in Private messages below.

When you plan a trip in your account, we keep what you enter: its title, the country, the city if you choose one, its dates and the checklist items you tick.

If you save a Leave By Check or Visa Check result, we keep the answers you gave the tool with the result: for Leave By Check, the country, how you entered and the dates of your stays; for Visa Check, the country, your nationality, why and how long you want to stay, the level of funds you declared and whether you are 50 or older. Our server works the result out again from our dated rules before keeping it.

We use all of this to keep your plans and send the reminders you ask for, so the legal basis is our contract with you. It is stored with Supabase, like the rest of your account, and only you can see it. Our back office counts trips and the members sharing their presence, and never shows your trips themselves: only, while you share your presence, the city you share it in today (see below).

Sharing your presence is off until you switch it on for a trip to a city. It then shows your display name, your username, your profile photo, the city and your dates on the Nomads page of that city, never anything more precise than the city. Only signed in members who share a trip to the same city themselves, with dates that overlap yours in the next 90 days, and whose account is at least 7 days old, can see it, and only 24 hours after they started sharing that trip. We keep the time you started sharing a trip with it until you switch sharing off. Members who have blocked each other, either way, never see each other there. Etienne and Linda can also see, in our back office's list of members, the city where you share your presence today, never your dates, the trip's title or a trip you don't share, and each time they see it is recorded in our moderation log. You can switch it off or delete the trip at any time, even while your account is paused, and it switches off by itself the day after your trip ends.

When you save a Leave By Check result whose date is at least 3 days away, the box to get reminders is ticked by default. We then remind you up to three times, 14, 7 and 2 days before your leave by date, in your account and by email through Brevo. You can untick the box before you save, turn a reminder off later from your trips, or turn off reminder emails in your settings or with the link in each email. A reminder is worked out from the rules we had on the day you saved, so check the official source before you travel.

When you write to another member, we keep your messages and the time each one was sent, the time you last read each conversation (only to count your unread messages: the other member is never told whether you have read theirs), whether you muted a conversation and which folder it sits in. It is stored with Supabase, like the rest of your account.

A conversation is private: only the two of you can read it, and our back office gives Etienne and Linda no way to open it. There is one exception. When one of you reports a message, we copy the 20 most recent messages of the conversation, ending with the reported one, and attach them to the report, even messages you had cleared by leaving the conversation. Etienne or Linda read that copy only to decide on the report, and each reading is recorded in our moderation log. The copy is kept until 180 days after our decision, even if their author deletes those messages or their account, so that deleting a message cannot erase the evidence of harassment.

When a message has been waiting unread for 15 minutes, we email you through Brevo, at most once an hour per conversation. The email gives the sender's display name and a link, never the text of the message. You can turn these emails off in your settings or with the link in each email.

New messages appear without reloading the page. For that, our database sends a signal through Supabase Realtime, the live service of our database provider. The signal holds technical identifiers (of the conversation, of the message and of your account) and never any text; your browser then fetches the message from our site, signed in as you. Supabase Realtime keeps these signals for up to 3 days, then deletes them.

A message stays until its author deletes it or their account. When you delete a message, its text is erased straight away and the other member sees Message deleted in its place. Leave hides the conversation and its earlier messages only for you: the other member keeps the whole history, and the conversation comes back if they write again. To stop someone from writing to you, block them. When you delete your account, the messages you sent go with it, and the other member keeps their own.

We use all of this to run the messaging you ask for, so the legal basis is our contract with you. Reports, the copy attached to them and the record of who read it rest on our legitimate interest in keeping members safe.

1. Comments stay until you delete them or your account; when you delete your account, your comments stay in their threads as [deleted], without your name.
2. Notifications you have read are deleted 90 days after you read them. Notifications you have not read are deleted 180 days after they arrive.
3. Reports are deleted 24 months after our decision.
4. Our moderation log, including the text of removed comments, is kept for 24 months as evidence of our decisions, then deleted.
5. Rate limiting counters are deleted within two days.
6. Trips, ticked checklist items and saved tool results stay until you delete them or your account.
7. Sharing your presence on a trip switches off by itself the day after your trip ends. Reminders in your account follow the rule for notifications above.
8. Private messages stay until their author deletes them or their account. The details of each conversation (which folder it is in, when you last read it, whether you muted or left it) stay until you delete your account. The notice we keep to know that a message is still unread follows the rule for notifications above. A copy of messages attached to a report is deleted 180 days after our decision.
9. Drafts you have not changed for 180 days are deleted with their photos, unless they were published before. Your other posts stay until you delete them or your account. The text of a post we took down, or of a post removed while a report about it was open, stays in our moderation log for 24 months.

You can ask to see, correct or delete the personal details you sent us, or object to how we use them. If you have an account, you can do most of this yourself from your settings: edit your profile, download your data or delete your account. For anything else, write to us and we will answer within one month. If you are not satisfied, you can also contact your data protection authority (in France, the CNIL).

Our newsletter is not open yet, and its sign-up form sends nothing. Before it opens, or before we add anything else that collects data, we will update this page and change the date at the top.