Privacy Policy

What TravelCobra collects, why I collect it, who helps me run the site, and the choices you have.

Privacy overview

TravelCobra is run by one person: me.

I'm Osanda Gamage, and I run TravelCobra from Colombo, Sri Lanka. I decide how the personal data described on this page is used, and I'm the person to contact about it.

For any question or request about your data, email me at info@travelcobra.com.

The short version

I don't sell your personal data.
If you're not signed in, your trip plans stay in your own browser. If you are, they're also saved to your account, encrypted.
Your bucket lists are private unless you make them public or share them with people you invite.
Analytics and advertising cookies are only set after you agree to them.
You can delete your account at any time from your account settings.

Account details

Your name, email address, a securely hashed password or your Google sign-in details, and your profile settings.

Trip plans

Saved in your browser. If you're signed in, also saved to your account on my server, encrypted, so you can open them on other devices.

Contributions

Places, travel routes, events and edit suggestions you submit, including the image sources you give for them.

Technical data

Your IP address, browser and device type, the pages you visit, and your cookie choices, used for security, analytics and ads.

Your account

If you register with email, I store your name, email address and a securely hashed version of your password. I never see or store the password itself. I send a verification email before the account is activated.
If you sign in with Google, Google shares your Google account ID, name, email address and, if you have one, your profile picture. The picture's web address is saved and shown as your avatar. You can turn "Show profile photo" off in your account settings to show your initials instead; the photo is then no longer shown on your profile or anywhere other travellers can see it.
Each sign-in creates a session. I store the session's browser and device details, IP address and expiry date, so unusual sign-ins can be spotted and sessions can be signed out.
Your account also holds your username, role (for example traveller or admin), account status, and anything you add in your profile settings: bio, home town, favourite places and social links.

Trip plans

If you're not signed in, trips you build in the trip planner are saved only in your browser's storage on your device.
If you're signed in, your trips are also saved to your account on my server, so you can use them on other devices. Trips already in your browser are copied to your account when you sign in. The trip details are stored encrypted. The trip name and summary figures (days, places and total budget) are stored unencrypted so your trips can be listed.
Anyone with its link can view a shared trip, until you move the trip to your Trash. Trips you publish appear publicly as community trips. Shared and community trip pages are kept out of search engines.
Saving a trip to your account (which also happens when you download or share it) runs a Cloudflare Turnstile check to confirm a real person is using the site. Turnstile processes your IP address and browser information.
Trips you delete go to your Trash, where you can restore them or delete them permanently.
The share image for a trip is made in your browser, from the trip's name, month and length. It isn't uploaded to my server. If you use the Share button, the image goes to the app you choose.

Bucket lists and photos

If you're signed in, you can keep bucket lists: goals with an optional note, category and target year. They're saved to your account on my server.
To mark a goal as done you upload one photo, and you can add the date and a short story. The photo is resized and saved as a new image on my server. Hidden information inside the original file, such as the location where it was taken and the camera details, is removed.
Each bucket list is private by default. If a list is made public (with the switch on that list), that list, including its stories and photos, can be seen by anyone on the community bucket lists page and on the public profile of everyone in the list. Your other lists stay private. These pages are kept out of search engines.
When someone adds one of your public goals to their own list, I tell you with a notification that doesn't name them. Public goals and place pages can show how many travellers have the same goal, as a number only.
Anyone signed in can report a public goal. I review reports and may hide a goal from public pages; you can still see it in your account.
Share images for a ticked-off goal or a list are made in your browser, from the photo and text already on the page. They aren't uploaded to my server. If you use the Share button, the image goes to the app you choose.
When you delete a goal or a list, the related photos are deleted from my server. What happens to your lists when you delete your account is explained under "How long I keep data".

Shared bucket lists

The person who makes a list can share it with up to 4 other people. Everyone in a shared list can see all its goals, notes, photos and stories, and who added and ticked off each goal. Everyone in it can add, edit, tick off and delete goals, rename the list and make it public or private.
You can invite someone by their username. They get an email and a notification with your name and the list's name, and they only join if they accept. To find them, the people you can invite are shown with their name, username and profile picture; in the same way, others can find you by your username to invite you.
You can also make an invite link. Anyone who has the link and is signed in can join the list until it expires after 7 days or you turn it off. Only a scrambled version of the link is stored, so it can't be read back from my database.
When someone joins a shared list or ticks off one of its goals, the others in the list get a notification.
The person who made the list can remove people, and anyone else can leave it at any time. The goals they added stay in the list.

Public profile and contributions

I review the places, travel routes, events and edit suggestions you submit before anything is published.
Once approved, contributions are public. With public attribution on, they show your display name and avatar and link to your public profile.
Your public profile can show your display name, username, avatar, bio, home town, social links, badges, the month you joined, the places, routes and events you've added, your public bucket lists, and the countries of the goals ticked off in them.
You can turn public attribution off at any time in your account settings. Your name, avatar and public profile are then hidden, and your contributions are shown without your name.

Emails and notifications

I only send emails about your account: email verification, password resets, updates on places you've suggested, badges you've earned, and invites to someone's shared bucket list. Emails are sent through Resend.
The same updates also appear as notifications in your account, along with notifications about your bucket lists, such as someone joining your shared list or ticking off one of its goals.
I don't currently send newsletters or marketing emails.

Cookies and browser storage

On your first visit, a consent banner asks which cookies you allow. You can change your choice at any time on the Cookie Settings page.

Necessary (always on): keep you signed in, protect forms against misuse, and remember your cookie choice. The site can't work properly without these.
Preferences (optional): remember choices you make on the site.
Analytics (optional): Google Analytics, which shows me which pages and features people use (for example, how often share images are downloaded) so I can improve them. Until you allow analytics, no analytics cookies are set, though Google may still receive limited information without cookies, such as a page being viewed.
Advertising (optional): Google AdSense cookies, explained in the next section.
Browser storage: besides cookies, the site uses your browser's storage to keep your trip plans, the trip planner's guided tour progress and your cookie choice on your device.

Advertising (Google AdSense)

TravelCobra shows ads from Google AdSense.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.

You can opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.

If you don't allow advertising cookies, Google may still show non-personalised ads, which use limited data, for example to limit how often you see an ad and to prevent fraud. Read how Google uses information from sites that use its services.

Other ad networks: ads on TravelCobra are served through Google AdSense, which may also let other ad networks that Google has certified serve ads here. Those vendors and ad networks are listed, with links to their own websites and privacy policies, on Google's page of vendors that are certified for third-party ads. You can opt out of their use of cookies for personalised advertising at www.aboutads.info.

Who helps me run the site

Vercel hosts the website.
The TravelCobra API and database store accounts, contributions and the trips saved to your account.
Resend sends account emails.
Google provides Google sign-in, Google Analytics, Google AdSense and the site's fonts (Google Fonts).
Cloudflare provides the Turnstile check.
Wikimedia Commons serves many of the photos on the site, so your browser connects to Wikimedia's servers when you view them.

Each provider only gets the data it needs for its part, and some process data outside Sri Lanka. I don't sell personal data or share it with anyone else unless the law requires it.

How I use your information

To run your account and keep it secure.
To save your trips to your account, and share or publish them when you ask me to.
To review and publish your contributions and show your public profile.
To keep your bucket lists, share them with the people you invite, and show the ones you make public.
To send account emails and notifications.
To understand how the site is used, if you allow analytics, and improve it.
To show ads, personalised only if you allow advertising cookies.
To prevent abuse, using rate limits, bot checks, and server logs that record IP addresses and browser details.
To meet legal obligations.

How long I keep data

Account data: for as long as your account exists.
Server and security logs: only as long as needed to keep the site secure and fix problems.
Trip plans in your browser: until you delete them or clear your browser storage.
Trips saved to your account: until you permanently delete them from your Trash or ask me to erase them.
When you delete your account: your name, email address, password, bio, home town, favourite places, social links and avatar are removed, trips you shared or published are made private, your bucket lists and their photos are deleted, and you're signed out on every device. A bucket list you shared with other people isn't deleted for them: it passes to the person who joined it first, with its goals and photos. You leave the lists other people shared with you; the goals you added there stay, shown as added by "Deleted User". Places you added that were approved stay on the site, shown as added by "Deleted User", because other travellers rely on them. A minimal record of the deleted account (its username and internal IDs) is kept so the account can't be misused. To have your saved trips erased as well, email me.

Your rights

Depending on where you live, including under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and the GDPR if you're in the EU or UK, you can ask me to:

give you a copy of the personal data I hold about you;
correct anything that's wrong;
delete your data;
stop or limit how I use it;
withdraw your consent to cookies, which you can do yourself on the Cookie Settings page.

You can change most things yourself in your account settings. For anything else, email info@travelcobra.com. I'll reply as soon as I can, within the time the law allows. You can also complain to the data protection authority where you live.

Keeping data safe

The site only runs over HTTPS, passwords are hashed, and saved trips are encrypted. Only I, and anyone I give an admin role, can use the admin tools. No website can promise perfect security, but if a breach affects your data I'll tell you as the law requires.

Children

TravelCobra isn't meant for children under 13, and I don't knowingly collect their data. If you think a child has created an account, email me and I'll delete it.

Links to other websites

Guides and trips link to other websites, such as booking sites, maps and the sources of photos. Those sites have their own privacy policies, which I don't control.

Changes to this policy

When I change this policy, I update the date at the top of the page. If a change is significant, I'll point it out on the site or email account holders.

Your choices

Cookie choices

Allow or refuse analytics, advertising and preference cookies on the Cookie Settings page.

Public attribution

Decide in your account settings whether your name, avatar and public profile appear with your contributions.

Bucket list visibility

Each bucket list is private unless it's made public with the switch on that list, and only the people you invite can join it. You can make it private again, remove people from your list, or leave someone else's list at any time.

Delete your account

Delete your account at any time from your account settings, or email me to have your data erased.

Helpful links

How Google uses information from sites that use its services Google Privacy Policy Google ad settings (My Ad Center) Cloudflare Privacy Policy Cookie Settings Contact