Privacy policy

SwissDiscover is operated by Shelduck Production Sàrl (the “Company”, “we”, “us”), a Swiss limited liability company registered with the Commercial Register of the Canton of Valais under number CHE-257.352.408, with registered office at c/o Fidaly SA, Rue Notre-Dame-des-Marais 1, 3960 Sierre, Switzerland.

This policy explains what personal data we collect when you use swissdiscover.com (the “Site”), why we collect it, and what your rights are. We comply with the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

We try to collect as little personal data as possible. Depending on how you use the Site, we may process the following:

• Technical and usage data: URL, page title, hostname, query parameters and referrer; browser, operating system, device type, screen resolution and language; and an approximate location (country, region, city) derived from your IP address. Our analytics provider, Umami, is self-hosted on our own infrastructure. It uses your IP address only to derive this approximate location and does not store the IP itself. Umami identifies sessions by a hash of website ID, hostname and user-agent combined with a rotating salt; separately, we set our own sd_vid cookie, described in Section 4.
• Account data: if you create an account, your email address, and any display name, short bio and profile picture you choose to add. Accounts are passwordless — you sign in with a one-time code sent to your email address.
• Point packs and saved content: which point packs you have installed and, for paid packs, the fact that your account is entitled to them. This lets your installs follow you across devices.
• Blog updates: if you hold an account, we may use your email address to tell you when a new article is published. You can ask us to stop at any time.
• Contact: if you email us, the email address and the content of your message.
• Shop orders: billing and shipping details, order contents and payment confirmation are processed through Shopify (see Section 5). When an order completes, Shopify notifies our server of the order reference and the buyer's email address so we can unlock the purchased point pack on the matching account. We never receive your payment card details.
• GeoGuesser game: saving a score requires an account. We store your best score, the number of rounds you survived and the display name shown on the leaderboard, linked to your account.
• Trip planning: trip lists, schedules, travel dates, hidden map layers, your shopping cart and your installed packs' map data are stored locally in your browser (localStorage) and are not transmitted to us.

We process personal data only for the purposes for which it was collected, in particular to:

• operate, secure and improve the Site;
• create and run your account, and sign you in;
• process shop orders, deliver products and unlock purchased point packs;
• respond to your messages and partnership requests;
• display leaderboards and game results in the GeoGuesser game;
• produce aggregated usage statistics so we can understand what works on the Site;
• measure the performance of our advertising, where you have agreed to it.

Where the GDPR applies, our legal bases are: performance of a contract for accounts, orders and entitlements; legitimate interests for keeping the Site secure, fixing errors and understanding aggregate usage; and your consent for the advertising cookies described in Section 4, which you can withdraw at any time.

We do not sell your personal data and we do not use it for automated decision-making with legal effect.

Essential cookies are needed for the Site to work and are always set. These are the signed session cookies for your account (user_session), the GeoGuesser game (geo-session) and the CMS (cms_session); the cookie recording your cookie choice (sd_consent); and, where enabled, the site-access cookie (sd_gate).

Analytics. We set a first-party cookie sd_vid containing a random identifier generated in your browser, which is attached to the events we send to our self-hosted Umami instance. It is not linked to your name or email and is not shared with third parties, but it does persist between visits, so it lets us recognise a returning browser. Umami's own script sets no cookies.

Marketing cookies, only if you agree. If you accept, we load the Meta (Facebook) pixel and the TikTok pixel, which set the cookies _fbp and _ttp and let us measure our advertising. These scripts are not loaded at all until you choose “Fine by me” in the cookie banner. If you choose “No thanks”, nothing is sent to Meta or TikTok.

You can change your mind at any time — this forgets your choice, deletes those two cookies and reloads the page:

You can also clear or block cookies via your browser settings. Disabling essential cookies may break parts of the Site.

We rely on a small set of trusted service providers. When you interact with these features, your data is processed under their own terms:

• PocketBase: backend database for places, partners, blog content, game scores and CMS accounts, hosted on our infrastructure.
• Shopify: powers the shop, including checkout and payment processing.
• Umami Analytics: privacy-focused analytics, self-hosted on our own infrastructure. No personal data is sold or shared with third parties.
• Meta Platforms (Facebook/Instagram advertising): loaded only with your consent. The pixel reports page views and your IP address to Meta and allows us to measure our advertising.
• TikTok: loaded only with your consent, for the same purpose as above.
• Sentry: captures application errors so we can fix bugs. Error reports include technical context such as browser version, the URL where the error occurred and your IP address. Sentry also records a sample of browsing sessions (session replay) so we can reproduce faults — text content and form inputs are masked before leaving your browser, and media is blocked, so what is recorded is the shape of the interaction rather than what you typed or read.
• Swisstopo: provides the base map tiles.
• Viator: bookable experiences shown on place pages are fetched from the Viator Partner API. Bookings are completed on Viator's own platform.
• CJ Affiliate / Hotels.com: outbound hotel links include affiliate tracking parameters. We may receive a commission if you complete a booking.
• YouTube: game reels and place videos are embedded from YouTube and subject to Google's privacy terms. Opening a video loads content from Google's servers, which receives your IP address.

Some of our service providers — notably Shopify, Sentry, Meta, TikTok, YouTube and Viator — are based outside Switzerland, including in the EU/EEA and the United States. When personal data is transferred abroad, we rely on the safeguards required by the nFADP and the GDPR, such as adequacy decisions or standard contractual clauses.

We keep personal data only as long as needed for the purposes described above, or longer where the law requires it:

• Account data, installed packs and entitlements: for as long as your account exists. Ask us to delete it and we remove the account and everything attached to it, apart from records we must keep for accounting purposes.
• Order records: ten years, as Swiss accounting and tax law requires for commercial documents.
• Game scores: for as long as your account exists, or until you ask us to remove them.
• Contact emails: for as long as needed to deal with your request and any follow-up.
• Analytics and error reports: for a limited period set in each tool, after which they are deleted or aggregated. Cookies expire on the schedules set by your browser and by the services listed in Section 5; your cookie choice itself is remembered for six months, after which we ask again.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction or deletion of inaccurate or outdated data;
• request deletion of your account and the data attached to it;
• ask us to stop emailing you about new articles;
• object to or restrict certain processing;
• withdraw your consent at any time;
• lodge a complaint with a competent supervisory authority.

You can withdraw your cookie consent yourself using the button in Section 4. For anything else — including deleting your account — contact us at contact@swissdiscover.com. We may ask you to confirm your identity before we act on a request.

We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access and disclosure. No system is fully secure, so we cannot guarantee absolute security.

We may update this policy from time to time to reflect changes in our services or in the law. The “Last updated” date at the top of this page tells you when the latest version was published.

Shelduck Production Sàrl
c/o Fidaly SA, Rue Notre-Dame-des-Marais 1
3960 Sierre, Switzerland
contact@swissdiscover.com