How we handle your data.

The short version: very little. There is no analytics script, no tracking pixel and no advertising network. Two cookies can exist here and no more: one remembers the cookie choice you made, and one — only if you accepted — lets a travel partner tell we sent you, so a commission is paid (the two cookies). We do count how often each page is read, from our own server’s log — without recording your IP address (details below). It loads one script from another company: Travelpayouts, the affiliate network we work with, so that links to travel partners can earn us a commission (details below).

Last updated: 14 October 2026

Who we are

yourwindowseat.com is operated by Theme Park AG, a Swiss Aktiengesellschaft registered in the Commercial Register of the Canton of Zürich (UID CHE-420.189.003). Full company details are in the imprint. Contact: the Theme Park AG contact form.

What we collect

• Page requests. Our web server writes one line for each page it serves, for each click on a link we count, and for the answer you give the cookie banner: the time, the page, the response, which site you came from if any, and the browser identification your browser sends. It does not record your IP address, and it does not record anything you typed into a web address. We use it to see which stories and pages are read, and how often people go on to contact Jon. Once a day the same lines are copied to our own analytics database, on another of our servers, so we can chart them. They stay on our servers and are shared with no one.
• Error logs. When a request fails, the error log can record the IP address, the time and the address that was requested. We use it to keep the site running and secure.
• Newsletter sign-ups. When you subscribe, we receive your email address, and we record when you signed up and when you confirmed, so that we can show you asked for it. Nothing is sent until you confirm by clicking the link in the first email. The list is run on our own mail server in Gravelines, France, and the mail is delivered by Mailgun (see below).
• Pitches. When you send a pitch we receive what you enter: your name, your email address and what you write. (The pitch form is not connected yet.)
• Messages to us. If you write to us through the Theme Park AG contact form, themepark.com’s privacy policy applies.

What we don’t do

• No third-party analytics service, no tracking pixels and no ad banners. Nothing here builds a profile of you or follows you around other sites: the page count described above is a plain server log with no identifier in it, so two visits cannot be linked to each other or to you. The only cookies are the two named below.
• No embedded widgets from partners. Fonts are served from our own server, so your browser makes no requests to Google while you read.
• No selling, renting or sharing your data with advertisers or data brokers.

The two cookies

Nothing is set before you answer the banner, and the site works the same whatever you answer.

• acceptCookies — set by us, always. It records whether you accepted or rejected, so we stop asking. It holds true or false and nothing else, and lasts a year. This one needs no permission: it exists only to remember the permission question.
• am_user_session — set only if you accept. Put there by the Travelpayouts script below. It holds a random identifier and no personal detail, and its job is to let a travel partner recognise that a booking came from yourwindowseat.com so the commission reaches us. It is not used for advertising and no one else reads it.

Reject and the Travelpayouts script is never loaded at all, so am_user_session is never set — and if an earlier visit left one behind, we delete it. You can change your mind whenever you like: Cookie choice at the bottom of any page brings the banner back.

The Travelpayouts script

Every page loads a script from Travelpayouts (tp-em.com), the affiliate network through which we work with travel partners such as Tripadvisor. The script can turn links to those partners into affiliate links, so that we earn a commission if you book, at no extra cost to you. Because your browser fetches the script from Travelpayouts’ servers, Travelpayouts receives your IP address, information about your browser and the address of the page you are reading. Travelpayouts is operated by Go Travel Un Limited (Hong Kong) and handles this data under its own privacy policy.

⛔ The script is not loaded until you accept. Reject, or ignore the banner, and your browser never contacts Travelpayouts at all — so none of the data above is sent either.

Links to other sites, and affiliate links

Pages on this site link to other sites: Fora Travel (to plan a trip with Jon), the publications Ben writes for, travel partners such as Tripadvisor, Viator, Virgin Voyages, Oceanwide Expeditions, Marriott, Booking.com (through the affiliate network CJ) and, through Travelpayouts, Aviasales, Kiwi.com, EconomyBookings and Welcome Pickups, Priority Pass for airport lounges (through Impact), Wise for travel money (through Partnerize), and credit card issuers. Once you follow a link, the other site’s privacy policy applies.

Some of these links are affiliate links, and they are labelled; the Travelpayouts script can also turn links to travel partners into affiliate links. When you follow one, the partner may use cookies or similar technology on its own site to recognise that you came from yourwindowseat.com, so that it can pay us a commission if you book, sign up or are approved for a card. We don’t pass your personal data to partners, and we don’t ask them for your name, contact or payment details.

Why we process it

• Page requests: understanding which pages are read and whether the site does its job, so we can write more of what people actually read. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)). Because the log holds no IP address or other identifier, it is not normally personal data at all.
• Error logs: security, abuse prevention and reliable operation. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
• Travelpayouts script and its cookie: earning affiliate commissions, which fund the site. Legal basis: your consent (GDPR Art. 6(1)(a)), given through the cookie banner and withdrawable at any time through Cookie choice at the bottom of any page.
• The acceptCookies cookie: remembering your answer so we do not ask again. Legal basis: our legitimate interest in honouring your choice (GDPR Art. 6(1)(f)); it is strictly necessary for that purpose and set whichever way you answer.
• Pitches: to read your pitch and answer it, and to work with you on a story. Legal basis: steps before a possible agreement with you (GDPR Art. 6(1)(b)) and our legitimate interest in answering.
• Newsletter: to send you the newsletter you asked for. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time through the unsubscribe link in every issue.

Where data goes

The site is hosted by OVH SAS (France) on a server in Warsaw, Poland, in the European Union. The analytics database the page log is copied into is on another OVH server, in Strasbourg, France, also in the European Union, reached over a private network between our own machines. Cloudflare, Inc. (United States) answers the domain-name lookups for yourwindowseat.com; your page requests go directly to our server and do not pass through Cloudflare. The Travelpayouts script is loaded from Travelpayouts’ servers; its operator, Go Travel Un Limited, is based in Hong Kong, outside Switzerland and the EU.

The newsletter list lives on our own mail server, an OVH machine in Gravelines, France, in the European Union. The emails themselves are delivered by Mailgun Technologies, Inc., using its European region, so the sending and the delivery records stay in the EU. Mailgun tells us whether an issue was delivered, opened or reported as spam, so that we stop mailing addresses that bounce or complain.

How long we keep it

• Page requests: the server log is rotated daily and deleted after 52 days. The copy in our analytics database — still with no IP address in it — is deleted after 90 days.
• Error logs: rotated daily and deleted after 52 days.
• Cookies: acceptCookies lasts a year from your answer; am_user_session lasts for your browsing session.
• Pitches: for as long as needed to answer and, if we publish your story, to work on it with you.
• Newsletter: until you unsubscribe.

Your rights

Under the FADP and, where it applies, the GDPR, you have the right to:

• Request access to the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted (subject to legal retention requirements)
• Object to or restrict processing based on legitimate interest
• Receive your data in a portable format
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority

To exercise any of these rights, send a request through the Theme Park AG contact form.

Security

The site is served only over TLS, so everything between your browser and our server is encrypted.

Changes to this policy

If we make material changes to this policy, we’ll update the date at the top. The current version always lives at this address.