Privacy
In short: no ads, no advertising networks, nothing sold, and no cookie. Visits are counted once, anonymously, on this site's own server in the EU.
Who is responsible
Sunshine Atlas is a personal, non-commercial project published as “Flightmussy”, and the controller of the data described below. Contact: ceoflightmussy@gmail.com.
I publish under a pseudonym as a private individual. My full legal name and address are available on request to that address, and to any supervisory authority on demand.
1. Server logs — everyone
Every request a browser makes is written to the web server's log: the IP address, the date and time, the address requested, the referring page, the browser's user-agent string, and the response's status and size.
- Why: to run the server, find faults, and defend against scrapers, floods and brute-force attempts.
- Legal basis: legitimate interests, Art. 6(1)(f) GDPR — a website that stays up and is not trivially abused.
- Kept: 14 days, then deleted automatically. Nothing is archived beyond that.
2. Anonymous visit counting — everyone
A small script served from this domain counts what is read. It records the page's address and title, the site you arrived from, any campaign tags on the link you followed (the standard utm_source, utm_medium and utm_campaign parameters — nothing else from the address is read), whether your browser said you typed this address or followed a link from another site, an approximate location worked out from your IP address (country, region, city) and the name of your network operator, your browser, operating system and device type, your screen and window size and pixel density, your browser's main language and time zone, how long the page stayed in the foreground, and how far down it was scrolled.
It also records a few things whose only job is to tell a person from a program: how many times you interacted with the page and how soon the first of those came, whether your device has a touchscreen and what kind of pointer it reports, how many measurements were sent, and a handful of technical markers that headless browsers give themselves away with — an automation flag some of them set, an empty language list, a desktop browser reporting no plug-ins.
Those exist because a crawler that runs JavaScript otherwise looks exactly like a reader, and one week's figures contained several thousand such visits. None of it is content: not which key, not which element, not where on the page — only that an interaction happened, and how many times. The script never reads what you type; it does not read the contents of any field at all.
What makes it anonymous is what it does not do:
- This counting stores nothing on your device. No cookie, no browser storage, nothing to clear.
- Your IP address is not stored. It is used on this same server to look up an approximate location — from a local database, so the address is not sent anywhere — and then discarded.
- To join the pages of one visit together, the server derives a key from your IP address, your browser and this site, mixed with a random value that is regenerated every day and never written to disk. So the key cannot be recreated tomorrow, and the same person visiting two of my atlases produces two unrelated keys. From the stored data there is no way to tell that two visits were the same person.
- Legal basis: legitimate interests, Art. 6(1)(f) — knowing which pages are worth keeping, at a resolution that cannot identify anyone. Because this tier writes nothing to and reads nothing from your device, it needs no consent under Art. 5(3) of the ePrivacy Directive.
- Kept: 400 days.
The embeddable widgets and destination badges under /embed/ are excluded from all of this. They run inside other people's pages, so they count nothing and store nothing.
3. What this site keeps on your device
- your light or dark theme choice.
It is not sent anywhere, and it does not identify you — it exists so the site looks the way you left it. It is exempt from the consent requirement because it does only what you asked for.
Until 28 September 2026 a note in the corner of the pages also kept the date and time you last closed it (sunshineatlas.donate). The note is gone, and nothing on this site writes or reads that value any more; if your browser still holds it, clearing this site's data removes it.
From 16 September to 11 October 2026 the pages also loaded Google Analytics, which counted the visits a second time for Google and stored its _ga cookies on your device: a random client number, kept up to two years. It is gone. If your browser still holds those cookies, this site deletes them on your next visit, and a browser that follows an old link to destinationsmap.com or thesunshinemap.com, the names the site had then, is told to delete the ones kept there. What Google already received stays with it on its own schedule, unless the account behind it is deleted sooner: the individual event records two months after they were collected, and anything tied to a cookie fourteen months after its last visit.
4. Other organisations your browser contacts
Some things on a page are fetched by your browser directly from someone else's servers, which means those servers see your IP address and what was requested. I have no control over what they then do with it, so their own policies apply:
- OpenFreeMap — the map's basemap tiles and their label fonts. openfreemap.org
- Amazon Web Services (s3.amazonaws.com): the elevation tiles that shade the map's mountains, from the Tilezen project's open dataset, fetched only once the map is zoomed in to a country or closer. Amazon's privacy notice. Amazon is based in the United States.
That is the whole list. Fonts, scripts, stylesheets and every image are served from this domain. That includes the destination photographs: they come from Wikimedia Commons, but this site keeps its own copies and serves them itself, so your browser never contacts Wikimedia. The credit under each photograph links to its page on Commons, and following that link is the only way Wikimedia hears from you. There are no advertising networks, no analytics services, no social media widgets and no Google Fonts.
Buy Me a Coffee is not on that list, because nothing on these pages loads from Buy Me a Coffee: the coffee button on the map and the link at the foot of each page are ordinary links. If you follow one, you are on Buy Me a Coffee's own site and under its privacy policy, and if you give, Buy Me a Coffee and Stripe, which handles its payments, show me what they show anyone who receives a payment, which is normally the name and the message you enter, your email address and the amount.
5. Where it is
The server is a virtual machine rented from Contabo GmbH (Munich, Germany) and located in the European Union. Contabo processes the data on my instructions and can reach the machine as any hosting provider can. I transfer nothing outside the EEA myself; the organisations in point 4 are contacted by your browser directly, and Amazon is outside the EEA.
6. Your rights
You can ask me to confirm what I hold about you and give you a copy (Art. 15), correct it (16), erase it (17), restrict how it is used (18), hand it over in a portable form (20), and object to anything I do on the basis of legitimate interests (21).
One honest limit: for the anonymous counting in point 2 and for the server logs, I cannot tell which records are yours, because there is no identifier to search on. Art. 11 GDPR covers exactly this case — where a controller genuinely cannot identify someone, the rights of access, rectification and erasure do not apply, because they cannot be carried out.
Write to ceoflightmussy@gmail.com. I answer within 30 days.
You can also complain to a supervisory authority. Mine is the Norwegian Data Protection Authority — Datatilsynet, Postboks 458 Sentrum, 0105 Oslo. You may instead complain to the authority where you live or work.
7. Changes
This notice was first published on 25 July 2026, and last changed on 11 October 2026, when Google Analytics was taken off the site: the point that described it is gone and the points after it moved up one, point 3 now says what becomes of the cookies it left, Google left the list in point 4, and nothing on this site sets a cookie any more. Before that it changed on 10 October 2026, when the globe became a flat map: OpenFreeMap, which serves the map's chart and its label fonts, and Amazon Web Services, which serves the elevation tiles that shade its mountains, joined the list in point 5, and the satellite imagery the globe was drawn with left the site. The same day the site took back its first name, Sunshine Atlas. Nothing the site keeps on your device changed. Before that it changed on 2 October 2026, when a way to give came back as Buy Me a Coffee: point 5 says why that company is not on its list. Before that it changed on 28 September 2026, when the note in the corner and the donation links were taken off the site: point 4 now lists the theme choice alone and says what became of the note's value, and point 5 no longer mentions PayPal. Before that it changed on 23 September 2026, when the note in the corner stopped asking for a donation and began inviting partnerships and sponsorships; what it stored did not change. Before that it changed on 19 September 2026, when it was brought into line with the sister atlases: Google Analytics got its own section in point 3, and the optional click-and-mouse measurement that used to be point 3 was switched off and taken out. The same day the destination photographs moved onto this site's own server, which took Wikimedia off the list in point 5. Before that it changed on 17 September 2026, when Google Analytics and its cookies were added to the site, and when the satellite imagery under the globe moved onto this site's own server. If what is collected ever changes, this page changes with it, and the date above moves.