Privacy Policy

Who is responsible

DurianDesk (duriandesk.com) is run by Tytus, who decides how the data described here is handled — in the words of the GDPR, the data controller.

For anything about your data — a copy, a correction, a deletion — write to contact@duriandesk.com.

The short version

We count visits with Google Analytics, which uses cookies — in Europe and the UK only once you agree in Google's consent message — and with Cloudflare Web Analytics, which uses none. Both show us totals, not people. There is no tracking pixel. We do not know who you are, we do not build a profile of you. We hold something personal about you only if you choose to: by writing to us through the contact form, by creating an account for the trip planner, or by sharing a trip plan.

Most pages show Google ads, and Google uses its own cookies for them — see Advertising and consent. Visitors in Europe and the UK are asked first.

What is stored in your browser

This site sets one cookie of its own, and only if you sign in: dd_session, which keeps you signed in for up to 60 days. It holds a random number, nothing else, and is removed when you sign out. Because it is needed for the sign-in you asked for, it doesn't need a separate consent. Google's advertising cookies are separate from this and described under Advertising and consent below. Google Analytics sets its own cookies (named _ga and _ga_ followed by letters), described under Visit statistics below.

The site also uses your browser's local storage for a handful of conveniences. It stays on your device, is not sent to us, and clearing your browser data removes it:

• your light or dark theme choice
• your trip plan — places, dates and whatever you type into it
• dates saved in Weather on your dates
• the currency you chose to see prices in
• figures you entered into the cost-of-living calculator
• a note that you're signed in, so the menu can say "Account" instead of "Sign in"

Accounts and saved trip plans

An account is optional; the trip planner works without one. If you create one, we hold your email address, when you last signed in, and the trip plans you save — including anything you type into them, such as hotel names or booking references. They are stored in a database at Cloudflare, which hosts this site, and only you can open them.

There is no password. We email you a sign-in link, which works once and expires after 20 minutes; we keep a record of it (not the link itself) so it can't be reused. The email is sent through Resend.

How long: until you delete your account. You can do that yourself on the account page, at any time; it removes the account, every saved plan and every link you've shared, straight away. The lawful basis is the service you asked for — keeping your plans.

Shared trip plans

When you share a plan, we store a read-only copy under a random link. The copy never includes hotel names, addresses, booking references, notes, times or your passport country; amounts are included only if you tick the box. Anyone with the link can see it, so share it with the people you mean to.

How long: until 90 days after the trip ends, then it is deleted automatically. You can delete it sooner with the private delete link you're given when you share, or from your account page.

Visit statistics

Cloudflare, which hosts the site, counts visits for us with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. It records which page was viewed, the site you came from, your browser type and your country, and shows them to us only as totals — we cannot see individual visitors.

We also use Google Analytics 4, from Google Ireland Limited, to see which pages and tools are used: the pages viewed and for how long, the site you came from, your device type, browser and approximate location (country or city, from your IP address, which Google Analytics does not store), and a few actions on the site — that a calculator was used and showed its result, that an affiliate link, the contact button or Buy Me a Coffee was clicked, that the contact form was sent (its topic, never what you wrote). It sets cookies named _ga and _ga_ followed by letters, which keep a random number for up to two years so that repeat visits are counted once.

In the European Economic Area, the UK and Switzerland, none of these cookies is set until you agree in Google's consent message, and you can refuse as easily as accept. Until then Google receives only signals without cookies, which it uses for estimated totals. Data is kept for 14 months. Google's own privacy policy applies to what it processes: policies.google.com/privacy.

Advertising and consent

This site shows ads served by Google AdSense. Google and its advertising partners use cookies to show those ads, including — where you allow it — ads based on your previous visits to this and other websites. No ads appear on the contact form, the legal pages, the account pages, shared trip plans or the Today view.

Visitors in the European Economic Area, Switzerland and the United Kingdom are asked first, by Google's certified consent management platform, before any personalised advertising cookie is set. You can refuse as easily as accept, and change your answer later.

You can turn off personalised ads at Google's Ad Settings, and read how Google uses data from sites that show its ads at policies.google.com.

Affiliate links

Some outgoing links to booking, insurance and transport services earn us a commission if you buy through them, at no extra cost to you. They are marked on the page where they appear and carry a sponsored attribute. When you click one, the site counts it: we record which company the link goes to, the page it was on and the day — nothing about you, no IP address, no cookie. That tells us which links are useful. Following one takes you to that company's own site, where their privacy policy applies, not ours.

To credit those commissions, pages also load Travelpayouts Drive, which sets its own cookies. In the European Economic Area, the UK and Switzerland it loads only after you agree in Google's consent message; elsewhere it loads with the page.

Reviews

If you leave a review on the services page, we keep the name you choose to show, your rating, your text and, if you give it, your email address. The email is never published: it is only there so we can check the review comes from a real client. Nothing is published until we have read it. Ask us at any time and we remove your review and everything stored with it.

The contact form

This is the only place where you give us personal data. The form collects your name, your email address, the subject you picked, and whatever you write in the message. When you press Send, the form also notes the page of this site where you pressed the contact button, the page language, and your answer to the optional question "How did you find DurianDesk?", so that we can see which pages and channels lead to enquiries. It does not read where you came from, and it uses no campaign tag or cookie for this. People often include details of their own situation there — nationality, family, finances, a visa application that was refused. Send only what you are comfortable sending.

Why we hold it: to answer you, and — if that is what you have asked for — to arrange the service with a firm in Thailand and get you a price. The lawful basis is your consent, given by the checkbox on the form, which you may withdraw at any time.

Where it is kept: in our mailbox, and in a private database on Cloudflare — the company that hosts this site — where we note which firm we asked and what was agreed. Only we can open it.

Who else sees it: the message is delivered to our mailbox by Resend, an email provider. To arrange a service you have asked for, we pass the details it needs to a firm in Thailand working in that field — immigration, accounting, property or education — which means your data leaves the European Economic Area. We do that only for the matter you raised, and you can ask us at any time which firm it went to. We do not sell data and we do not add you to a mailing list.

How long: enquiries are deleted twelve months after the last message in the exchange; in our database your name, email and message are cleared automatically at that point. We keep them that long only so that if you come back with a follow-up, the history is still there. Ask us and we will delete yours sooner.

Hosting and server logs

The site runs on Cloudflare Workers. Like any web host, Cloudflare processes the technical details of a request — including your IP address — to serve the page and to block abuse. We do not use those logs to identify individual visitors.

Services we call on your behalf

Weather figures come from Open-Meteo and exchange rates from Frankfurter. Both are requested by our server, not by your browser, so neither of them sees anything about you. Resend delivers contact-form messages, as described above.

The tip link goes to Buy Me a Coffee, where their own terms and privacy policy apply. We never see your payment details.

Your rights

Under the GDPR you may ask for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, or withdraw consent. Write to contact@duriandesk.com and we will deal with it. You also have the right to complain to the data protection authority in the country where you live.

Changes

If what we collect changes, this page changes with it and the date at the top is updated.