Privacy Notice

The short version

There is no advertising and no tracking on this site. We do not use Google Analytics or any equivalent, we run no ad network, we set no cookies to follow you, and we do not sell personal data to anyone.

We do count page views, and the way we do it is the point: there is no script in your browser, nothing is stored on or read from your device, and the count carries no identifier of you — not a cookie, not a session id, not a hashed IP address. We record that a page was read, which site linked to it, and which country it was read from. We cannot tell you apart from anyone else, we do not try, and we could not go back and single you out if we wanted to.

What we do hold is small and boring: an email address if you have an account, and your IP address for a few minutes so that one visitor cannot exhaust the free API for everybody else. That is very nearly the whole story, and the rest of this page is just that in detail.

Who we are

ThemeParks.wiki is operated by Jamie Holding (James Holding on the paperwork), a sole trader based in the United Kingdom. We are the "data controller" for the personal data described on this page, which means we are the ones responsible for it, and here is where to find us on the record:

• Postal address: James Holding, ThemeParks.wiki, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. Post needs the name James on it to reach us.
• ICO registration: ZC215410, on the Information Commissioner's Office register of fee payers. It is a public entry, so you can check it without asking us.

Contact us about anything here, including to exercise any of your rights: hello@themeparks.wiki. Email reaches us faster than post does.

What we collect, and why

If you use the site or API without an account, we process:

• Your IP address, to count requests against the rate limit and to block scanners and abusive traffic. It is held in a short-lived cache, not a database of visitors — see how long we keep things, below.
• The site your browser says you came from, and only the site. We keep https://example.com, never the particular page you were on or anything after it. We count those in aggregate to see who links to the API, and we do not attach the count to you or to your IP address.
• A page view, when a page of the website is served to you: the address of the page, the site that linked to it (again the site, never the page), and the country your request came from. This is one row saying "this page was read once, from this source, in this country". It contains nothing that identifies you and no reference to any other row, so there is no way to reconstruct a visit, a journey, or a person from it. We use it to see which pages and which articles are worth writing more of.

If you create an account, we additionally store:

• Your email address — to verify the account, let you reset your password, and contact you about the service or your API keys.
• Your username and display name.
• A one-way hash of your password. We never store the password itself and cannot recover it.
• One-way hashes of your API keys. We cannot show you a key again after you create it, because we do not have it.
• If you sign in with Discord or GitHub: the account identifier and display name they give us, plus access tokens, which are encrypted at rest. We ask those services for the minimum they will give us, and we never receive your password for them.

We do not ask for your name, address, phone number or date of birth, because we do not need them.

If you buy a subscription, the checkout is run by Paddle, our merchant of record. Paddle collects your payment details, billing address and tax location itself, as a data controller in its own right under its own privacy notice; we never see your card. What we send Paddle, at the moment you open the checkout, is two things: the email address on your account, so the receipt and the plan land on the same person and you are not asked to type it again, and an internal reference to your account, which is the identifier we generated when you signed up and means nothing outside our own database. It comes back on Paddle's messages to us and is how we know which account to put on the plan. We send nothing else, and we do not send your username, your API keys or anything about how you have used the service. What Paddle sends us, and what we store, is the email address you gave at checkout, your country, and the identifiers of your Paddle customer record, your subscription and each transaction. We use them to put your account on the plan you bought, keep it there while the subscription runs, and handle cancellations and refunds.

If you use a paid feature, we record it against your account: when, and which of your API keys made it, or that it came from the website. For history beyond the free window we also record which attractions and their destinations, the time range you asked for, how far back we actually served, and how many observations came back; for the websocket firehose, how many times you connect and how long you stay connected, each per key per day. Any paid feature added later is recorded the same way. Nothing is recorded for a request inside the free window, or for anonymous traffic from someone without an account. We keep this so a refund request can be judged on what the account actually did, as the refund policy says.

When you accept the terms, whether while creating an API key or when you ask at checkout for your plan to start immediately, we record that acceptance: your account, which version of the document you accepted, when, and the form you accepted it through. We do not store your IP address with this record. It is kept for as long as your account exists, like other account data.

There is no automated decision-making and no profiling. Nothing about you is decided by an algorithm here.

Our lawful bases

Data protection law requires us to have a specific reason for each use. Ours are:

• Performance of a contract — everything account-related, including switching your plan when Paddle tells us you have paid. You asked us for an account and API keys; we cannot provide them without an email address and a password hash.
• Legitimate interests — rate limiting and abuse prevention using IP addresses, the aggregate counts of which sites link to us, and the aggregate page counts described above. Our interest is keeping a free service available and not letting one client degrade it for everyone. We have weighed this against your privacy: the data is held briefly, used for nothing else, never enriched, never combined into a profile, and never shared for marketing.

We do not currently rely on consent for anything, which is why you are not being asked to click a banner.

How long we keep it

• IP addresses: minutes to an hour, depending on which limit is being counted. The general rate-limit counter lasts a minute; the history budget is metered by the hour, so an address used for history requests is held for up to an hour. A block on abusive traffic lasts up to 30 minutes. All of them expire by themselves. We do not keep a log of which addresses visited us.
• Account data: for as long as you have an account. Ask us to delete it and we will.
• Referrer counts: kept as running totals per linking site. There is nothing personal in them and nothing to tie one back to a person.
• Page counts: three months, after which our hosting provider deletes them automatically. They were never personal data, so this is a storage limit rather than a privacy one.
• Billing records: the subscription, transaction and refund records Paddle sends us are kept for six years after the last payment, because tax and accounting rules require financial records to be kept that long, even if you delete your account in the meantime.
• Paid-feature usage records: 180 days, then deleted automatically. That covers the period in which a refund or a card dispute can still be raised.

Separately, our hosting provider keeps short-lived server logs as part of running the platform, in the ordinary way.

Who else touches it

We use a small number of suppliers to run the service. They process data on our instructions only, under contract, and none of them are permitted to use it for their own purposes:

• Cloudflare — the website, DNS, protection against attacks, and where the aggregate page counts are stored.
• Heroku (Salesforce) — application hosting and the database.
• Amazon Web Services — our data archive, in the London region.
• Mailgun — sending account emails, via its EU service.
• GitHub and Discord — only if you choose to sign in with them, or sponsor us through GitHub.
• Better Stack — monitoring whether the service is up.

Paddle is different. As merchant of record for paid subscriptions it handles the checkout, payment, invoicing, tax and refunds, and for the payment data it collects it is a controller in its own right rather than our processor. Paddle is a UK company; its privacy notice covers what it does with that data.

We do not sell personal data, share it with advertisers, or hand it to data brokers. We would disclose data if we were legally required to, and we would tell you unless we were prohibited from doing so.

Where it is held

We keep data in the UK or EU where the choice is ours: our archive is in London and our email provider runs on its EU service. Some of our suppliers are US companies. Where personal data is transferred outside the UK or the EEA, that transfer is covered by the supplier's data processing agreement together with the UK's International Data Transfer Addendum or the EU standard contractual clauses, which are the safeguards the law provides for this.

Cookies and your browser

We set no cookies. Not for analytics, not for advertising, not for anything.

One page is different, and only that one page. The checkout at /checkout loads Paddle's own script so the payment overlay can run, and Paddle sets its own cookies there, as the controller of them, under its privacy notice. They carry your payment through and help Paddle spot fraud. They are Paddle's, not ours; we cannot read them, and no other page on this site loads that script. They are strictly necessary for a payment you have asked to make, which is the one category the banner law exempts, so they do not produce a banner either. If you never open the checkout, none of this touches you.

If you log in, the site keeps your session in your browser's local storage so you are not signed out on every page. It also briefly remembers two things to stop the site annoying you: whether a page needed reloading after an update, and whether you have dismissed the "create an account" prompt. All of that is necessary for features you asked for, none of it identifies you to anyone else, and none of it leaves your browser except to sign your requests to our own API.

That is why there is no cookie banner on this site. The law that produces banners is about storing or reading things on your device, and our page counting does neither — it happens on our server, from the request you already sent us, with nothing written back to your browser. There is genuinely nothing here to consent to. If that ever changes, we will ask properly rather than assume.

If your browser sends Do Not Track or Global Privacy Control, we do not count the request at all. Neither signal obliges us to do that. We do it because you asked in the only way a browser lets you ask, and a page count is not worth ignoring you over.

Your rights

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong.
• Delete your account and its data.
• Restrict or object to how we use it, including objecting to anything we do on the basis of legitimate interests.
• Port it — receive it in a machine-readable form.

Email hello@themeparks.wiki. We do not charge for this and we will not ask you why. We aim to respond within one month, which is the deadline the law sets, and we will tell you if a request is complex enough to need longer.

If you are unhappy with how we have handled your data, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk/make-a-complaint), or to your own country's supervisory authority if you are in the EU. We would rather you told us first so we can put it right, but you do not have to.

Changes to this notice

If we change what we collect or why, we update this page and record it in the changelog below. Material changes are announced on the status page and, for account holders, sent by email. See also our Terms & Acceptable Use.

Changelog

• 20 September 2026 — corrected the retention period stated for IP addresses. It said a rate-limit counter lasts about a minute; the history request budget is metered per hour, so an address used for history requests is held for up to an hour rather than a minute. Nothing about what we collect changed — only the description of how long one of the counters keeps it.
• 9 September 2026 — described what the checkout page sends to Paddle, that Paddle's own cookies are set on that one page, and that the consent record also covers asking for immediate access at checkout. Nothing new is collected by us.
• 6 September 2026 — described the paid-feature usage records kept as refund evidence, their 180-day retention, and the consent record kept when you accept the terms while creating an API key.
• 6 September 2026 — described billing through Paddle: what Paddle collects itself, what it sends us, and how long we keep it. Nothing else changed.
• 9 August 2026 — added our postal address and ICO registration number, and corrected the referrer description: we only ever stored the linking site, never the page. No change to what we collect or why.
• 29 July 2026 — first published.