Privacy Policy

Data controller

The data controller for Skidbee is PRODUCTIONSinHD (sole trader Emil Auranen, Business ID 3420643-7).

Postal address: PRODUCTIONSinHD Vilpunkatu 2 A 4 02230 Espoo Finland

For privacy questions and requests concerning personal data: info@skidbee.fi.

What data do we handle?

It helps to separate two things: the data the service itself uses, and the ordinary technical connection data that any website visit creates.

• Your device location, when you ask for location-based results and grant the browser permission.
• The location you select or search for yourself, which may be remembered in your browser.
• The child's age you select, which is stored only in your browser.
• Your language choice (Finnish, Swedish or English).
• Feedback you send through the form, plus your optional email address.
• The page path the feedback was sent from, and the technical timestamps of the entry.
• Ordinary technical connection data (such as IP address and browser request details) handled by the technical platforms and network providers behind the service.
• The name and email address you enter in the submission form, plus the details of the place or event you submit, if you send a submission.
• Events in our own usage statistics: coarse usage data with no user, visit or device identifier, described in more detail under "Our own usage statistics".

During ordinary browsing, Skidbee does not ask for a name, date of birth, address or other identifying details. A name and email address are requested only if you submit a place or an event through the /ilmoita form; in the feedback form the email address is optional.

Your location

You can use Skidbee in two ways: by selecting or typing a location yourself, or by asking for results based on your device's current location. Location is never required — the service works fine when you pick a place manually.

When you ask for your current location, the browser requests permission separately. Skidbee receives no location at all before you grant it. Skidbee does not request the browser's high-accuracy positioning mode, but the accuracy of the location the browser returns can still vary.

• Device coordinates are used transiently during that use.
• They are not written to browser storage (localStorage).
• They are not stored in Skidbee's database.
• They are not added to the Skidbee page URL.
• In the capital region, the area can be resolved entirely in your browser using locally bundled area outlines.
• If local resolution doesn't succeed, the coordinates may be sent transiently to a Skidbee server function, which uses Geoapify's EU API endpoint for reverse geocoding. Skidbee does not store the coordinates at that stage either.

Location (either your device location or the place you chose) is also used to fetch weather, and to query nearby places and events from Supabase using map-bounds values. The weather request goes through a Skidbee server function, so your browser does not contact the weather provider directly. Skidbee's own infrastructure necessarily handles technical details of your connection, such as your IP address, and Supabase sees its own queries as part of the normal network connection.

Your child's age

You can choose a child's age so the content fits better. It is a single whole number between 0 and 12, and it involves no identification of the child in any way.

• The age is stored only in your browser as part of your preferences.
• No child's name, date of birth or email is requested or stored.
• No account or identifier is created for a child.
• The age is not sent to Skidbee's database, not to Supabase as a preference, and not to third parties.
• The age is used locally to filter content and order recommendations.

What is the data used for?

Data is used to run the service and to improve it based on feedback.

• Showing suitable activity ideas.
• Finding places and events nearby.
• Taking the weather into account in suggestions.
• Remembering the preferences you chose, on your own device.
• Receiving, handling and replying to feedback.
• Operating, securing and debugging the service.
• Receiving, reviewing and publishing submitted places and events, and corresponding with the submitter.
• Improving the service and judging how well the content fits, using our own limited usage statistics (for example noticing that searches too often return zero results).

Recommendations are contextual: the child's age, location, weather and time of day may affect the order content appears in at that moment. Skidbee does not build a lasting behavioural profile from this and keeps no history of clicks, viewed content or interests tied to a user identifier.

Browser storage and cookies

The service uses the following data stored in your browser:

• pp.prefs.v1 – browser localStorage. Remembers the selected child's age and the location you chose (an identifier for catalogue places, and coordinates for searched locations). No automatic expiry: it stays until you change it or clear the site data in your browser.
• skiddo_locale – a first-party functional cookie that remembers your explicit language choice. Valid for roughly one year.
• __cf_bm – a Cloudflare infrastructure cookie for security and bot management. Valid for about 30 minutes.
• __dpl – a technical hosting cookie related to pinning the deployed version. Valid for about 24 hours.
• Your browser's session storage may hold ordinary technical navigation state, such as scroll position restoration.
• skidbee.usagestats.optout – a privacy preference in browser localStorage. It is written only if you turn our own usage statistics off yourself, and its value is just a fixed marker ("1"). It contains no random or unique identifier, is never sent to the server and is never attached to an event, and it disappears when you turn the statistics back on or clear site data.
• skidbee.ga4.consent.v1 – your choice about the optional Google Analytics, in browser localStorage. Its value is only "granted" or "denied" and contains no random identifier. If you consent, Google Analytics may additionally set its own first-party analytics cookies (_ga and _ga_<measurement id>); without consent they are not set.

Skidbee uses no advertising cookies, no marketing tracking and no behavioural tracking. Skidbee's own limited usage statistics use no cookies and store no analytics identifier in your browser — the only thing stored for them is the opt-out preference described above, which you set yourself. With the current implementation we ask separately for consent only for the optional Google Analytics, which may set its own analytics cookies after consent; without consent the only storage in use is the functional and technical storage described above. The site is therefore no longer entirely free of analytics cookies if you consent to Google Analytics. If we ever introduce other technologies stored in the browser, we will assess the need for consent separately.

Feedback and email

When you send feedback, we store what you entered in the form. The email address is optional and is used only to get back to you about your feedback — never for newsletters or marketing.

• The feedback type, i.e. the topic.
• The message you wrote.
• An optional email address.
• The page path the feedback was sent from.
• Technical timestamps and the row identifier.

Feedback is not sent together with the child's age, device coordinates, your chosen location, a browser identifier or any persistent user identifier. Feedback is kept for a maximum of 12 months: an automatic daily cleanup deletes older rows. Feedback is additionally sent as a notification to Skidbee's administrative mailbox (info@skidbee.fi) through Lovable's email service, so that it is noticed and can be answered. The notification contains the same form details, and if you provided your email address it is set as the reply-to address. If the email delivery fails, the feedback is still stored in the database. Feedback cannot be read, edited or deleted from the browser — only administrative access can reach it. Please avoid writing unnecessary personal details into the free-text field.

Submitting places and events

You can submit a place or an event through the /ilmoita form. Submitting is voluntary and requires no account. The form asks for a name and an email address so that we can clarify details if needed and let you know about publication.

A submission publishes nothing automatically: it is stored in our review queue, which only administrative access can reach. We store the following details of a submission:

• The submitter's name.
• The submitter's email address.
• The details of the submitted place or event, for example name, organiser, address, municipality, time, price, age recommendation, languages and categorisation.
• Optional free-text fields, such as the description and any notes for us.
• The source URL of the submission, i.e. the link to a web page, if you provide one.
• The submission type (place or event) and its review status.
• Technical timestamps: when the submission was created and when it was updated.
• The accepted version of the Terms of Use (terms_version) and the moment of acceptance (terms_accepted_at).
• The internal submission identifier and our review records, such as review notes and any publication details.
• The notification email sent about the submission to the administrative address info@skidbee.fi, containing the same form details.

Once we have reviewed the submission, we send one message to the submitter's email address about the outcome (published or not published), in the language the submission was made in. The message concerns only that submission, and the address is never used for newsletters, marketing or mailing lists. A notification about the submission is sent to the administrative mailbox (info@skidbee.fi) through Lovable's email service, and the submitter's email address is set as the reply-to address so that we can answer directly. If the email delivery fails, the submission still remains in the review queue. The purposes of processing are receiving and reviewing the submission, asking for further details where needed, publishing or declining the content, and preventing misuse; the legal basis is our legitimate interest in compiling the service's content and in corresponding with the submitter. The terms acceptance is stored as evidence of which terms the submitter accepted — it is not a consent to processing personal data. Please avoid writing unnecessary personal details into the free-text fields, and do not send images or identifying details of children.

External services

A few external services are needed for Skidbee to work. The ones below may receive a visitor's technical or personal data.

• Supabase – content database and feedback storage. Your browser reads public place and event data directly, and nearby queries include map-bounds values derived from a location. The database is hosted in London, United Kingdom. Skidbee does not build a visitor profile from these reads.
• MET Norway / Norwegian Meteorological Institute – weather forecasts. Your browser sends the weather request coordinates to a Skidbee server function, which fetches the forecast from MET Norway; your browser does not contact MET Norway directly. Coordinates passed onward are rounded to at most roughly four decimal places, and we do not call that coordinate anonymised. MET Norway therefore sees technical data about Skidbee's server connection rather than your browser's IP address, and MET Norway may process its own technical access logs under its own terms and privacy practices. Skidbee does not store weather request coordinates or MET Norway responses in its database.
• OpenFreeMap and OpenStreetMap – map tiles. Your browser requests tiles directly from the provider, which sees ordinary connection data such as your IP address. A tile URL does not contain your exact device coordinate, but the tiles you view naturally reveal the geographic area being looked at.
• Geoapify – location search and reverse geocoding. Your typed location search and your device coordinates (rounded to roughly 110 metres) are sent through Skidbee's server to Geoapify's EU API endpoint (api-eu.geoapify.com); your browser does not contact Geoapify directly, so Geoapify does not receive your browser's IP address through that API call. No child age, event information, usage-statistics identifier or persistent user or device identifier is sent with it. Geoapify may process its own technical logs under its own terms, and we do not call the search anonymous. Skidbee does not store the searches or the responses in its database. The same server path is also used for admin address checks. Geoapify's location data is derived from OpenStreetMap.
• Cloudflare – traffic delivery, security and bot protection. Handles ordinary technical connection data and sets the infrastructure cookie described above.
• Lovable – the technical hosting platform. According to the provider's documentation, operational log data may include things like IP address, approximate location derived from the connection, browser and device details, pages and features accessed, timestamps and debugging information, and it may be retained for up to 90 days. This is hosting, security and troubleshooting processing — Skidbee does not build visitor analytics from it. The same provider's email service delivers the feedback notification to the administrative mailbox, processing the message content, the recipient and any reply-to address.
• Google Maps – opens only when you deliberately choose directions. The URL carries the destination place or event location; Skidbee does not add your current location to it. Once you move over to Google, Google's own privacy practices apply.

Transfers outside the EU/EEA

Skidbee's Supabase database is hosted in London, United Kingdom, which is outside the EU and EEA. The European Commission currently recognises the United Kingdom as providing an adequate level of data protection.

Some technical providers, such as hosting and network partners, may run internationally distributed infrastructure. For that reason we do not claim that all processing happens inside the EU/EEA, and we do not name a country for log processing that we have not verified ourselves.

Retention periods

Retention matches what the service actually stores:

• Current device location: not stored persistently by Skidbee.
• The location you chose: in your browser until you change it or clear site data.
• Child's age: in your browser until you change it or clear site data.
• Language cookie: about one year.
• Infrastructure cookies: __cf_bm about 30 minutes, __dpl about 24 hours.
• Feedback: a maximum of 12 months in the database. The email notification about the feedback remains in the administrative mailbox until it is deleted there, and the email service's delivery records for the provider's own retention period. The hosting platform's operational log data may, according to the provider, be retained for up to 90 days.
• Submissions (place and event submissions): a maximum of 12 months from the moment the submission was finally handled, i.e. approved or declined. An automatic daily cleanup then deletes the row. Submissions still awaiting review are not deleted automatically, because they have not been resolved. Published place and event details remain in the service as content, but they do not contain the submitter's name or email address.
• Our own usage-statistics rows: a maximum of 12 months. An automatic daily cleanup permanently deletes older rows from the database, and no longer-term copy of the rows is kept.

Legal bases for processing

In short, processing rests on the following grounds:

• Delivering the features you asked for: the processing is needed to give you exactly the result you requested (for example nearby places or a weather-aware suggestion).
• Receiving, handling and replying to feedback: legitimate interest.
• Operating, securing and debugging the service: legitimate interest in providing a working and protected service.
• Functional preferences stored in your browser: processing needed for the service to work, which you can change or delete yourself.
• Receiving, reviewing and publishing submissions, corresponding with the submitter and preventing misuse: legitimate interest. The terms acceptance is stored as evidence that the contractual terms were accepted, not as consent to processing personal data.
• Our own limited usage statistics: legitimate interest (Article 6(1)(f) GDPR) in improving how the service works and what content it offers. We have assessed that legitimate interest internally and kept the amount of data as small as possible. You can object going forward by turning the usage statistics off in your browser under "Our own usage statistics".

The browser's location permission is a technical permission under your control. On its own it is not a complete description of a legal basis under the GDPR, and granting it should not be read as automatic GDPR consent. The legal basis and the rules about storing information in the browser are two separate things: our own usage statistics rest on legitimate interest, and separately, they use no analytics cookies, no localStorage identifiers, no fingerprinting and no other persistent visitor identifier — the current implementation stores no analytics information on your terminal device and reads no analytics identifier from it.

Your rights

You have the rights to your personal data that the GDPR provides. In practice, with Skidbee they mostly concern feedback and submissions you have sent, since other data stays in your own browser.

• The right of access to your data.
• The right to have data corrected.
• The right to erasure.
• The right to restriction of processing.
• The right to object to processing where applicable.
• The right to data portability where applicable.

Skidbee has no user accounts and no persistent user identifier. Preferences stored in your browser, such as the child's age or chosen location, therefore generally cannot be linked by us to an identified person, and we cannot retrieve them remotely — you can change or delete them yourself in your browser. For matters concerning feedback or a submission you have sent, contact info@skidbee.fi. Our own usage statistics are deliberately built without any user, visit or device identifier. We therefore normally cannot tell which existing statistics rows relate to you, and we do not introduce additional identification merely to make those rows identifiable. This does not remove the rights the GDPR gives you. The practical way to object to this processing is to turn the usage statistics off in your browser under "Our own usage statistics"; that applies to events sent from then on. Existing statistics rows are deleted automatically within 12 months. An email request cannot by itself identify or stop future statistics events in your browser, but you are always welcome to send privacy questions and requests to info@skidbee.fi.

Managing the location permission

Using your location is always voluntary and you stay in control of it.

• You can decline location access when the browser asks for permission.
• You can use the service by picking a place manually, without any location permission.
• You can withdraw a permission you granted earlier in your browser or device settings.

Children's privacy

Skidbee is meant for parents and other adults looking for things to do with children. The service creates no accounts and no identifiable profiles for children.

The selected child's age is only a content preference that stays on your device. Normal use of the service never asks for a child's name, date of birth, email or other contact details.

Analytics and advertising

At the moment, Skidbee has no:

• advertising trackers or marketing pixels,
• personalised advertising,
• marketing profiling,
• third-party analytics without your consent — the optional Google Analytics is described in its own section below.

The site's fonts are self-hosted, so a normal page load makes no requests to Google's font service. We use Skidbee's own cookieless usage statistics, described in the next section, and the optional Google Analytics, which is enabled only with your consent and is described in the section after that. This policy describes the service as it works today.

Our own usage statistics

We improve the service with a very limited first-party usage statistic. It uses no cookies, no localStorage identifier, no fingerprinting and no other persistent visitor identifier, and individual events cannot be linked to the same person or visit. The legal basis for the processing is legitimate interest (Article 6(1)(f)).

The statistics are collected only on the real public site (skidbee.fi and www.skidbee.fi). Nothing is collected from development or preview builds, tests or automated browsers.

• The type of event, for example that a search was made, that a result list was shown, that a programme was opened or that directions were opened.
• The view the event came from (programmes, nearby, ideas or a programme page).
• The number of results as a coarse number and as a class (for example zero results or few results).
• The selected day option and how many days from today it is, the number of filters, and the sort choice.
• The selected age range, as one of the ready-made ranges the service offers.
• The timestamp of the event.

The statistics store no IP address, browser identifier, session or user identifier, device identifier, fingerprint, referring address, exact location, street address, search words, free text, names, email addresses or programme titles. The rows cannot be read from the browser and administrators see aggregate counts only. Rows are deleted automatically after 12 months. You can turn these statistics off in your own browser with the control below; no new statistics events are then sent from your browser. Opting out does not affect any other part of the service, and you can turn the statistics back on later.

Google Analytics (optional)

Google Analytics is entirely optional in Skidbee and is enabled only if you give explicit consent. Before consent Google's measurement script is not loaded at all and nothing is sent from your browser to Google Analytics — no cookieless measurement and no consent-state messages either. The purpose of the processing is to understand how the service is used and to improve Skidbee accordingly.

The legal basis is consent (Article 6(1)(a)). You can refuse without it affecting your use of the service, and you can withdraw consent later in the analytics settings on this page.

• Google Analytics is loaded only if you choose "Allow analytics". Without consent no request is made to Google.
• You can withdraw consent at any time under "Change analytics settings". Withdrawal stops new Google Analytics events immediately and removes Skidbee-domain _ga cookies on a best-effort basis.
• After consent, Google Analytics may set first-party analytics cookies (_ga and _ga_<measurement id>).
• Google Analytics creates browser, client and session identifiers as part of how it operates. We therefore do not call Google Analytics data anonymous.
• Google Analytics receives technical and browser usage information (for example the page address without query parameters, browser and device details and connection data, and it also processes the IP address as part of operating the service, under its own terms and documentation).
• Skidbee's own events are sent to Google Analytics deliberately coarse: event type, view, age range as one of the ready-made ranges, day option, result size class, difference in days, number of filters, confidence of the age information, sort choice, and the kind of search or directions.
• Skidbee intentionally does not send place-search text, exact coordinates, postcode, street address, a child's exact age, programme or place titles, database identifiers, names, email addresses or free text to Google Analytics. Of the page address only the origin and path are sent, without query parameters.
• Advertising-related consent is always kept denied. Skidbee uses no Google Ads, no remarketing, no ad audiences, no Google Signals and no User-ID.

Google Analytics is a service of Google Ireland Limited / Google LLC and is subject to Google's own data processing and privacy terms. We do not claim that all Google Analytics processing takes place inside the EU or EEA. Withdrawing consent and deleting cookies stops new collection in this browser but does not delete data Google has already received; requests about that should also be addressed to Google. Google Analytics runs only on the real public site (skidbee.fi and www.skidbee.fi), not on admin pages, development or preview builds, tests or automated browsers. Skidbee's own limited usage statistics continue independently of this choice and remain cookieless.

Right to lodge a complaint

If you believe your personal data has been handled contrary to data protection law, you have the right to lodge a complaint with the supervisory authority. In Finland that is the Office of the Data Protection Ombudsman.

Changes to this policy

This policy is updated if the way Skidbee handles data changes. The current version can always be found on this page.