Your privacy
Last updated 25 September 2026
Vanlife Stories is a sample project run by Charlesworth AI (details in the legal notice). This is what it does with personal data. It follows the EU General Data Protection Regulation (GDPR).
The short version
- No cookies, no advertising and no third-party analytics.
- Sign-in is by invitation only. Everyone else can look around, or try the read-only demo, which shows sample photos and stores nothing about you.
- Photos are private: only their owner sees them, and they are never shared, published, sold or used to train anything.
If you just visit (or try the demo)
To see which pages are read, the site records a small entry for each page view: the page address (without anything after a ? or #), the website you came from (the site name only), whether you are on a mobile, tablet or desktop, and your country. On blog posts and the About page it also records how long the page was visible and how far you scrolled.
- Your country is looked up from your IP address at the moment of the visit. The address is used for that in memory and thrown away: it is not stored.
- A visitor code is kept only to count how many different visitors there were in a day. It is a one-way hash of your IP address and browser details, mixed with a random value that changes every day and is deleted after two days, after which the code can no longer be linked to you.
- Nothing is placed on your device (no cookies or identifiers) and nothing is read from it beyond what the page already knows. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is recorded.
- How long: 180 days. Only the site's administrators can see the totals.
- Security logs of IP addresses and pages requested are kept in a rolling log (the most recent few tens of megabytes, so days to weeks) for security and troubleshooting.
- The map loads tiles from OpenStreetMap, so it learns your IP address when you open the map, including in the demo.
The legal basis for all of this is legitimate interests (GDPR art. 6(1)(f)): knowing which pages are read and keeping the site secure, with no cookies and no profile of you.
If you have an account (by invitation)
- What is stored: your email address, your name, a hashed password if you set one, a two-factor secret if you turn that on, and the date you accepted the Terms. To keep you signed in, your browser holds a login token in local storage. Unsaved travel log entries are kept there too, so they survive a closed window or a reload; each one is removed when you save or discard it, or delete the entry. Neither is a cookie, and neither is used to track you. Clearing your browser's site data removes both.
- Your photos are stored against your account in Amazon Web Services storage in Ireland. Other users can't see them, and they are never shared, published, sold or used to train the software. The site owner only looks at them when needed to help you or to keep the site secure.
- Number plates can be blurred automatically, depending on the option you choose when uploading. Faces are not blurred. If you correct a plate blur by hand, the unblurred original is kept so the correction can be redone; it is used for nothing else and is deleted with the photo.
- Location: if a photo has GPS data, the site reads it to place the photo on your map. To look up the place name, only the coordinates (never the photo) are sent to OpenStreetMap's Nominatim service.
- How long: until you delete a photo or your account. Deleting deletes every stored copy.
The legal basis for running your account and photos is the contract you accept in the Terms (art. 6(1)(b)). Nothing is decided about you automatically.
Contact form
A message sent through the contact page is emailed to us and used only to reply. It is kept only as long as needed, normally no more than 12 months.
Who else is involved
| Who |
What for |
| Amazon Web Services (Ireland) |
The servers the site runs on, and photo storage |
| MongoDB Atlas (on Amazon Web Services, Paris) |
The database |
| Maxer Hosting |
The mail server that sends sign-in links and receives contact-form messages |
| Google Fonts |
Typefaces in sign-in and account emails. The email fetches them when it is opened, so Google learns your IP address and when you opened it |
| Sentry (EU region, Germany) |
Error monitoring: error reports only, configured to send no personal data or photo data |
| OpenStreetMap Foundation |
Map tiles (your browser asks for them) and place names (photo coordinates only) |
Amazon Web Services, MongoDB Atlas, Maxer Hosting and Sentry are processors acting on our instructions; OpenStreetMap and Google act for their own purposes. Nothing is sold or given to advertisers. Where a provider is a US company or outside the EU, transfers rely on the safeguards in its data-processing terms (the EU Standard Contractual Clauses or the EU–US Data Privacy Framework).
Your rights
You can see and download your data, delete your account, and correct your details yourself in Settings. You can also object to processing based on legitimate interests, or ask anything else, through the contact page. Requests are answered within one month. If you are not satisfied, you can complain to your local data protection authority.
You must be at least 18 to have an account. If this notice changes in a way that matters, its date changes and account holders are asked to accept the Terms again.