Privacy Policy
Last updated: August 2026 · Effective date: August 2026
This Privacy Policy explains how GoList ("GoList", "we", "us", or "our"), the operator of the travel-discovery website wheretogolist.com (the "Service"), collects, uses, discloses, and safeguards your information when you visit or use the Service. It also describes the choices and rights you have regarding your information.
By accessing or using GoList, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service. We encourage you to read this Policy in full so you understand our practices.
- Who we are & scope
- Information we collect
- How we use your information
- Legal bases for processing (EEA/UK)
- Cookies & similar technologies
- How we share information
- Affiliate links
- Data retention
- International data transfers
- Data security
- Your privacy rights
- Do Not Track
- Third-party links
- Children's privacy
- Changes to this Policy
- How to contact us
1. Who we are & scope
GoList is a travel-inspiration website that helps you discover destinations based on the kind of trip you want, and provides links to book flights, accommodation, and activities through third-party partners. This Policy applies to information we handle through wheretogolist.com and its related pages. It does not apply to third-party websites or services that we link to, which are governed by their own privacy policies.
2. Information we collect
2.1 Information you provide to us
- Account information (optional). If you choose to create an account or sign in (by email or through Google) so your Bucket List syncs across devices, we collect your email address and any destinations you save. You can use the entire Service without an account.
- Communications. If you contact us (for example, by email), we receive the information you include in your message, such as your name, email address, and its contents.
2.2 Information collected automatically
- Approximate location. When you open the Service, we look up your approximate, city-level location derived from your internet (IP) connection through a third-party lookup, solely to rank destinations by distance from you. We do not request or collect your precise GPS location, and we do not store this on our servers.
- Device & usage data. Like most websites, our hosting provider may process standard technical information — such as IP address, browser type, device type, referring page, and timestamps — to deliver pages, maintain security, and prevent abuse.
- Aggregate analytics. We use privacy-friendly, cookieless analytics to understand overall traffic (for example, how many people view a page and which site referred them). This data is aggregated and does not identify you personally.
2.3 Information stored on your device
To make the Service work, we store a small amount of information locally in your browser using local storage — including your saved Bucket List, your selected home city, and which destinations you have already been shown (so results stay fresh). This information remains on your device and is not transmitted to us unless you sign in to sync your Bucket List.
2.4 Information from third parties
If you sign in through Google, we receive basic account information (such as your email address) from Google in accordance with the permissions you grant. We also display destination content — such as restaurant listings and photos — sourced from third-party providers.
3. How we use your information
- To operate, maintain, and provide the Service and its features.
- To show you relevant destinations ranked by distance from your approximate location.
- To save and synchronise your Bucket List across your devices when you sign in.
- To measure and improve the performance, content, and usability of the Service.
- To earn affiliate commissions when you book through partner links, which keeps GoList free.
- To secure the Service, prevent fraud and abuse, and comply with legal obligations.
- To respond to your enquiries and provide support.
4. Legal bases for processing (EEA/UK)
If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
- Legitimate interests — to operate, secure, and improve the Service, to measure aggregate traffic, and to earn affiliate revenue that keeps the Service free, in a way that does not override your rights.
- Consent — where required, for example when you choose to sign in or when a partner sets non-essential cookies after you click a booking link. You may withdraw consent at any time.
- Contract — to provide account features you request, such as syncing your Bucket List.
- Legal obligation — where we must process data to comply with the law.
5. Cookies & similar technologies
GoList itself uses minimal cookies and local storage that are necessary to make the Service function — for example, to keep you signed in and to save your Bucket List and preferences on your device. Our aggregate analytics is cookieless and does not track you across other websites.
When you click an affiliate booking link, our travel partners may set their own cookies on your device to attribute the referral to us. These are controlled by those partners under their own policies. You can manage or delete cookies at any time through your browser settings, though some features (such as staying signed in) may not work if you block essential cookies.
6. How we share information
We do not sell your personal information. We share information only in these limited ways:
| Recipient | Purpose |
|---|---|
| Supabase | Authentication and Bucket List storage (only if you create an account). |
| Travelpayouts, Aviasales, Hotellook, Klook | Travel affiliate partners; when you click a booking link they may receive referral data and set cookies to credit the sale. |
| Yelp | Provides restaurant listings and photos displayed on destination pages. |
| Pexels | Provides destination photography. |
| IP geolocation & mapping providers | Estimate your approximate location and map/geocode destinations. |
| Vercel (hosting & Web Analytics) | Serves the website and provides privacy-friendly, cookieless traffic measurement. |
| Legal & safety | We may disclose information if required by law, to enforce our terms, or to protect the rights, property, or safety of GoList, our users, or the public. |
Each third party processes data under its own privacy policy. We encourage you to review them.
7. Affiliate links
Some links on GoList are affiliate links. If you click one and make a booking or purchase, we may earn a commission at no additional cost to you. This is our primary way of keeping the Service free. For more detail, see our Affiliate Disclosure.
8. Data retention
We keep personal information only for as long as necessary for the purposes described in this Policy. Account information and your saved Bucket List are retained while your account is active and are deleted (or anonymised) after you request deletion. Information stored locally in your browser remains until you clear it. Aggregate analytics data is retained in de-identified form.
9. International data transfers
GoList and some of our service providers operate in various countries, so your information may be processed outside your country of residence, including in countries that may have different data protection laws. Where required, we rely on appropriate safeguards for such transfers.
10. Data security
We take reasonable technical and organisational measures to protect information against loss, misuse, and unauthorised access, including serving the site over encrypted (HTTPS) connections and relying on reputable providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Your privacy rights
Depending on where you live, you may have some or all of the following rights regarding your personal information:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate or incomplete data.
- Deletion — ask us to delete your account and associated data.
- Objection / restriction — object to or restrict certain processing.
- Portability — receive your data in a portable format.
- Withdraw consent — where processing is based on consent.
- Non-discrimination — we will not treat you differently for exercising your rights.
If you are in California, you have rights under the CCPA/CPRA, including the right to know, delete, and opt out of "sale" or "sharing" of personal information — and we confirm we do not sell your personal information. To exercise any right, contact us using the details in Section 16. We may need to verify your identity before responding.
12. Do Not Track
Because there is no common industry standard for "Do Not Track" signals, GoList does not currently respond to them. Our analytics is cookieless and does not track you across sites regardless.
13. Third-party links
The Service contains links to third-party websites (for example, booking partners and restaurant pages). We are not responsible for the content or privacy practices of those sites, and this Policy does not apply to them. Please review their policies before providing any information.
14. Children's privacy
GoList is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will take steps to delete it.
15. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the "last updated" date above. Significant changes may be highlighted on the Service. Your continued use after changes take effect constitutes acceptance of the updated Policy.
16. How to contact us
If you have any questions, requests, or complaints about this Policy or your personal information, contact us at: