Privacy Policy

Privacy Policy

Version date: October 19, 2026. This policy explains how whenjapan.com ("the Site", "WhenJapan", "Japan Travel Comfort Calculator", "we", "us") handles visitor information. This notice explains our practices; reading or using the Site is not consent to optional advertising or analytics.

1. Who we are and scope

The Site is managed by the website operator using WhenJapan / Japan Travel Comfort Calculator as its public operating name. For Hong Kong Personal Data (Privacy) Ordinance purposes, that operator is the data user for Site visitor information; where GDPR / UK GDPR applies, that operator is the data controller. Privacy, legal, and data-rights enquiries can be sent to hello@whenjapan.com. If the Site later operates through a company, partnership, or other legal entity, this page will be updated. This policy applies when you browse the Site, use the calculator, itinerary planner or itinerary checker, read guides, or contact us by email.

The Site currently does not offer user accounts, process payments, or ask for passport numbers, government ID, date of birth, precise address, health records, or payment data. Please do not send sensitive personal information to us by email.

2. Information we collect

Information you provide: if you contact us by email or through the Contact page, we receive your name or display name if provided, email address, message content, and related correspondence. Providing this information is voluntary, but if you do not provide a workable contact method, we may be unable to respond. We use this to respond, handle correction requests, keep reasonable operational records, and protect the Site.

Technical information collected automatically: when you visit the Site, Cloudflare Pages / CDN / DNS / security and other hosting, security, or analytics services may record IP address, approximate region, device and browser type, operating system, HTTP request headers, referring URL, pages or URLs viewed, timestamps, error logs, and security events. This is used to load the Site, cache content, provide TLS, detect and block abuse, debug issues, protect security, and understand aggregate usage.

Calculator choices: the Japan Travel Comfort Calculator runs in your browser. The month, region, priority, or preference choices you select are generally not used by us to identify you. If your URL includes query parameters, that URL may be logged by hosting or analytics services for technical and statistical purposes.

Pasted itineraries: the itinerary checker analyses your text within the current browser page. Its checking code does not upload the text to us or an AI provider, add it to a share URL, or save it to local storage. Loading the page and its public data files still creates normal technical requests. Browser extensions, browser session restoration and your own sharing are outside this local processing. Avoid pasting names, booking references, passport details or health records.

Share links and downloads: calculator and planner URLs can contain your region, month, trip length, pace and travel preferences, including an allergy-related preference. Anyone receiving the URL can read those choices; URLs may also appear in browser history and hosting logs. These are not private or password-protected links. Result cards are saved to your device or shared with the app you choose; check their contents before sharing.

Usage events: the current site code creates limited browser events, such as the tool used, language, region, month and score band. It does not include pasted itinerary text, names or email addresses in those events. The current code does not connect those events to an external analytics provider, including Cloudflare Web Analytics described below. This does not prevent the technical logging described above.

3. How we use information

We use information to provide and maintain the Site, respond to enquiries, improve content and tools, detect and prevent abuse, protect security, understand anonymous or aggregate traffic, comply with legal obligations, and make required disclosures or controls if advertising or affiliate links are enabled.

4. Cookies, analytics, and advertising

The Site and third-party services may use cookies, local storage, pixels, or similar technologies for essential operation, security, preferences, analytics, and advertising. You can block or delete cookies through your browser settings, though some features or security checks may be affected.

The Site uses Cloudflare Pages, CDN, DNS, and security features to provide the Site, HTTPS, caching, abuse prevention, DDoS / WAF-type protection, and technical records. Cloudflare may process the technical information described above under its service terms, data processing terms, and Cloudflare Privacy Policy.

Cloudflare Web Analytics: the Site uses Cloudflare Web Analytics. Cloudflare adds a measurement script to pages that collects the page URL (which may include query parameters), referring URL, country or region, device type, browser, operating system, and performance data such as load times, so we can understand aggregate traffic and site performance. According to Cloudflare's documentation, this script does not use cookies, local storage, or other browser storage, and does not identify individuals by IP address, User Agent, or other data; the IP address attached to the request is discarded at the Cloudflare data center and is not stored in its analytics databases or logs. We only view aggregate statistics and do not use them to identify individual visitors. If you do not want to be measured, you can block static.cloudflareinsights.com with a browser content blocker; the Site will still work.

Cloudflare automated-traffic protection: Cloudflare adds a security-check script to pages (paths starting with /cdn-cgi/challenge-platform/) to distinguish human visitors from automated programs, and may set security cookies such as cf_clearance and __cf_bm. These cookies are used only for security and abuse prevention, not for advertising or analytics.

The Site does not currently use Cloudflare Zaraz or Turnstile. If they are enabled later, this page will be updated and consent or choice controls will be provided where required by applicable law.

Google Search Console may be used for aggregate search performance and indexing information. Google Search Console does not require a tracking script to load in visitors' browsers. As of the last updated date above, the Site does not load Google Analytics / GA4 or Google Tag Manager scripts. Such processing is subject to the Google Privacy Policy.

Google AdSense is not currently enabled. Public pages do not show ads or load the AdSense advertising script. If AdSense is enabled later, this policy will be updated and applicable cookie or advertising consent choices will be provided before the script loads.

You can manage or opt out of personalized advertising through:

• Google My Ad Center / Ads Settings
• aboutads.info (US DAA) and Your Online Choices (EU)
• Your browser cookie settings

For visitors in the European Economic Area, the United Kingdom, and Switzerland, if personalized ads, non-essential analytics cookies, or similar technologies are enabled, we will request consent through Google or another appropriate consent management mechanism as required by applicable law. Rejecting non-essential cookies will not prevent you from reading guides or using the comfort calculator. When advertising or analytics features that use cookies are enabled, the page will provide a Cookie choices entry point so you can change or withdraw your choice.

5. Current third-party service status

As of the last updated date above, the Site's main third-party service status is as follows. If this changes, this page will be updated. If non-essential cookies, personalized advertising, or similar tracking technologies are involved, consent will be requested first where required by applicable law.

6. Third-party service providers

We may use the following categories of providers to process limited information: Cloudflare (Pages hosting, CDN, DNS, security features, Web Analytics, and possible Email Routing); source-code and deployment services (such as GitHub); analytics and search-performance tools (such as Google); advertising services (such as Google AdSense); and email services. These providers process information under their service terms, data processing terms, privacy policies, our settings, or applicable law.

We can handle information we control through available account settings and applicable law. However, logs or records kept by third-party providers for security, abuse prevention, legal compliance, backups, or service operations may be subject to their own policies, retention periods, and legal obligations, and may not all be immediately deletable or changeable by us.

7. Legal bases (GDPR / UK GDPR)

Where GDPR or UK GDPR applies to the processing, our legal bases may include our legitimate interests in providing the Site, securing it, measuring aggregate traffic and site performance with cookieless Cloudflare Web Analytics, and responding to enquiries; steps taken at your request when you contact us; your consent for non-essential analytics, advertising cookies, and personalized ads; and legal obligations where applicable. You may withdraw consent at any time, without affecting processing already carried out.

8. Your rights

Hong Kong: where the Personal Data (Privacy) Ordinance applies, you may request access to, and correction of, the personal data we hold about you.

EU / UK: where GDPR / UK GDPR applies, you may request access, correction, deletion, restriction, objection to processing, data portability, and withdrawal of consent. You may also lodge a complaint with your local data protection authority.

California: where the CCPA/CPRA applies to the Site, you may request to know, correct, delete, and opt out of the "sale" or "sharing" of personal information, without discrimination. We do not sell personal information for money; if personalized advertising is enabled, some laws may treat cross-context advertising identifiers or ad-related disclosures as "sharing." If your browser sends a Global Privacy Control or similar opt-out signal and applicable law requires the Site to honor it, the Site will handle it according to those requirements.

To exercise rights, email hello@whenjapan.com. To protect privacy, we may ask for reasonable information to confirm that you are the relevant person or an authorized representative. If a request is manifestly unfounded, excessive, repetitive, involves another person's information, requires us to retain information by law, or may be refused or limited under applicable law, we may refuse it, limit it, or ask for more information as permitted by law.

9. International data transfers

The Site is intended for Hong Kong and international visitors and uses global service providers. Information may therefore be processed outside your location, including in Hong Kong, the United States, the European Union, the United Kingdom, or other regions. Relevant providers use safeguards under their policies, contracts, or applicable transfer mechanisms.

10. Retention and security

We keep information only as long as needed for the purposes described in this policy, to handle enquiries, comply with law, or keep reasonable business records. For correspondence, retention depends on whether the enquiry is resolved, follow-up is needed, or a specific legal obligation or dispute requires the record. Information no longer needed for those purposes should be deleted or anonymised. Technical and security logs are retained for limited periods based on hosting, analytics, and security settings.

We use reasonable technical and organizational measures such as HTTPS, Cloudflare security features, access controls, and data minimization. However, Internet transmission, email, and electronic storage cannot be guaranteed to be completely secure. If we become aware of a security incident that may affect personal data, we will assess notification to affected individuals or regulators based on the nature of the incident, risk, and applicable law.

11. Children's privacy

The Site is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided information to us, contact us so we can delete it.

12. Third-party links

The Site may link to third-party websites whose privacy practices are their own responsibility; this policy does not apply to them.

13. Changes to this policy

We may update this policy from time to time and will revise the version date above. A policy update does not by itself authorise a new use of personal data; we will obtain consent where required. Material changes will be highlighted where reasonable.

14. Contact

For any questions about this policy or your data, email hello@whenjapan.com or use the Contact page. You may also contact the Hong Kong Privacy Commissioner for Personal Data about a privacy concern.