Privacy policy

This notice explains how World Country Groups (“we”, “the site”) handles personal data when you visit the site, create an account or use its features. We collect as little personal data as we can, only for the purposes below. We do not sell personal data, show advertising, or use analytics, tracking or advertising cookies. It is written to meet the EU General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies.

In short

• Browsing the site does not build a profile of you: we use no analytics tools or trackers, and your browser is not asked to load scripts, fonts or images from other companies.
• If you create an account, we keep the details you give us and what you save on the site.
• We keep limited, pseudonymous usage statistics for some features, and you can opt out.
• You can see, download, correct or delete your data at any time.

1. Who is responsible

The controller of your personal data is the operator of World Country Groups (worldcountrygroups.org). You can contact us about anything in this notice using the form at the bottom of this page. If you have an account, you can also download or delete your data from your account page.

2. What we collect, why, and on what legal basis

Purpose	Personal data	Legal basis (GDPR Art. 6)	Kept
Providing your account	Username, display name, email address (optional), password (stored only as a salted hash), account status, registration date, settings and saved items	Contract (6(1)(b))	Until you delete your account
Keeping you signed in	A session cookie	Contract (6(1)(b)); strictly necessary	24 hours
Features you use, including AI-assisted features	What you enter or save (for example questions and their answers) and when	Contract (6(1)(b))	Until you delete it or your account
Emails you ask for	Email address and your email preferences	Consent (6(1)(a)); you can withdraw it at any time in your account settings	Until you switch them off or delete your account
Usage statistics for some features (for example pages opened through a shared link)	Time, pages opened, shortened IP address (network part only), browser family and device type, main language, referring site name, and a daily pseudonymous code	Legitimate interests (6(1)(f)): understanding whether features are used and keeping them secure	90 days
Answering data-protection requests	Your email address, name if given, and your message	Legal obligation (6(1)(c))	Up to 3 years after the request is closed
Security and error logs	Technical details of failed requests, without information identifying who made them	Legitimate interests (6(1)(f)): keeping the site working and secure	30 days
Backups	Encrypted copies of the above	Legitimate interests (6(1)(f)): preventing data loss	Up to 12 months, on a rolling basis

Providing personal data is voluntary. To have an account you need a username and password; an email address is optional. We do not make decisions about you by automated means, including profiling.

3. Usage statistics

Ordinary browsing is not recorded. For some features, such as pages opened through a link someone shared with you, we keep minimal statistics so that we know whether they are used. We shorten IP addresses before storing them (for example 203.0.113.57 becomes 203.0.113.0), keep only the browser family and type of device, and use a code that is calculated on our server, is not stored on your device and changes every day, so visits on different days cannot be linked. You can object at any time by choosing “Don't count my visit” where it is offered; nothing further is then recorded about your visits.

4. Cookies and similar storage

We use only cookies that are strictly necessary for the site to work or to remember a choice you made, so we do not ask for consent. We use no analytics, advertising or third-party cookies.

Name	Purpose	Duration
wcg_session	Keeps you signed in	24 hours
wcg_share	Lets a shared link open the page it was made for	Until the link expires (at most 90 days)
wcg_nostats	Remembers that you opted out of usage statistics	1 year
wcg-share-notice (local storage)	Remembers that you have seen a privacy note	Until you clear your browser data

5. Who else handles data, and transfers outside the EU

We use a small number of service providers who process personal data only on our instructions, under data processing terms:

• hosting, network and email delivery;
• an AI service provider, for AI-assisted features (content you submit to these features is sent to it to produce a response; it does not use it to train its models and keeps it only for a limited period for abuse monitoring);
• encrypted backup storage (data is encrypted before it leaves our server, with a key only we hold);
• domain name services.

Some of these providers are located in, or store data in, countries outside the European Economic Area, including the United States. Where this happens we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for certified providers) or on the European Commission's Standard Contractual Clauses. You can ask us for details of the providers and a copy of the relevant safeguards. We do not otherwise share, sell or rent personal data.

6. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict how we use your data;
• data portability: receive your data in a machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing before the withdrawal;
• complain to a data protection authority, in particular in the EU country where you live or work. A list of authorities is on the European Data Protection Board's website.

Account holders can download or delete their data themselves from the account page. For anything else, use the form below. We answer within one month (extendable by two further months for complex requests, in which case we will tell you), free of charge. We may ask you to confirm your identity.

7. Security

Connections to the site are encrypted (HTTPS), passwords are stored only as salted hashes, access to personal data is limited to the site's administrators, and backups are encrypted. If a personal data breach is likely to put your rights at risk, we will notify the competent authority within 72 hours and inform you where required.

8. Children

The site is not directed at children under 16, and we do not knowingly collect their personal data.

9. Links to other websites

The site links to other websites. When you follow a link, the other site's privacy policy applies.

10. Changes

We will post any changes to this notice on this page and update the date at the top. If a change is significant, we will also tell account holders by email.