Privacy

Last updated: 4 August 2026

Takara Trails is a static site. There is nothing to sign up for, nothing to log into, and no form to fill in, so we collect nothing from you directly. What follows is an account of the little that does get measured, who processes it, and how to switch off the optional part.

Privacy questions, and any of the requests under "Your rights" below, go to [email protected].

What we don't do

No accounts, no logins, no newsletter, no comments, no contact form, no advertising. We don't sell data, we don't share it with ad networks, and nothing here attempts to work out who you are.

What gets measured

Two things count visits, and they work very differently.

Cloudflare Web Analytics runs for every visitor. It is cookieless: it writes nothing to your device and does no fingerprinting. What it reports is aggregate — page views, the referring site, country, device type, and page-speed measurements (Core Web Vitals). Because it stores nothing on your device and cannot single you out, it runs without asking. There is no consent to give and none to withdraw.

Google Analytics 4 is the one that uses cookies, and it loads only where you have allowed it. The site runs Google Consent Mode v2:

• In the EEA, the UK and Switzerland, analytics storage starts denied. GA4 sets no cookies unless you accept through the banner.
• Elsewhere, analytics storage starts granted, and you can decline through the same banner.
• Advertising storage, advertising user data and ad personalization are denied in every country, always, with no setting that turns them on. This site carries no advertising and sends nothing for advertising purposes.

Where GA4 is allowed to run, it sets cookies named _ga and _ga_*, normally lasting two years. They distinguish one browser from another and group page views into sessions. That data is processed by Google LLC, which means it leaves Japan and the EEA and is handled under Google's terms as our processor. If that isn't acceptable to you, decline the banner: every page works the same either way.

How long it is kept. Event and user data in GA4 expires after 14 months, and the clock restarts whenever the same browser comes back — so for a regular reader the window runs 14 months from their last visit rather than their first. Stop visiting and everything tied to your browser ages out within that period. The aggregate counts that survive afterwards are just totals, with nothing left to tie them to a browser.

Hosting

Cloudflare serves and protects the site. Like any web server, its network handles your IP address in order to send you a page and to block attacks. We run no server of our own and keep no logs of our own, but we should be precise about one thing: as the Cloudflare account holder we can see Cloudflare's own traffic dashboards, which include security events and country-level breakdowns derived from visitor IP addresses. We use them to keep the site up and to investigate abuse, nothing else, and we cannot connect them to anything you do on the pages themselves.

What is stored on your device

Two things, both functional, both staying in your browser.

The Heritage Passport. When you tick a site off as visited, that checklist is saved to your browser's localStorage under the key takara-trails:passport:v1. It holds a plain list of site identifiers and nothing else — no name, no dates, no location. It is never transmitted to us or to anyone else. It also isn't backed up anywhere: clearing your browser data erases it, and it won't follow you to a different browser or device.

Your cookie choice. Whichever answer you give the banner is recorded in localStorage as well, so the banner stops asking on every page. It records a preference; it doesn't track anything.

Neither requires consent. One is a feature you switched on yourself, the other exists solely to remember your answer to the consent question.

Third parties

Fonts are self-hosted and served from this domain, so opening a page sends no request to Google Fonts or any other font service. Images are served from the same origin. Apart from Cloudflare (hosting and cookieless analytics) and Google (GA4, where allowed), no third party receives anything when you read a page.

Pages do link out — to UNESCO, railway and ferry operators, site operators and tourism offices. Once you follow one of those links you are on someone else's site, under their privacy policy, not this one.

Your rights

Change your mind about analytics. The "Cookie settings" link in the footer reopens the banner on any page. Accepting or declining takes effect immediately, and declining also deletes the GA4 cookies already set rather than merely halting new ones.

Clear the passport. Untick the sites, or clear this site's data in your browser.

If you are in the EEA or the UK, the GDPR and UK GDPR give you the right to ask for access to your data, correction, erasure, restriction of or objection to processing, and portability, plus the right to complain to your national supervisory authority. The site is operated from Japan, so Japan's Act on the Protection of Personal Information applies as well. Our legal basis is your consent for GA4, and legitimate interest for cookieless aggregate measurement and for keeping the site online and secure.

One honest caveat about those requests: we hold almost nothing that could be traced back to an individual. There are no accounts, and what analytics reaches us is aggregated. If you write to us we will tell you plainly what exists and what we can act on, rather than pretend to a lookup we can't perform.

Children

This is a travel reference written for adults. It is not directed at children and we do not knowingly collect anything from them. If you believe a child's data has somehow reached us, write to the address above and we'll deal with it.

Changes to this policy

Revisions are dated at the top of this page. If something material changes — a new processor, a different consent default — the date moves and the change is described in the section it affects.