Privacy & cookies

No account needed

We do not take bookings or payments here. Saved places and planning checklists stay in this browser. The host cannot read your saved list. Our hosting provider processes network requests to serve the site; we do not attach those requests to a guest booking. Our hosting provider may use essential security cookies to protect the service.

Ask the guide

Answers are matched on your device. Sharing questions with the hosts is optional. The preference starts selected, but nothing is sent until you explicitly choose “Share & keep on for this tab”. That choice applies to future questions in this tab until you turn sharing off or reload the page. If you choose it, the question, matched topics and answer feedback are saved in our private guide database. The question feature does not attach an IP address, guest account or reservation. Please do not enter names, contact details, codes, documents or health information. A sensitive-text filter is a safeguard, not a guarantee.

You can stop sharing future questions at any time. Shared records older than 180 days are cleaned when a new question is saved. Clearing the chat removes the tab’s chat, not records already shared. For removal, send us the question and approximate date through Airbnb without repeating sensitive details here.

The optional AI plan assistant uses Groq to interpret the request you choose to send. Starting the microphone requires your browser permission; stopping a recording sends up to 60 seconds of audio to Lisbonline’s server and then Groq for multilingual transcription. The transcript and your public planning preferences are then sent to Groq to propose changes. Sending a written request uses the same AI interpretation without microphone access. The notice beside the controls explains this before either action. Please do not include booking codes, contact details or other private information.

Lisbonline does not store recordings, transcripts or conversation text in its database, analytics or browser storage. These stay in memory while the assistant is open and pass through the server only for processing. Closing the assistant discards an unfinished recording and cancels pending browser requests; an already submitted provider request may finish. Groq’s own processing and retention policies apply, including possible reliability/abuse logs. See Groq’s data policy. Short-lived, purpose/day-separated network hashes and anonymous quota counters protect the free service; no raw IP or request text is stored in them. Counters expire after two days and are removed on later requests.

Only public catalogue IDs and supported planning preferences you explicitly apply enter the device-local planner; a one-time transfer between pages expires after ten minutes. AI cannot book anything or establish a venue’s opening hours, prices, access or availability. Actual plans use existing guide records and published event sessions, and report named places they cannot fit. Language recognition and interpretation may be wrong; review the text and choices before applying. Free limits may temporarily pause AI without disabling the ordinary trip filters.

Optional traffic measurement

We use Google Analytics only after you choose “Allow analytics”. If you decline, no Analytics script, cookie or measurement request is sent to Google.

With permission, Google receives usage information including the public page being viewed, basic browser/device information, the domain (not the full URL) of a recognised referring search/social/booking or AI-assistant site, and events such as opening a guide section, calendar or Airbnb listing link. Network requests necessarily reach Google with your IP address; we do not send it as a custom identifier. Your questions, saved list, contact details, reservation and arrival dates are not sent as analytics event data. Advertising storage, advertising personalisation and Google Signals are disabled.

Your cookie choice is stored locally for 180 days. Analytics cookies, when enabled, are set with a 180-day lifetime. You may change your choice below; withdrawing permission removes this site’s Analytics cookies and reloads the page without the tag. Blocking or clearing browser storage may cause us to ask again. Google’s privacy policy and how Google uses data from partner sites explain its processing and international data arrangements.

With renewed Analytics permission, public search terms, result counts, chosen result types and public result paths help us improve search. Terms are limited on your device to public guide vocabulary; unknown or sensitive text is withheld. We do not send keystrokes, identify the person searching, or attach an account, name, email, booking, private question or location. Searches still work when you decline, and no search history is stored by this feature. Earlier permission that excluded search terms is not reused for this new purpose; an earlier rejection remains respected.

With Analytics permission, we also count map openings, turning Near me on, adding a save and opening a walking plan in another map app. These counts contain only the action name, not your coordinates, starting area, distance, search text, saved-place list or private notes. We do not send these counts without a current Analytics choice.

After a successful explicit offline download, we count only an “offline saved” action when Analytics permission is current. No download list, map extent, private note or location accompanies that action.

Maps, bookings & other links

In-page street maps load as they come into view, with a manual option if needed. Full-screen maps load when you open them. Map tiles, fonts and sprites come from our own site, so no third-party map provider receives your IP address. Map data is © OpenStreetMap contributors, provided under the Open Database Licence; the basemap is built with Protomaps.

The nearby-services map does not request your device location. On maps offering “Use my location” or “Near me”, your browser asks for permission when you choose that action. The position and distance calculations stay in this tab: coordinates are never saved to browser storage, our database or Analytics, or put in URLs. Only a yes/no Near me flag is remembered for this browsing session. On another page, a fresh position is requested only if you previously opted in and browser permission is already granted. We never automatically open a new permission prompt.

“Follow my location” follows movement until the map closes, the page is hidden or 30 minutes pass. “Forget my location” clears the in-memory position, stops following and removes the session flag. General city maps contain public venues and neighbourhood references, not a home marker or home-based starting point. Home-area orientation appears only in the Guest Guide, as an approximate neighbourhood circle, not the apartment address.

Directions open Google or Apple Maps only when selected; the links contain public destinations, never your coordinates. Those services, Airbnb and other linked sites have their own privacy policies. Booking availability comes from a host-side calendar connection; the public response contains blocked nights, not guest names or reservation details.

Choose “Keep offline” in My Lisbon to download your selected public place pages, smaller photos and the map around those places. A service worker is registered only after that action. Its technical scope covers this site so the downloaded pages can open, but it never caches question or other API responses, the guest guide, your position or private notes. The copy and saved list stay in this browser; no list is written to our database. Downloads make ordinary requests to our own site. Other pages show an offline message while disconnected. “Remove offline copy” deletes the download without deleting your saved list or notes. Your browser may clear stored data, so refresh the copy before an outing.

Optional Google Places lookups

In your private place-list workspace, each Google lookup is sent only after you choose it. Lisbonline sends that place name and any address you enter to Google; your own notes, full imported file, email and other list entries are not included. Highly rated discovery sends only the category and a fixed Lisbon search area. A rating or hours refresh sends the selected place ID.

Google results are displayed separately from our street maps, with attribution, and are not added to our map data or offline downloads. Ratings and hours can change. We do not save Google names, addresses, ratings, hours, photos or reviews in your draft or our database. Only the chosen place ID and your own words can be kept on your device or downloaded. Small request counters contain a day-specific hash of the signed-in account and request totals; user counters expire after two days and are removed on the next successful lookup. Aggregate monthly counters contain no account hash and expire two days after the month ends. Google sign-in, if available in future, does not grant access to private Maps lists. Read Google’s Privacy Policy and the Google lookup terms.

Lisbon weather

The hourly and extended daily forecasts load through our own site. Our server fetches and caches the fixed central-Lisbon forecast from MET Norway; it does not forward your IP address, device location, page URL or questions to the weather provider. No location permission, account or weather cookie is needed. Weather data is a forecast estimate, not a live station measurement. Daytime/evening suggestions are editorial; the full-month planner uses explicitly labelled IPMA monthly climate averages (1991–2020, Lisboa / Instituto Geofísico) outside the available daily forecast, not daily predictions or historical readings. Provider and licence links open only when you choose them.

Hourly rain percentages come separately from WeatherAPI.com. Our server requests only the fixed central-Lisbon forecast, with a server-held API key. It does not forward your IP address, device position, page URL, questions or saved places. Each percentage belongs to its stated forecast hour; we do not add hourly percentages into an invented two-hour probability.

Event programme images

Event photos, posters and Lisbon context photographs are served by our own site. A publisher request is not made by your browser when a card appears. Our server may obtain and cache permitted programme artwork separately. Publisher links and credits identify the source; they open only when you choose a link.

Contacting us

We use the name, email address and details you send to answer your message, not to subscribe you to the newsletter. For a privacy question or data request, email hello@lisbonline.com.

Messages and delivery records are kept for up to one year, then removed automatically. The form does not save your message in browser storage or send it to Analytics.

Journal feedback

Choosing Useful or Not quite sends the article and your response, without a name or email. A random response code stays in this browser for up to 30 days so you can change or undo the choice. The server keeps a keyed version of that code for up to 30 days; cumulative article totals remain afterwards. These are response counts, not unique-reader statistics, and are not sent to Analytics or an email service.

For abuse prevention, a day-specific keyed network hash and an hourly counter are kept separately for up to two days. Raw IP addresses are not stored in the feedback database. Publication notices go only to the site owner, not readers or subscribers.

Postcard from Lisbon

Newsletter sign-ups are not open yet. The public Postcard page does not collect an email address or place you on a waiting list. Browser template previews do not send email or subscribe anyone.

When enabled, the separate Postcard form will ask for an email address, edition, a separate daily, weekly or off Journal choice, optional interests and, for Trip mode, arrival and departure dates. Consent is not preselected and is independent of sharing guide questions. Sender is the selected email processor. We record the signup and confirmation times, source page, form version, chosen edition and Journal frequency, and exact consent wording. Existing subscriptions start with Journal by email off; changing that choice does not change the Postcard edition. No name, booking details or device coordinates are needed. Confirmation links last seven days; preference links last thirty days.

The signup system is designed to retain an unconfirmed request for seven days, and to erase a withdrawn subscriber’s record and consent history after thirty days. Confirmed records remain only for operating the requested subscription and its consent proof. Those collection and sending paths stay disabled until delivery, anti-abuse and retention operations have been verified. A contact message never subscribes you on its own.

A real issue will include preference and unsubscribe links. An unsubscribe request does not depend on the email provider being online; opening a link does not change your subscription until you confirm the action. An email app’s one-click unsubscribe uses its signed request directly. Capability links contain opaque IDs rather than email addresses; their pages have no Analytics, third-party scripts, offline cache or referring URL. Do not share these personal links.

No newsletter open/click tracking, subscriber campaign or sponsor data transfer is enabled now. Site links in template previews have edition/date campaign tags, not recipient identifiers. If email tracking is enabled later, this notice must describe the actual provider settings and choices before collection begins. Sponsors never receive subscriber addresses.

The focused security check, when configured, uses Cloudflare Turnstile. A short-lived keyed IP hash is used only for rate limiting, kept separately from subscription records and never sent to Sender or Analytics. Raw IP addresses are not stored in our subscription database. You can contact hello@lisbonline.com about an email preference or data request; incoming replies are forwarded by ImprovMX to our inbox in Gmail.

Locals contributions

Typing a guide stays in your tab. Saving on this device keeps its display name, introduction, places and notes in this browser. Download or remove the device copy whenever you choose. No draft words go to an AI service or Analytics.

Signing in uses the hosting platform’s ChatGPT identity. A Site-scoped account ID keeps cloud data separate; the account email is used to check owner access. Applying for the beta sends your display name, Lisbon area and introduction to the editor. Account emails are not part of public profiles.

Saving a cloud draft is private. A publication request confirms the contributor rules and public-sharing consent. A person reviews each submitted version; only an approved snapshot appears at the chosen profile link. Public fields include your display name, handle, bio, area/year, place notes, collections, tips, day ideas and business disclosures. Public guides can appear in the Locals directory and their display name, area, collection labels and venue names can appear in link previews or downloadable share cards. Directory filters search only published snapshots; draft words, account IDs and question receipts are excluded. Sharing does not export private My Lisbon notes or location. A local-connection badge requires a separate human check. Readers can optionally mark a published guide useful once per signed-in account. Only the total is public, not who voted. You can remove a choice and see or download your own choices at /locals/activity/. Appreciation is not a venue rating or a guide ranking. The Site-scoped account ID, guide identifier and choice time remain until you remove the choice or delete your Locals data. A separate hourly account counter limits abuse; expired counters are removed in batches on later appreciation requests. No raw IP, email, private note or choice is sent to Analytics. Published contributors can opt in to reader questions.

Questions for a local

Sending a question does not require an account, name or email. Your question and any reply are stored on Lisbonline and can be read by the chosen contributor, the editor and anyone holding your private conversation link. The link is a confidential access key; only its hash is stored with the conversation. Question words, replies and private links are not sent to Analytics, an AI service or an email provider. No email notifications are sent. Do not include personal or booking details.

Questions and replies stay private unless the reader and contributor both opt into anonymous public sharing and an editor approves those exact words. The private link lets the reader withdraw public sharing or delete the question and reply. Contributors can pause their inbox and take a Q&A offline. A public profile taken offline hides its Q&As too; deleting the contributor account removes its conversations.

Private conversations become unavailable 90 days after their last change. Expired records are removed in batches of up to 100 on later question submissions, so physical deletion may be later. Published Q&As remain until removed or deleted. The question form uses Turnstile and a separate one-hour keyed network rate limit; raw IPs and challenge tokens are not stored with the question. Private links appear only in the URL fragment and are not saved automatically in browser storage. You must keep the link to return.

You can take your public profile offline immediately, export cloud data or delete your Locals records from the builder. This does not delete your ChatGPT account, a separately saved device draft or copies already kept by other people. Cloud records remain until you delete them or ask us to do so. Removal reasons and appeals are visible only to the contributor and editor.

Content reports store the reported URL/note identifier, explanation, case status and optional contact details for up to 180 days, removed on the next reporting request after expiry. Reporter details are not public. A private receipt code lets its holder read the case status; keep it confidential. If you provide an email, Sender delivers a transactional receipt. Turnstile checks abuse; raw IPs and challenge tokens are not retained in the report. Keyed network rate counters are separate from the content case. Contact hello@lisbonline.com about privacy, deletion or a moderation decision.

Contributor rules and moderation