What we collect, and why

What we actually collect

The site loads one third-party script: Google Analytics 4(gtag.js), so we can see which pages get used and whether the verdicts on this site are worth returning for. It runs by default from your first page view, unless you have previously turned it off — seeManage settings for how, and for the fuller explanation of why we measure anything at all.

When it runs, GA4 tells Google, at a high level: which pages you viewed, your approximate location (city-level, derived from IP address — Google anonymises the IP address itself before storing it, a default GA4 behaviour we have not overridden), the kind of device and browser you're using, and which site or search engine sent you here. It does not see your name, your email address, or anything you type into this site — there are no forms here to type into.

Beyond that: this site makes no other external requests and runs no other client-side script, with two small exceptions that never leave your browser — the code that shows and dismisses the analytics notice, and the toggle on the settings page. Neither of those sends anything anywhere.

Where the data goes

Google LLC, which operates Google Analytics, is a US company. When GA4 runs, the data it collects leaves Switzerland (and the EEA, for EU visitors) and is processed in the US. Google acts as our data processor for this purpose, under its own Google Analytics terms. That transfer relies on Google's certification under the EU-US and Swiss-US Data Privacy Frameworks and on Standard Contractual Clauses as a backstop — the mechanisms Swiss and EU law recognise for this kind of transfer, not a guarantee that no government anywhere can ever request the data.

Cookies

When analytics is running, GA4 sets its own cookies in your browser — typically_ga and a per-property _ga_<id> cookie — to tell repeat visits apart from new ones. We don't read these ourselves; Google does.

The site itself does not set a tracking cookie. It stores one small preference — whether you've opted out of analytics — in your browser's localStorage, not a cookie, and never sends that preference anywhere; it only controls whether this browser loads GA4 on the next page view. We checked this rather than assumed it: a plain page load against this site sets no Set-Cookieheader at all. The hosting platform (Cloudflare) has the capability to set a session cookie — it is wired up at the infrastructure level in case a future feature needs one — but no page on this site currently uses that feature, so it sets nothing today. If that changes, this page will say so.

Turning analytics off, on the settings page, also clears any GA cookies already set in your browser for this site.

Legal basis

We operate under the Swiss Federal Act on Data Protection (FADP), which treats this kind of analytics as something you can opt out of rather than something that requires opt-in consent up front — that's why analytics runs by default and the notice you see offers an acknowledgement plus a link to genuinely turn it off, rather than an Accept/Decline choice at the door. If you're visiting from the EU, the GDPR may also apply to you; the same opt-out, on the same settings page, is how you exercise it here.

Retention and your rights

Analytics data is retained under Google's standard GA4 retention window; we have not shortened or extended it. We do not otherwise hold a database of visitors — there is no login, no account, no form submission on this site to retain.

You can access, correct, or ask us to delete anything we hold about you, or object to processing, by writing to privacy@peakorskip.com. For the part that lives in your own browser rather than with us — the analytics preference — you can see and change it yourself, any time, on thesettings page.

One more thing worth stating plainly

Some pages link out to booking partners for tickets. Following one of those links takes you to that partner's own site, which has its own, separate privacy practices we don't control.