Privacy
Last updated September 2026
The short version
THE WALL stores as little as possible. There are no trackers, no analytics, no advertising and nothing passed to third parties for marketing. That is also why there is no cookie banner: only strictly necessary cookies are set, and those need no consent.
What it needs in order to work: a username, an email address, a password as a hash, and your devices' settings.
Controller
Lenny Godart
Luxembourg
lenny@godart.lu
What is stored and why
Account
Username, email address, password as a bcrypt hash, time of registration, and when you saw the introduction to the device.
Basis: performance of a contract, Art. 6(1)(b) GDPR. Retention: until you delete the account.
Devices
Device name, device ID, firmware version, the location you set with its coordinates, modes and all display settings. With every request the device also reports the name of its Wi-Fi network, signal strength, uptime, chip temperature, storage use and number of restarts; the device page shows them.
Basis: performance of a contract, Art. 6(1)(b) GDPR. Retention: until you remove the device.
Content
Your notes. Anyone you share a device with can read the notes on it.
Basis: performance of a contract, Art. 6(1)(b) GDPR. Retention: until you delete them.
Spotify, only if you connect it
Your Spotify user ID and display name, and the access tokens, encrypted. Briefly held: what is playing (5 seconds), the queue (30 seconds), album details and covers already reduced to panel size (one day). Anyone you share a device with sees on the panel what is playing.
Basis: consent by connecting, Art. 6(1)(a) GDPR. Retention: until you disconnect or delete the account; withdrawing access in your Spotify account works too.
Server logs
IP address, timestamp and requested address, to fend off abuse and to find faults.
Basis: legitimate interest, Art. 6(1)(f) GDPR. Retention: 14 days, then deleted automatically.
Services that see something
These services are needed so the panel can show anything at all. Where an IP address is transmitted, it says so.
- Cloudflare
- Delivery and protection of the site, Cloudflare, Inc., USA. Every request from your browser and from your device passes through Cloudflare. Because Cloudflare accepts the encrypted connection, it sees your IP address, the requested address and the content. The transfer to the USA rests on the EU-US Data Privacy Framework, under which Cloudflare is certified. Basis: legitimate interest in a fast and protected site, Art. 6(1)(f) GDPR.
- Brevo
- System emails (confirming your address, resetting a password, invitations, data export) are sent through Brevo, Sendinblue SAS, Paris. Brevo receives your email address and the content of the email, so for a data export all your data as an attachment. Basis: performance of a contract, Art. 6(1)(b) GDPR.
- adsb.lol, adsb.fi, adsbdb.com, GitHub Pages
- Flight data. Our server makes the request, not your browser and not your device. What is sent is the location you set or are moving on the map, never your IP address. Both flight data sources are asked and their lists merged, because each network has its own receivers. For airline and route the server only sends the aircraft's callsign, to adsbdb.com and to the Virtual Radar Server standing data that adsb.lol serves through GitHub Pages (GitHub Inc., USA).
- Open-Meteo
- Weather data, also requested by the server only, with your device's coordinates.
- mobiliteit.lu
- Departures for the transit mode and the list of stops, from the Administration des transports publics in Luxembourg. Our server makes the request. What is sent is the ID of the chosen stop or coordinates for the search, never your IP address.
- Spotify
- Only if you connect Spotify on the device page. You sign in at Spotify AB in Stockholm, our server never sees your password. After that our server asks, on behalf of your account, what is playing and what comes next, as long as a device shows Spotify, plus album details and covers. Spotify learns that this app reads your account, not your IP address. Nothing is controlled.
- OpenStreetMap, Nominatim
- Map imagery and place search on the device page, plus the place under the aircraft on the panel. Our server makes the search and the place lookup, the latter only with the aircraft's coordinates. Your browser loads the map tiles directly, which transmits your IP address to the OpenStreetMap Foundation. That is why the map only loads once you ask for it.
- Bunny Fonts
- Typefaces, delivered by BunnyWay d.o.o. in Slovenia, so inside the EU. By its own account the service logs nothing and sets no cookies.
Where the data sits
On a server in Luxembourg. The site is delivered through Cloudflare, which is a transfer to the USA (see above). Beyond that nothing leaves the EU, apart from the map tiles when you load the map.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21).
Two of those need no email: under Settings you can download all your data as a file and delete your account with its content at once and completely.
You can lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux.
Cookies
THE WALL sets a single one: the session identifier that keeps you signed in. It is strictly necessary, expires 30 days after your last visit (one year after you sign in at the latest) and is deleted when you sign out. Cloudflare may set its own short-lived cookie to tell people from bots (__cf_bm, 30 minutes), also strictly necessary and without recognising you across other sites. No tracking, no audience measurement, no banner. Your chosen language is kept by your browser itself, without a cookie.
Legal notice
Provider
Lenny Godart
Luxembourg
Nature of this service
A private, non-commercial hobby project. Nothing is sold and there is no subscription. The source code of the firmware and the server is public: use and change it, but do not sell it.
Third-party content
Map data and place names from OpenStreetMap, published under the Open Database License. The map on the panel is drawn by our server from public domain data: coastlines, borders, water, built-up areas and place names from Natural Earth, airports and runways from OurAirports. That data sits ready on our server and is never requested while the device runs. Flight data from the open projects adsb.lol and adsb.fi, routes from the Virtual Radar Server standing data (public domain) and from adsbdb.com. Weather data from Open-Meteo, departures and stops from the Administration des transports publics (mobiliteit.lu), both under CC BY 4.0. Titles, covers and the queue in the Spotify mode come from Spotify.
Airline logos are registered trademarks of the respective airlines. They are used here only for display on your own device, not for sale and not to imply any association.
Liability
The flight and weather data shown comes from third-party sources and may be wrong, delayed or incomplete. It is not suitable for navigation or for any aviation decision.