Privacy policy
Last updated 28/10/2026.
Down The Road is a free website that shows which nearby shops sell what you are looking for, and where products come from. It is run by the operator of Down The Road, the data controller for the information described here. Write to us at [email protected] or through the contact form.
In short: you can search and check barcodes without an account. We keep only what the service needs to work and to show shops that it brings them customers. We do not sell your data, show adverts, or track you across other sites.
What we collect, and why
| What | From whom | Why | How long |
|---|---|---|---|
| Your email address, and a scrambled (hashed) password or the id Google gives us when you sign in with Google | People who create an account: shops, and shoppers who write reviews | To run your account (contract) | Until you delete the account |
| A shop's name, address and map pin, opening hours, products, prices, and photos, plus an optional phone and WhatsApp number | Shops | To publish the listing. All of this is public on the website (contract) | Until the shop removes it or deletes the account |
| Reviews: a star rating and optional text. Your name and email are never shown with a review | Shoppers with a confirmed email | To help others choose (legitimate interests) | Until you or we remove the review, or you delete the account |
| Searches: the words you searched for and roughly where you searched from (the position is rounded to about a kilometre before it is stored) | Anyone using search | To improve search, and to show a shop how many people searched near it (legitimate interests) | 365 days |
| Usage: which products and shops were viewed, when someone used Directions, Call, or WhatsApp (never the number dialled or the message), and barcodes checked | Anyone using the website | To show shops what the service does for them, and to improve it (legitimate interests) | 365 days |
| Diagnostics: when a page fails, our server records which page failed and why. Never your searches, name, or address | Recorded by our own server, not sent by you | To find and fix problems (legitimate interests) | 30 days in our database; daily archives are kept for up to 90 days |
| Reports about a listing or a review | Anyone who reports something | To keep listings accurate and safe (legitimate interests) | Until handled, then kept as a record of the decision |
| Messages sent through our contact form: your email address and your message. We do not keep your IP address with it | Anyone who writes to us | To answer you (legitimate interests) | 365 days |
| Server logs: your IP address, the page or address requested, and the result | Anyone who reaches our servers | Security and keeping the service running (legitimate interests) | A few weeks at most |
When you are signed in, searches, usage, and reports are linked to your account. When you are not, they are anonymous to us.
Cookies
The website sets up to three cookies of its own, readable only by our server. ddr_session, set once you sign in, keeps you signed in for 30 days and holds nothing but your sign-in. ddr_lang remembers your language for a year. ddr_consent remembers for a year whether you accepted analytics. These are strictly necessary for what you asked for. Only if you accept analytics, Google Analytics sets its own cookies (named _ga, kept up to two years) to count visits. You can change your mind at any time with Cookie settings at the bottom of every page. There are no advertising cookies.
What stays with you
Your countries and brands to avoid, the pages you viewed recently and your choice of walking, driving or public transport stay in your browser. The lists reach us only as filters on a search and are never stored.
Location
We ask your browser for your location only when you choose "Use my location" or have already allowed it for this site, to find shops near you; it is stored with your search rounded to about a kilometre. You can always search around a town or postcode you type instead. To open the home page map somewhere useful we use the approximate location that comes with your connection (the country, sometimes the city); it only centres the map and is not stored.
Who else sees data
- Our hosting provider (OVHcloud, in Europe) stores the database, photos, and backups for us.
- Cloudflare sits in front of our servers, and its Turnstile check confirms that a person, not a bot, is creating an account, sending a report, or using the contact form. Cloudflare sees your IP address and some information about your device and browser.
- Google, only if you choose Continue with Google. On the website, Google's sign-in script loads only on the sign-in and sign-up pages.
- OpenFreeMap sends the map images to your browser or phone, so it sees your IP address and the part of the map you are looking at.
- Google Maps, your phone, or WhatsApp, only when you choose Directions, Call, or WhatsApp. These open on your device; nothing passes through us.
- Open Food Facts and similar open product databases receive a barcode when we look up a product we do not know yet. No personal information is sent with it.
- OpenStreetMap contributors: shops nobody has claimed yet were started from OpenStreetMap data (ODbL). We copy the names, addresses and public phone numbers of businesses, never anything about a person.
- Google Analytics: its script loads on every page. Until you accept analytics it sets no cookies and sends Google only anonymous signals with no identifier. If you accept, it sets its cookies and Google receives the pages you visit, your IP address, and information about your device and browser, and gives us visit counts. We do not use it for advertising.
- Mundus (mundus.live), only if you press the round Mundus button in the header. Its window then loads from mundus.live, which sees your IP address and some information about your device and browser.
These providers may process data outside your country. Where they do, the safeguards data protection law requires apply, such as standard contractual clauses. We never sell personal data or share it for advertising.
Backups
We keep database backups for up to 30 days so we can recover from a failure. Deleted information disappears from backups when they expire.
Your rights
Data protection law, including the GDPR and the UK GDPR, gives you the right to a copy of your data, to have it corrected or deleted, to object to or limit how we use it, and to take it with you. To delete your account and everything tied to it, use the account deletion page. For anything else, use the contact form; we answer within one month.
When you delete your account we remove your sign-in details, your shop with its products, photos, hours, and prices, and every review you wrote or that was written about your shop. Reports and usage records stay, but without any link to you.
If you are unhappy with how we handle your data, you can complain to the data protection authority where you live.
Children
Down The Road is not meant for children under 13, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date above, and say so on the site if the change matters.