Privacy Policy
Last updated August 2026.
The short version
Fathom Fares never sells your personal data. We use self-hosted, cookieless analytics to understand how the site is used, and, subject to your consent choices below, Google Ads measurement to know when our advertising works. Nothing we keep identifies you unless you give us your email on purpose, and you can opt out of ads measurement at any time.
What we collect
Browsing: two kinds of analytics, both cookie-free and both running entirely on our own server. First, anonymous aggregate counters (which section of the site was viewed, per day) that store no IP addresses or device fingerprints at all. Second, Umami, an open-source, self-hosted, cookie-free analytics tool that records page views, section visits, and interaction events (which buttons and filters are used, never what you type into any form), plus referrers and approximate (city-level) location, using a rotating anonymous hash instead of a persistent identifier, and never stores your IP address, none of it is shared with or sent to any third party. It also skips visitors entirely when a Do-Not-Track or Global Privacy Control signal is present, rather than just excluding them from reports afterward. Because it sets no cookies and builds no profile of you, we run it on a legitimate-interest basis and it is not controlled by the ads-consent banner, declining ads cookies does not stop this first-party measurement; a Do-Not-Track or Global Privacy Control signal does.
Ad measurement: when we run ads (for example on Google or Reddit), a Google measurement tag tells us an ad click led to a visit or a booking request. What it may store depends on where you are and what you choose: in the EU/EEA, UK and Switzerland it stays cookieless unless you click Accept on our consent banner; elsewhere it runs unless you opt out (banner, the “Your Privacy Choices” link in the footer, or a Global Privacy Control / Do-Not-Track signal, with those signals set, the tag never loads at all). When permitted, Google may set advertising cookies to attribute conversions; when not, Google receives only aggregate, modeled signals.
Your privacy choices
A consent banner appears on your first visit (opt-in in the EU/EEA, UK and Switzerland; notice-and-opt-out elsewhere). You can change your mind any time via “Your Privacy Choices” in the footer, which includes the California CCPA/CPRA opt-out of “sharing” for ads measurement (the consolidated link the CPRA allows in place of a “Do Not Sell or Share” link, we sell nothing either way). We honor Global Privacy Control and Do-Not-Track as a full opt-out. Your choice is stored on your device only.
Accounts: if you sign in, we store your email address and your watched sailings. Sign-in uses a one-time emailed link and a session cookie, that cookie exists only to keep you signed in, and no password ever exists.
Weekly drops email: if you sign up for the weekly price-drop email, we store your address, where on the site you signed up, and when you confirmed. Nothing is sent until you click the confirmation link, every issue carries a one-click unsubscribe, and the address is used for that email only.
Booking requests: if you ask a cruise agent to contact you, the details you enter in that form (name, contact info, loyalty number, notes) are stored securely and reviewed by our booking desk on an internal dashboard so a human can follow up. They are used for that purpose only, kept while the request is active plus up to 24 months for follow-up and record-keeping, and deleted on request (email us).
Server logs: our web server keeps standard technical logs for debugging and abuse prevention, rotated away on a schedule.
What we never do
No selling or renting of personal data. No social-media trackers. No data brokers. Advertising measurement runs only as described above and always under your consent choices; our own analytics never use cookies or persistent identifiers.
Who processes data for us
We use a small number of infrastructure providers purely to run the site, never to advertise: Resend delivers our email (it processes the destination address to send it), Cloudflare serves and protects the site, and DigitalOcean hosts it. Our analytics run on our own server, not a third party. Google receives ad-measurement signals as described above, governed by your consent choices. We do not sell your personal data; California residents can opt out of “sharing” for ads measurement via “Your Privacy Choices” in the footer, and we honor Global Privacy Control automatically.
How long we keep it
Your email and watches are kept until you delete your account, at which point they are erased immediately. Aggregate analytics counts contain no personal data and are kept indefinitely. Technical server logs rotate away on a short schedule.
Your rights
Wherever you live, you can ask us to access, correct, or delete the personal information we hold, and to receive a copy of it. You can opt out of the “sharing” of personal information for ads measurement at any time via “Your Privacy Choices” in the footer, and we honor Global Privacy Control (GPC) and Do-Not-Track browser signals as an opt-out regardless. We will never discriminate against you for exercising any of these rights. These rights track the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws. For visitors in the EU/EEA, UK and Switzerland: the data controller is Fathom Fares (contact: [email protected]); ads measurement runs only on your consent (withdrawable any time via “Your Privacy Choices”), our self-hosted analytics on legitimate interest as described above, and you may lodge a complaint with your local supervisory authority.
Delete everything yourself: when you are signed in, use Delete account in your account menu, it immediately and permanently erases your account, every saved watch, and all alert history. The unsubscribe link in any alert email does the same. Or email [email protected] for access, correction, or deletion and we’ll take care of it.
Children
Fathom Fares is not directed to children under 16 and we do not knowingly collect their information.