diff --git a/sentry.client.config.js b/sentry.client.config.js
index 0b7b65c..a8c2925 100644
--- a/sentry.client.config.js
+++ b/sentry.client.config.js
@@ -1,8 +1,11 @@
 import * as Sentry from "@sentry/astro";
+import { scrubEvent, scrubBreadcrumb } from "./src/lib/sentryScrub.js";
 
 Sentry.init({
   dsn: "https://bf8afd06f49d13d2e136c99d78e88626@o4511568346021888.ingest.de.sentry.io/4511568347856976",
   // To disable sending user data, uncomment the line below. For more info visit:
   // https://docs.sentry.io/platforms/javascript/guides/astro/configuration/options/#dataCollection
   dataCollection: { userInfo: false },
-});
\ No newline at end of file
+  beforeSend: scrubEvent,
+  beforeBreadcrumb: scrubBreadcrumb,
+});
diff --git a/src/app/aboutDrawer.ts b/src/app/aboutDrawer.ts
index 112099a..38f55d3 100644
--- a/src/app/aboutDrawer.ts
+++ b/src/app/aboutDrawer.ts
@@ -1,4 +1,5 @@
 import { el } from './dom';
+import { initAnalyticsOptOut } from '../lib/analyticsOptOut.js';
 
 const drawer = () => el('about-drawer');
 
@@ -50,4 +51,5 @@ export function initAboutDrawer() {
   el('about-overlay').addEventListener('click', dismissAbout);
   document.addEventListener('keydown', (e: KeyboardEvent) => { if (e.key === 'Escape') dismissAbout(); });
   document.addEventListener('keydown', trapAboutFocus);
+  initAnalyticsOptOut();
 }
diff --git a/src/components/AnalyticsOptOut.astro b/src/components/AnalyticsOptOut.astro
new file mode 100644
index 0000000..2a0d4c2
--- /dev/null
+++ b/src/components/AnalyticsOptOut.astro
@@ -0,0 +1,69 @@
+---
+import { translations, type Lang } from '../lib/i18n';
+
+interface Props {
+  lang: Lang;
+}
+
+const { lang } = Astro.props;
+const t = translations[lang];
+---
+<!-- Wired by initAnalyticsOptOut() (lib/analyticsOptOut.js). -->
+<label class="optout">
+  <span class="optout-text">
+    <span class="optout-label">{t.optout_label}</span>
+    <span class="optout-hint">{t.optout_hint}</span>
+  </span>
+  <input type="checkbox" role="switch" class="optout-switch" checked />
+</label>
+
+<style>
+  .optout {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 14px;
+    cursor: pointer;
+  }
+  .optout-text {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+  }
+  .optout-label {
+    font-size: 0.85rem;
+    font-weight: 600;
+    color: #d8dbc8;
+  }
+  .optout-hint {
+    font-size: 0.75rem;
+    line-height: 1.4;
+    color: rgba(216,219,200,0.6);
+  }
+  .optout-switch {
+    appearance: none;
+    flex: 0 0 auto;
+    position: relative;
+    width: 38px;
+    height: 22px;
+    margin: 0;
+    border-radius: 11px;
+    background: rgba(216,219,200,0.2);
+    cursor: pointer;
+    transition: background 0.2s;
+  }
+  .optout-switch::after {
+    content: '';
+    position: absolute;
+    top: 3px;
+    left: 3px;
+    width: 16px;
+    height: 16px;
+    border-radius: 50%;
+    background: #d8dbc8;
+    transition: transform 0.2s;
+  }
+  .optout-switch:checked { background: #f0f2a0; }
+  .optout-switch:checked::after { transform: translateX(16px); background: #0e120a; }
+  .optout-switch:focus-visible { outline: 2px solid #f0f2a0; outline-offset: 2px; }
+</style>
diff --git a/src/components/PrivacyContent.astro b/src/components/PrivacyContent.astro
index d905938..517e547 100644
--- a/src/components/PrivacyContent.astro
+++ b/src/components/PrivacyContent.astro
@@ -1,5 +1,6 @@
 ---
 import type { Lang } from '../lib/i18n';
+import AnalyticsOptOut from './AnalyticsOptOut.astro';
 
 interface Props {
   lang: Lang;
@@ -11,33 +12,48 @@ const { lang } = Astro.props;
 {lang === 'fr' && (
   <div class="privacy-pane">
     <h1>Politique de confidentialité</h1>
-    <p class="privacy-date"><em>Dernière mise à jour : juin 2026</em></p>
+    <p class="privacy-date"><em>Dernière mise à jour : septembre 2026</em></p>
 
     <h2>Ce que MeridianWay fait (et ne fait pas)</h2>
-    <p>MeridianWay est une application entièrement statique : elle ne possède pas de serveur propre, ne crée pas de compte utilisateur et ne stocke aucune donnée personnelle en base de données. Tout le calcul (position du soleil, score d'ombre) s'effectue directement dans votre navigateur.</p>
+    <p>MeridianWay ne crée pas de compte utilisateur, ne vous demande aucune information personnelle et ne tient aucun fichier de ses utilisateurs. Tout le calcul (position du soleil, score d'ombre) s'effectue directement dans votre navigateur. Le site est hébergé par Fly.io, et trois relais (Cloudflare Workers) opérés par MeridianWay transmettent une partie des requêtes et en gardent les réponses en cache.</p>
 
     <h2>Données transmises à des services tiers</h2>
-    <p>Pour fonctionner, l'application envoie certaines données à des services externes. Ces services reçoivent votre adresse IP ainsi que les données listées ci-dessous.</p>
+    <p>Pour fonctionner, l'application envoie certaines données à des services externes. Chaque service que votre navigateur contacte directement reçoit aussi votre adresse IP. OpenRouteService et Overpass sont interrogés par un relais MeridianWay et ne la reçoivent pas.</p>
 
     <table>
       <thead>
         <tr><th>Service</th><th>Données transmises</th><th>Finalité</th></tr>
       </thead>
       <tbody>
-        <tr><td><strong>Photon</strong> (komoot GmbH, DE)</td><td>Texte saisi dans les champs adresse</td><td>Suggestions d'autocomplétion</td></tr>
-        <tr><td><strong>Nominatim</strong> (OSM Foundation, UK)</td><td>Adresse saisie ; coordonnées GPS si géolocalisation activée</td><td>Géocodage et géocodage inverse</td></tr>
-        <tr><td><strong>OpenRouteService</strong> (HeiGIT, DE)</td><td>Coordonnées de départ et d'arrivée</td><td>Calcul des itinéraires</td></tr>
-        <tr><td><strong>Overpass API</strong> (serveurs OSM)</td><td>Zone géographique de l'itinéraire</td><td>Données bâtiments et arbres</td></tr>
-        <tr><td><strong>CartoCDN</strong> (Carto Inc., USA)</td><td>Zone de la carte affichée</td><td>Tuiles cartographiques</td></tr>
-        <tr><td><strong>Umami</strong></td><td>Page visitée, type d'appareil, langue du navigateur — sans cookies, IP anonymisée</td><td>Statistiques d'utilisation agrégées</td></tr>
-        <tr><td><strong>Sentry</strong> (serveurs EU, Allemagne)</td><td>Erreurs techniques, URL de la page, type de navigateur — sans données d'identité</td><td>Détection et correction de bugs</td></tr>
+        <tr><td><strong>Fly.io</strong><br /><span class="svc">hébergement</span></td><td>Pages demandées</td><td>Mise à disposition du site</td></tr>
+        <tr><td><strong>Stadia Maps</strong></td><td>Zone de la carte affichée</td><td>Fond de carte</td></tr>
+        <tr><td><strong>Photon</strong><br /><span class="svc">komoot GmbH, DE</span></td><td>Texte saisi dans les champs adresse ; lieu déjà choisi dans l'autre champ</td><td>Suggestions d'autocomplétion</td></tr>
+        <tr><td><strong>Nominatim</strong><br /><span class="svc">OSM Foundation, UK</span></td><td>Adresse saisie ; coordonnées GPS si vous utilisez la géolocalisation</td><td>Géocodage et géocodage inverse</td></tr>
+        <tr><td><strong>Open-Meteo</strong></td><td>Point central de l'itinéraire</td><td>Météo : nébulosité et température</td></tr>
+        <tr><td><strong>Relais MeridianWay</strong><br /><span class="svc">Cloudflare Workers</span></td><td>Coordonnées de départ et d'arrivée ; zone de l'itinéraire</td><td>Relais vers OpenRouteService et Overpass, hauteurs des bâtiments suisses ; réponses gardées en cache 7 à 30 jours, sans lien avec qui les a demandées</td></tr>
+        <tr><td><strong>OpenRouteService</strong><br /><span class="svc">HeiGIT, DE, via le relais</span></td><td>Coordonnées de départ et d'arrivée</td><td>Calcul des itinéraires</td></tr>
+        <tr><td><strong>Overpass API</strong><br /><span class="svc">serveurs OSM, via le relais</span></td><td>Zone géographique de l'itinéraire</td><td>Données bâtiments et arbres</td></tr>
+        <tr><td><strong>Umami</strong></td><td>Adresse de la page, site de provenance, localisation approximative (pays, région) déduite de l'adresse IP, qui n'est pas conservée ; navigateur, système, taille d'écran, langue ; actions dans l'app (recherche lancée, partage…). Sans cookie</td><td>Statistiques d'utilisation agrégées, dont les zones où des itinéraires sont recherchés ; désactivables (voir plus bas)</td></tr>
+        <tr><td><strong>Sentry</strong><br /><span class="svc">serveurs EU, Allemagne</span></td><td>Erreurs techniques, adresse de la page sans ses paramètres, type de navigateur ; sans données d'identité</td><td>Détection et correction de bugs</td></tr>
       </tbody>
     </table>
 
-    <p>La géolocalisation est <strong>optionnelle</strong> et uniquement déclenchée si vous cliquez sur le bouton de localisation.</p>
+    <p>Après une recherche, l'adresse de la page contient les points de départ et d'arrivée, ainsi que le texte saisi pour les désigner : c'est ce qui rend un itinéraire partageable. Umami la reçoit avec des points arrondis à 100 m environ et sans le texte saisi : de quoi voir dans quelles zones des itinéraires sont recherchés, pas de retrouver une adresse précise. Sentry la reçoit sans aucune de ces informations.</p>
+
+    <p>La géolocalisation est <strong>optionnelle</strong> : l'app n'y a accès qu'avec votre autorisation, demandée par le navigateur. Elle sert quand vous appuyez sur un bouton de localisation et, dans l'app installée sur l'écran d'accueil, à proposer votre position comme départ à l'ouverture. Si vous avez déjà donné l'autorisation, l'app s'en sert aussi pour centrer la carte au démarrage.</p>
 
     <h2>Cookies et stockage local</h2>
-    <p>MeridianWay n'utilise <strong>aucun cookie</strong>. Aucune donnée n'est enregistrée dans le stockage local de votre navigateur.</p>
+    <p>MeridianWay n'utilise <strong>aucun cookie</strong>. L'app enregistre en revanche jusqu'à trois informations dans le stockage local de votre navigateur :</p>
+    <ul>
+      <li><strong>Votre dernière position</strong>, si vous avez utilisé la géolocalisation : dans l'app installée, elle sert de départ de secours quand la localisation échoue.</li>
+      <li><strong>La fermeture de la bannière d'installation</strong>, pour ne plus l'afficher.</li>
+      <li><strong>Votre refus des statistiques de visite</strong>, si vous l'avez exprimé (voir ci-dessous).</li>
+    </ul>
+    <p>Ces informations restent sur votre appareil. La position n'en sort que lorsqu'elle est reprise comme point de départ, et suit alors le même chemin que tout point de départ. Pour tout effacer, supprimez les données du site dans les réglages de votre navigateur.</p>
+
+    <h2>Statistiques de visite</h2>
+    <p>MeridianWay mesure son audience avec Umami, sans cookie et sans enregistrer d'identifiant sur votre appareil. Si vous préférez que vos visites ne soient pas comptées, désactivez l'interrupteur ci-dessous, ou celui du panneau À propos de l'app : plus rien n'est envoyé à Umami depuis ce navigateur, sans rechargement. Le réglage vaut pour ce navigateur sur cet appareil. Sur iPhone, l'app installée sur l'écran d'accueil a son propre stockage et se règle séparément. Il ne coupe pas les rapports d'erreurs envoyés à Sentry.</p>
+    <div class="privacy-optout"><AnalyticsOptOut lang={lang} /></div>
 
     <h2>Vos droits</h2>
     <p>Conformément à la loi fédérale suisse sur la protection des données (nLPD) et au RGPD pour les utilisateurs de l'Union européenne, vous pouvez à tout moment demander quelles données vous concernant ont été traitées. Les données transmises aux services tiers sont régies par leurs propres politiques de confidentialité.</p>
@@ -50,33 +66,48 @@ const { lang } = Astro.props;
 {lang === 'de' && (
   <div class="privacy-pane">
     <h1>Datenschutzerklärung</h1>
-    <p class="privacy-date"><em>Zuletzt aktualisiert: Juni 2026</em></p>
+    <p class="privacy-date"><em>Zuletzt aktualisiert: September 2026</em></p>
 
     <h2>Was MeridianWay tut (und nicht tut)</h2>
-    <p>MeridianWay ist eine vollständig statische Anwendung: Sie verfügt über keinen eigenen Server, erstellt keine Benutzerkonten und speichert keine personenbezogenen Daten in einer Datenbank. Alle Berechnungen (Sonnenposition, Schattenbewertung) erfolgen direkt in Ihrem Browser.</p>
+    <p>MeridianWay erstellt keine Benutzerkonten, fragt keine persönlichen Angaben ab und führt keine Kartei über seine Nutzerinnen und Nutzer. Alle Berechnungen (Sonnenposition, Schattenbewertung) erfolgen direkt in Ihrem Browser. Die Website wird bei Fly.io gehostet; drei von MeridianWay betriebene Relais (Cloudflare Workers) leiten einen Teil der Anfragen weiter und speichern die Antworten zwischen.</p>
 
     <h2>An Drittanbieter übermittelte Daten</h2>
-    <p>Für den Betrieb sendet die Anwendung bestimmte Daten an externe Dienste. Diese Dienste erhalten Ihre IP-Adresse sowie die nachstehend aufgeführten Daten.</p>
+    <p>Für den Betrieb sendet die Anwendung bestimmte Daten an externe Dienste. Jeder Dienst, den Ihr Browser direkt kontaktiert, erhält auch Ihre IP-Adresse. OpenRouteService und Overpass werden über ein MeridianWay-Relais abgefragt und erhalten sie nicht.</p>
 
     <table>
       <thead>
         <tr><th>Dienst</th><th>Übermittelte Daten</th><th>Zweck</th></tr>
       </thead>
       <tbody>
-        <tr><td><strong>Photon</strong> (komoot GmbH, DE)</td><td>In den Adressfeldern eingegebener Text</td><td>Autocomplete-Vorschläge</td></tr>
-        <tr><td><strong>Nominatim</strong> (OSM Foundation, UK)</td><td>Eingegebene Adresse; GPS-Koordinaten bei aktivierter Standortbestimmung</td><td>Geo- und Reverse-Geocoding</td></tr>
-        <tr><td><strong>OpenRouteService</strong> (HeiGIT, DE)</td><td>Start- und Zielkoordinaten</td><td>Routenberechnung</td></tr>
-        <tr><td><strong>Overpass API</strong> (OSM-Server)</td><td>Geografischer Bereich der Route</td><td>Gebäude- und Baumdaten</td></tr>
-        <tr><td><strong>CartoCDN</strong> (Carto Inc., USA)</td><td>Angezeigter Kartenausschnitt</td><td>Kartenkacheln</td></tr>
-        <tr><td><strong>Umami</strong></td><td>Besuchte Seite, Gerätetyp, Browsersprache — ohne Cookies, anonymisierte IP</td><td>Aggregierte Nutzungsstatistiken</td></tr>
-        <tr><td><strong>Sentry</strong> (EU-Server, Deutschland)</td><td>Technische Fehler, Seiten-URL, Browsertyp — ohne Identitätsdaten</td><td>Fehlererkennung und -behebung</td></tr>
+        <tr><td><strong>Fly.io</strong><br /><span class="svc">Hosting</span></td><td>Aufgerufene Seiten</td><td>Bereitstellung der Website</td></tr>
+        <tr><td><strong>Stadia Maps</strong></td><td>Angezeigter Kartenausschnitt</td><td>Hintergrundkarte</td></tr>
+        <tr><td><strong>Photon</strong><br /><span class="svc">komoot GmbH, DE</span></td><td>In den Adressfeldern eingegebener Text; im anderen Feld bereits gewählter Ort</td><td>Autocomplete-Vorschläge</td></tr>
+        <tr><td><strong>Nominatim</strong><br /><span class="svc">OSM Foundation, UK</span></td><td>Eingegebene Adresse; GPS-Koordinaten, wenn Sie die Standortbestimmung nutzen</td><td>Geo- und Reverse-Geocoding</td></tr>
+        <tr><td><strong>Open-Meteo</strong></td><td>Mittelpunkt der Route</td><td>Wetter: Bewölkung und Temperatur</td></tr>
+        <tr><td><strong>MeridianWay-Relais</strong><br /><span class="svc">Cloudflare Workers</span></td><td>Start- und Zielkoordinaten; Bereich der Route</td><td>Weiterleitung an OpenRouteService und Overpass, Schweizer Gebäudehöhen; Antworten werden 7 bis 30 Tage zwischengespeichert, ohne Bezug zur anfragenden Person</td></tr>
+        <tr><td><strong>OpenRouteService</strong><br /><span class="svc">HeiGIT, DE, über das Relais</span></td><td>Start- und Zielkoordinaten</td><td>Routenberechnung</td></tr>
+        <tr><td><strong>Overpass API</strong><br /><span class="svc">OSM-Server, über das Relais</span></td><td>Geografischer Bereich der Route</td><td>Gebäude- und Baumdaten</td></tr>
+        <tr><td><strong>Umami</strong></td><td>Seitenadresse, verweisende Website, ungefährer Standort (Land, Region) aus der IP-Adresse, die nicht gespeichert wird; Browser, System, Bildschirmgrösse, Sprache; Aktionen in der App (Suche gestartet, Teilen …). Ohne Cookies</td><td>Aggregierte Nutzungsstatistiken, auch zu den Gebieten, in denen Routen gesucht werden; abschaltbar (siehe unten)</td></tr>
+        <tr><td><strong>Sentry</strong><br /><span class="svc">EU-Server, Deutschland</span></td><td>Technische Fehler, Seitenadresse ohne Parameter, Browsertyp; ohne Identitätsdaten</td><td>Fehlererkennung und -behebung</td></tr>
       </tbody>
     </table>
 
-    <p>Die Standortbestimmung ist <strong>optional</strong> und wird nur aktiviert, wenn Sie auf die Standortschaltfläche klicken.</p>
+    <p>Nach einer Suche enthält die Seitenadresse Start- und Zielpunkt sowie den dafür eingegebenen Text: So lässt sich eine Route teilen. Umami erhält sie mit auf rund 100 m gerundeten Punkten und ohne den eingegebenen Text: genug, um zu sehen, in welchen Gebieten Routen gesucht werden, aber nicht, um eine genaue Adresse zu finden. Sentry erhält sie ohne jede dieser Angaben.</p>
+
+    <p>Die Standortbestimmung ist <strong>optional</strong>: Die App erhält nur mit Ihrer Erlaubnis Zugriff darauf, die Ihr Browser abfragt. Sie wird genutzt, wenn Sie auf eine Standortschaltfläche tippen, und in der auf dem Startbildschirm installierten App, um beim Öffnen Ihren Standort als Start vorzuschlagen. Haben Sie die Erlaubnis bereits erteilt, zentriert die App damit auch die Karte beim Start.</p>
 
     <h2>Cookies und lokaler Speicher</h2>
-    <p>MeridianWay verwendet <strong>keine Cookies</strong>. Es werden keine Daten im lokalen Speicher Ihres Browsers gespeichert.</p>
+    <p>MeridianWay verwendet <strong>keine Cookies</strong>. Die App speichert jedoch bis zu drei Angaben im lokalen Speicher Ihres Browsers:</p>
+    <ul>
+      <li><strong>Ihren letzten Standort</strong>, falls Sie die Standortbestimmung genutzt haben: In der installierten App dient er als Ersatzstart, wenn die Ortung fehlschlägt.</li>
+      <li><strong>Dass Sie das Installationsbanner geschlossen haben</strong>, damit es nicht mehr erscheint.</li>
+      <li><strong>Dass Sie die Besuchsstatistik ausgeschaltet haben</strong>, falls zutreffend (siehe unten).</li>
+    </ul>
+    <p>Diese Angaben bleiben auf Ihrem Gerät. Der Standort verlässt es nur, wenn er als Startpunkt übernommen wird, und nimmt dann denselben Weg wie jeder Startpunkt. Um alles zu löschen, entfernen Sie die Websitedaten in den Einstellungen Ihres Browsers.</p>
+
+    <h2>Besuchsstatistik</h2>
+    <p>MeridianWay misst seine Besuche mit Umami, ohne Cookies und ohne eine Kennung auf Ihrem Gerät zu speichern. Möchten Sie nicht gezählt werden, schalten Sie den Schalter unten aus oder den im Bereich «Über die App»: Von diesem Browser wird dann nichts mehr an Umami gesendet, ohne Neuladen. Die Einstellung gilt für diesen Browser auf diesem Gerät. Auf dem iPhone hat die auf dem Startbildschirm installierte App einen eigenen Speicher und wird separat eingestellt. Fehlerberichte an Sentry werden dadurch nicht abgeschaltet.</p>
+    <div class="privacy-optout"><AnalyticsOptOut lang={lang} /></div>
 
     <h2>Ihre Rechte</h2>
     <p>Gemäss dem Schweizer Bundesgesetz über den Datenschutz (DSG) und der DSGVO für Nutzer der Europäischen Union können Sie jederzeit anfragen, welche Daten über Sie verarbeitet wurden. Die an Drittanbieter übermittelten Daten unterliegen deren eigenen Datenschutzrichtlinien.</p>
@@ -89,33 +120,48 @@ const { lang } = Astro.props;
 {lang === 'it' && (
   <div class="privacy-pane">
     <h1>Informativa sulla privacy</h1>
-    <p class="privacy-date"><em>Ultimo aggiornamento: giugno 2026</em></p>
+    <p class="privacy-date"><em>Ultimo aggiornamento: settembre 2026</em></p>
 
     <h2>Cosa fa (e non fa) MeridianWay</h2>
-    <p>MeridianWay è un'applicazione completamente statica: non dispone di un proprio server, non crea account utente e non memorizza dati personali in alcun database. Tutti i calcoli (posizione del sole, punteggio ombra) vengono eseguiti direttamente nel tuo browser.</p>
+    <p>MeridianWay non crea account utente, non chiede informazioni personali e non tiene alcun archivio dei suoi utenti. Tutti i calcoli (posizione del sole, punteggio ombra) vengono eseguiti direttamente nel tuo browser. Il sito è ospitato da Fly.io, e tre relay (Cloudflare Workers) gestiti da MeridianWay inoltrano parte delle richieste e ne conservano le risposte in cache.</p>
 
     <h2>Dati trasmessi a servizi di terze parti</h2>
-    <p>Per funzionare, l'applicazione invia alcuni dati a servizi esterni. Questi servizi ricevono il tuo indirizzo IP e i dati elencati di seguito.</p>
+    <p>Per funzionare, l'applicazione invia alcuni dati a servizi esterni. Ogni servizio che il tuo browser contatta direttamente riceve anche il tuo indirizzo IP. OpenRouteService e Overpass vengono interrogati da un relay di MeridianWay e non lo ricevono.</p>
 
     <table>
       <thead>
         <tr><th>Servizio</th><th>Dati trasmessi</th><th>Finalità</th></tr>
       </thead>
       <tbody>
-        <tr><td><strong>Photon</strong> (komoot GmbH, DE)</td><td>Testo inserito nei campi indirizzo</td><td>Suggerimenti di completamento automatico</td></tr>
-        <tr><td><strong>Nominatim</strong> (OSM Foundation, UK)</td><td>Indirizzo inserito; coordinate GPS se la geolocalizzazione è attivata</td><td>Geocodifica e geocodifica inversa</td></tr>
-        <tr><td><strong>OpenRouteService</strong> (HeiGIT, DE)</td><td>Coordinate di partenza e arrivo</td><td>Calcolo degli itinerari</td></tr>
-        <tr><td><strong>Overpass API</strong> (server OSM)</td><td>Area geografica dell'itinerario</td><td>Dati edifici e alberi</td></tr>
-        <tr><td><strong>CartoCDN</strong> (Carto Inc., USA)</td><td>Area della mappa visualizzata</td><td>Tile cartografiche</td></tr>
-        <tr><td><strong>Umami</strong></td><td>Pagina visitata, tipo di dispositivo, lingua del browser — senza cookie, IP anonimizzato</td><td>Statistiche d'uso aggregate</td></tr>
-        <tr><td><strong>Sentry</strong> (server EU, Germania)</td><td>Errori tecnici, URL della pagina, tipo di browser — senza dati di identità</td><td>Rilevamento e correzione dei bug</td></tr>
+        <tr><td><strong>Fly.io</strong><br /><span class="svc">hosting</span></td><td>Pagine richieste</td><td>Messa a disposizione del sito</td></tr>
+        <tr><td><strong>Stadia Maps</strong></td><td>Area della mappa visualizzata</td><td>Mappa di base</td></tr>
+        <tr><td><strong>Photon</strong><br /><span class="svc">komoot GmbH, DE</span></td><td>Testo inserito nei campi indirizzo; luogo già scelto nell'altro campo</td><td>Suggerimenti di completamento automatico</td></tr>
+        <tr><td><strong>Nominatim</strong><br /><span class="svc">OSM Foundation, UK</span></td><td>Indirizzo inserito; coordinate GPS se usi la geolocalizzazione</td><td>Geocodifica e geocodifica inversa</td></tr>
+        <tr><td><strong>Open-Meteo</strong></td><td>Punto centrale dell'itinerario</td><td>Meteo: nuvolosità e temperatura</td></tr>
+        <tr><td><strong>Relay MeridianWay</strong><br /><span class="svc">Cloudflare Workers</span></td><td>Coordinate di partenza e arrivo; area dell'itinerario</td><td>Inoltro a OpenRouteService e Overpass, altezze degli edifici svizzeri; risposte conservate in cache da 7 a 30 giorni, senza legame con chi le ha richieste</td></tr>
+        <tr><td><strong>OpenRouteService</strong><br /><span class="svc">HeiGIT, DE, tramite il relay</span></td><td>Coordinate di partenza e arrivo</td><td>Calcolo degli itinerari</td></tr>
+        <tr><td><strong>Overpass API</strong><br /><span class="svc">server OSM, tramite il relay</span></td><td>Area geografica dell'itinerario</td><td>Dati edifici e alberi</td></tr>
+        <tr><td><strong>Umami</strong></td><td>Indirizzo della pagina, sito di provenienza, posizione approssimativa (paese, regione) ricavata dall'indirizzo IP, che non viene conservato; browser, sistema, dimensioni dello schermo, lingua; azioni nell'app (ricerca avviata, condivisione…). Senza cookie</td><td>Statistiche d'uso aggregate, comprese le zone in cui si cercano itinerari; disattivabili (vedi sotto)</td></tr>
+        <tr><td><strong>Sentry</strong><br /><span class="svc">server EU, Germania</span></td><td>Errori tecnici, indirizzo della pagina senza parametri, tipo di browser; senza dati di identità</td><td>Rilevamento e correzione dei bug</td></tr>
       </tbody>
     </table>
 
-    <p>La geolocalizzazione è <strong>opzionale</strong> e viene attivata solo se fai clic sul pulsante di localizzazione.</p>
+    <p>Dopo una ricerca, l'indirizzo della pagina contiene i punti di partenza e di arrivo e il testo inserito per indicarli: è ciò che rende condivisibile un itinerario. Umami lo riceve con i punti arrotondati a circa 100 m e senza il testo inserito: abbastanza per vedere in quali zone si cercano itinerari, non per risalire a un indirizzo preciso. Sentry lo riceve senza nessuna di queste informazioni.</p>
+
+    <p>La geolocalizzazione è <strong>opzionale</strong>: l'app vi accede solo con il tuo permesso, richiesto dal browser. Viene usata quando tocchi un pulsante di localizzazione e, nell'app installata sulla schermata Home, per proporre la tua posizione come partenza all'apertura. Se hai già dato il permesso, l'app la usa anche per centrare la mappa all'avvio.</p>
 
     <h2>Cookie e archiviazione locale</h2>
-    <p>MeridianWay non utilizza <strong>alcun cookie</strong>. Nessun dato viene salvato nell'archiviazione locale del tuo browser.</p>
+    <p>MeridianWay non utilizza <strong>alcun cookie</strong>. L'app salva però fino a tre informazioni nell'archiviazione locale del tuo browser:</p>
+    <ul>
+      <li><strong>La tua ultima posizione</strong>, se hai usato la geolocalizzazione: nell'app installata serve da partenza di riserva quando la localizzazione non riesce.</li>
+      <li><strong>La chiusura del banner di installazione</strong>, per non mostrarlo più.</li>
+      <li><strong>La disattivazione delle statistiche di visita</strong>, se l'hai scelta (vedi sotto).</li>
+    </ul>
+    <p>Queste informazioni restano sul tuo dispositivo. La posizione ne esce solo quando viene ripresa come punto di partenza, e segue allora lo stesso percorso di qualsiasi punto di partenza. Per cancellare tutto, elimina i dati del sito nelle impostazioni del browser.</p>
+
+    <h2>Statistiche di visita</h2>
+    <p>MeridianWay misura le visite con Umami, senza cookie e senza salvare alcun identificativo sul tuo dispositivo. Se preferisci che le tue visite non vengano contate, disattiva l'interruttore qui sotto o quello nel pannello Informazioni dell'app: da questo browser non viene più inviato nulla a Umami, senza ricaricare la pagina. L'impostazione vale per questo browser su questo dispositivo. Su iPhone, l'app installata sulla schermata Home ha una propria memoria e si imposta a parte. Non disattiva le segnalazioni di errore inviate a Sentry.</p>
+    <div class="privacy-optout"><AnalyticsOptOut lang={lang} /></div>
 
     <h2>I tuoi diritti</h2>
     <p>In conformità con la legge federale svizzera sulla protezione dei dati (LPD) e il RGPD per gli utenti dell'Unione europea, puoi richiedere in qualsiasi momento quali dati che ti riguardano sono stati trattati. I dati trasmessi a servizi di terze parti sono disciplinati dalle rispettive informative sulla privacy.</p>
@@ -128,33 +174,48 @@ const { lang } = Astro.props;
 {lang === 'en' && (
   <div class="privacy-pane">
     <h1>Privacy Policy</h1>
-    <p class="privacy-date"><em>Last updated: June 2026</em></p>
+    <p class="privacy-date"><em>Last updated: September 2026</em></p>
 
     <h2>What MeridianWay does (and doesn't do)</h2>
-    <p>MeridianWay is a fully static application: it has no server of its own, creates no user accounts, and stores no personal data in any database. All calculations (sun position, shadow scoring) run directly in your browser.</p>
+    <p>MeridianWay creates no user accounts, asks for no personal information and keeps no records of its users. All calculations (sun position, shadow scoring) run directly in your browser. The site is hosted by Fly.io, and three relays (Cloudflare Workers) run by MeridianWay forward some of the requests and cache the responses.</p>
 
     <h2>Data sent to third-party services</h2>
-    <p>To function, the application sends certain data to external services. These services receive your IP address along with the data listed below.</p>
+    <p>To function, the application sends certain data to external services. Every service your browser contacts directly also receives your IP address. OpenRouteService and Overpass are queried by a MeridianWay relay and do not receive it.</p>
 
     <table>
       <thead>
         <tr><th>Service</th><th>Data sent</th><th>Purpose</th></tr>
       </thead>
       <tbody>
-        <tr><td><strong>Photon</strong> (komoot GmbH, DE)</td><td>Text typed in address fields</td><td>Autocomplete suggestions</td></tr>
-        <tr><td><strong>Nominatim</strong> (OSM Foundation, UK)</td><td>Address entered; GPS coordinates if geolocation is enabled</td><td>Geocoding and reverse geocoding</td></tr>
-        <tr><td><strong>OpenRouteService</strong> (HeiGIT, DE)</td><td>Start and end coordinates</td><td>Route calculation</td></tr>
-        <tr><td><strong>Overpass API</strong> (OSM servers)</td><td>Geographic area of the route</td><td>Building and tree data</td></tr>
-        <tr><td><strong>CartoCDN</strong> (Carto Inc., USA)</td><td>Displayed map area</td><td>Map tiles</td></tr>
-        <tr><td><strong>Umami</strong></td><td>Page visited, device type, browser language — no cookies, anonymised IP</td><td>Aggregated usage statistics</td></tr>
-        <tr><td><strong>Sentry</strong> (EU servers, Germany)</td><td>Technical errors, page URL, browser type — no identity data</td><td>Bug detection and fixing</td></tr>
+        <tr><td><strong>Fly.io</strong><br /><span class="svc">hosting</span></td><td>Pages requested</td><td>Serving the site</td></tr>
+        <tr><td><strong>Stadia Maps</strong></td><td>Displayed map area</td><td>Base map</td></tr>
+        <tr><td><strong>Photon</strong><br /><span class="svc">komoot GmbH, DE</span></td><td>Text typed in address fields; place already chosen in the other field</td><td>Autocomplete suggestions</td></tr>
+        <tr><td><strong>Nominatim</strong><br /><span class="svc">OSM Foundation, UK</span></td><td>Address entered; GPS coordinates if you use geolocation</td><td>Geocoding and reverse geocoding</td></tr>
+        <tr><td><strong>Open-Meteo</strong></td><td>Midpoint of the route</td><td>Weather: cloud cover and temperature</td></tr>
+        <tr><td><strong>MeridianWay relays</strong><br /><span class="svc">Cloudflare Workers</span></td><td>Start and end coordinates; area of the route</td><td>Relay to OpenRouteService and Overpass, Swiss building heights; responses cached for 7 to 30 days, with no link to who requested them</td></tr>
+        <tr><td><strong>OpenRouteService</strong><br /><span class="svc">HeiGIT, DE, via the relay</span></td><td>Start and end coordinates</td><td>Route calculation</td></tr>
+        <tr><td><strong>Overpass API</strong><br /><span class="svc">OSM servers, via the relay</span></td><td>Geographic area of the route</td><td>Building and tree data</td></tr>
+        <tr><td><strong>Umami</strong></td><td>Page address, referring site, approximate location (country, region) derived from the IP address, which is not stored; browser, system, screen size, language; actions in the app (search started, share…). No cookies</td><td>Aggregated usage statistics, including the areas where routes are searched; you can turn them off (see below)</td></tr>
+        <tr><td><strong>Sentry</strong><br /><span class="svc">EU servers, Germany</span></td><td>Technical errors, page address without its parameters, browser type; no identity data</td><td>Bug detection and fixing</td></tr>
       </tbody>
     </table>
 
-    <p>Geolocation is <strong>optional</strong> and only triggered if you click the location button.</p>
+    <p>After a search, the page address contains the start and end points and the text typed to name them: that is what makes a route shareable. Umami receives it with the points rounded to about 100 m and without the typed text: enough to see the areas where routes are searched, not to find a precise address. Sentry receives it without any of this information.</p>
+
+    <p>Geolocation is <strong>optional</strong>: the app only gets access with your permission, which your browser asks for. It is used when you tap a location button and, in the app installed on your home screen, to suggest your position as the start when it opens. If you have already granted permission, the app also uses it to centre the map at start-up.</p>
 
     <h2>Cookies and local storage</h2>
-    <p>MeridianWay uses <strong>no cookies</strong>. No data is saved in your browser's local storage.</p>
+    <p>MeridianWay uses <strong>no cookies</strong>. The app does save up to three items in your browser's local storage:</p>
+    <ul>
+      <li><strong>Your last position</strong>, if you have used geolocation: in the installed app, it is the fallback start when locating you fails.</li>
+      <li><strong>That you closed the install banner</strong>, so it is not shown again.</li>
+      <li><strong>That you turned off visit statistics</strong>, if you did (see below).</li>
+    </ul>
+    <p>These items stay on your device. The position only leaves it when it is used as a starting point, and then follows the same path as any starting point. To erase them all, clear this site's data in your browser settings.</p>
+
+    <h2>Visit statistics</h2>
+    <p>MeridianWay measures its audience with Umami, without cookies and without saving any identifier on your device. If you would rather your visits were not counted, turn off the switch below, or the one in the app's About panel: nothing more is sent to Umami from this browser, with no reload needed. The setting applies to this browser on this device. On iPhone, the app installed on your home screen has its own storage and is set separately. It does not turn off the error reports sent to Sentry.</p>
+    <div class="privacy-optout"><AnalyticsOptOut lang={lang} /></div>
 
     <h2>Your rights</h2>
     <p>Under the Swiss Federal Act on Data Protection (FADP) and the GDPR for users in the European Union, you may at any time request details of what data concerning you has been processed. Data transmitted to third-party services is governed by their own privacy policies.</p>
@@ -167,33 +228,48 @@ const { lang } = Astro.props;
 {lang === 'rm' && (
   <div class="privacy-pane">
     <h1>Disposiziuns davart la protecziun da datas</h1>
-    <p class="privacy-date"><em>Ultima actualisaziun: zercladur 2026</em></p>
+    <p class="privacy-date"><em>Ultima actualisaziun: settember 2026</em></p>
 
     <h2>Tge che MeridianWay fa (e na fa)</h2>
-    <p>MeridianWay è ina app cumplettamain statica: ella n’ha nagin agen server, na fa nagins contos d’utilisader e n’arcunescha naginas datas persunalas en ina banca da datas. Tut las calculaziuns (posiziun dal sulegl, evaluaziun da la sumbriva) vegnan fatgas directamain en Voss navigatur.</p>
+    <p>MeridianWay na fa nagins contos d’utilisader, na dumonda naginas indicaziuns persunalas e na maina nagina cartoteca da ses utilisaders. Tut las calculaziuns (posiziun dal sulegl, evaluaziun da la sumbriva) vegnan fatgas directamain en Voss navigatur. La website vegn ospitada da Fly.io, e trais relais (Cloudflare Workers) manads da MeridianWay transmettan ina part da las dumondas ed arcuneschan las respostas en il cache.</p>
 
     <h2>Datas surdadas a servetschs da terzas persunas</h2>
-    <p>Per funcziunar tramet l’app tschertas datas a servetschs externs. Quests servetschs survegnan Vossa adressa IP sco er las datas menziunadas qua sutvart.</p>
+    <p>Per funcziunar tramet l’app tschertas datas a servetschs externs. Mintga servetsch che Voss navigatur contactescha directamain survegn er Vossa adressa IP. OpenRouteService ed Overpass vegnan dumandads tras in relais da MeridianWay e na la survegnan betg.</p>
 
     <table>
       <thead>
         <tr><th>Servetsch</th><th>Datas transmessas</th><th>Finamira</th></tr>
       </thead>
       <tbody>
-        <tr><td><strong>Photon</strong> (komoot GmbH, DE)</td><td>Text endatà en ils champs d’adressas</td><td>Propostas da cumplettaziun automatica</td></tr>
-        <tr><td><strong>Nominatim</strong> (OSM Foundation, UK)</td><td>Adressa endatada; coordinatas GPS sche la geolocaziun è activada</td><td>Geocodaziun e geocodaziun inversa</td></tr>
-        <tr><td><strong>OpenRouteService</strong> (HeiGIT, DE)</td><td>Coordinatas da partenza e d’arriv</td><td>Calculaziun da la ruta</td></tr>
-        <tr><td><strong>Overpass API</strong> (servers OSM)</td><td>Zona geografica da la ruta</td><td>Datas d’edifizis e da plantas</td></tr>
-        <tr><td><strong>CartoCDN</strong> (Carto Inc., USA)</td><td>Zona da la charta mussada</td><td>Plattinas da charta</td></tr>
-        <tr><td><strong>Umami</strong></td><td>Pagina visitada, tip da l’apparat, lingua dal navigatur — senza cookies, adressa IP anonimisada</td><td>Statisticas d’utilisaziun agregadas</td></tr>
-        <tr><td><strong>Sentry</strong> (servers UE, Germania)</td><td>Sbagls tecnics, URL da la pagina, tip dal navigatur — senza datas d’identitad</td><td>Chattar e reparar sbagls</td></tr>
+        <tr><td><strong>Fly.io</strong><br /><span class="svc">hosting</span></td><td>Paginas dumandadas</td><td>Metter a disposiziun la website</td></tr>
+        <tr><td><strong>Stadia Maps</strong></td><td>Zona da la charta mussada</td><td>Charta da basa</td></tr>
+        <tr><td><strong>Photon</strong><br /><span class="svc">komoot GmbH, DE</span></td><td>Text endatà en ils champs d’adressas; lieu gia tschernì en l’auter champ</td><td>Propostas da cumplettaziun automatica</td></tr>
+        <tr><td><strong>Nominatim</strong><br /><span class="svc">OSM Foundation, UK</span></td><td>Adressa endatada; coordinatas GPS sche Vus utilisais la geolocaziun</td><td>Geocodaziun e geocodaziun inversa</td></tr>
+        <tr><td><strong>Open-Meteo</strong></td><td>Punct central da la ruta</td><td>Aura: nivels e temperatura</td></tr>
+        <tr><td><strong>Relais MeridianWay</strong><br /><span class="svc">Cloudflare Workers</span></td><td>Coordinatas da partenza e d’arriv; zona da la ruta</td><td>Transmissiun a OpenRouteService ed Overpass, autezzas dals edifizis svizzers; respostas arcunadas 7 fin 30 dis en il cache, senza colliaziun cun la persuna che las ha dumandadas</td></tr>
+        <tr><td><strong>OpenRouteService</strong><br /><span class="svc">HeiGIT, DE, tras il relais</span></td><td>Coordinatas da partenza e d’arriv</td><td>Calculaziun da la ruta</td></tr>
+        <tr><td><strong>Overpass API</strong><br /><span class="svc">servers OSM, tras il relais</span></td><td>Zona geografica da la ruta</td><td>Datas d’edifizis e da plantas</td></tr>
+        <tr><td><strong>Umami</strong></td><td>Adressa da la pagina, website da derivanza, lieu approximativ (pajais, regiun) deducì da l’adressa IP, che na vegn betg arcunada; navigatur, sistem, grondezza dal visur, lingua; acziuns en l’app (tschertga cumenzada, parter…). Senza cookies</td><td>Statisticas d’utilisaziun agregadas, er davart las zonas nua che rutas vegnan tschertgadas; Vus las pudais deactivar (guardai sutvart)</td></tr>
+        <tr><td><strong>Sentry</strong><br /><span class="svc">servers UE, Germania</span></td><td>Sbagls tecnics, adressa da la pagina senza parameters, tip dal navigatur; senza datas d’identitad</td><td>Chattar e reparar sbagls</td></tr>
       </tbody>
     </table>
 
-    <p>La geolocaziun è <strong>opziunala</strong> e vegn mo activada sche Vus cliccais sin il buttun da localisaziun.</p>
+    <p>Suenter ina tschertga cuntegna l’adressa da la pagina il punct da partenza e quel d’arriv sco er il text endatà per als numnar: uschia sa lascha ina ruta parter. Umami la survegn cun ils puncts arrundads a var 100 m e senza il text endatà: avunda per vesair en tge zonas che rutas vegnan tschertgadas, ma betg per chattar ina adressa precisa. Sentry la survegn senza naginas da questas indicaziuns.</p>
+
+    <p>La geolocaziun è <strong>opziunala</strong>: l’app ha mo access cun Voss permiss, che Voss navigatur dumonda. Ella vegn utilisada cura che Vus tutgais in buttun da localisaziun e, en l’app installada sin il visur da partenza, per proponer Vossa posiziun sco partenza cura che l’app vegn averta. Sche Vus avais gia dà il permiss, centrescha l’app cun quai er la charta tar la partenza.</p>
 
     <h2>Cookies e memorisaziun locala</h2>
-    <p>MeridianWay n’utilisescha <strong>nagins cookies</strong>. Naginas datas na vegnan arcunadas en la memorisaziun locala da Voss navigatur.</p>
+    <p>MeridianWay n’utilisescha <strong>nagins cookies</strong>. L’app arcunescha dentant fin trais indicaziuns en la memorisaziun locala da Voss navigatur:</p>
+    <ul>
+      <li><strong>Vossa ultima posiziun</strong>, sche Vus avais utilisà la geolocaziun: en l’app installada serva ella sco partenza da reserva, sche la localisaziun na reussescha betg.</li>
+      <li><strong>Che Vus avais serrà il bandier d’installaziun</strong>, per ch’el na cumparia betg pli.</li>
+      <li><strong>Che Vus avais deactivà las statisticas da visitas</strong>, sche quai è il cas (guardai sutvart).</li>
+    </ul>
+    <p>Questas indicaziuns restan sin Voss apparat. La posiziun al banduna mo sch’ella vegn utilisada sco punct da partenza, e fa lura il medem viadi sco mintga punct da partenza. Per stizzar tut, stizzai las datas da questa website en ils parameters da Voss navigatur.</p>
+
+    <h2>Statisticas da visitas</h2>
+    <p>MeridianWay mesira sias visitas cun Umami, senza cookies e senza arcunar in identificatur sin Voss apparat. Sche Vus na vulais betg che Vossas visitas vegnian dumbradas, deactivai il cumutatur qua sutvart u quel en il panel «Pertutgant» da l’app: da quest navigatur na vegn lura nagut pli tramess ad Umami, senza chargiar danovamain. Il parameter vala per quest navigatur sin quest apparat. Sin l’iPhone ha l’app installada sin il visur da partenza sia atgna memoria e sto vegnir parametrada separadamain. El na deactivescha betg ils rapports da sbagls tramess a Sentry.</p>
+    <div class="privacy-optout"><AnalyticsOptOut lang={lang} /></div>
 
     <h2>Voss dretgs</h2>
     <p>Tenor la Lescha federala davart la protecziun da datas (nLPD) e tenor il DSGVO per las utilisadras ed ils utilisaders da l’Uniun europeica pudais Vus dumandar da tut temp tge datas che concernan Vus èn vegnidas elavuradas. Las datas transmessas a servetschs da terzas persunas èn suttamessas a lur atgnas disposiziuns davart la protecziun da datas.</p>
@@ -225,9 +301,24 @@ const { lang } = Astro.props;
     color: #d8dbc8;
     margin-bottom: 0.75rem;
   }
+  .privacy-pane ul {
+    margin: 0 0 0.75rem 1.25rem;
+    padding: 0;
+  }
+  .privacy-pane li {
+    line-height: 1.6;
+    color: #d8dbc8;
+    margin-bottom: 0.35rem;
+  }
   .privacy-pane a {
     color: #f0f2a0;
   }
+  .privacy-optout {
+    margin: 1rem 0 1.25rem;
+    padding: 14px 16px;
+    border: 1px solid rgba(240,242,160,0.2);
+    border-radius: 8px;
+  }
   table {
     width: 100%;
     border-collapse: collapse;
@@ -246,6 +337,13 @@ const { lang } = Astro.props;
     border-bottom: 1px solid rgba(240,242,160,0.07);
     vertical-align: top;
     color: #d8dbc8;
+    /* German compounds otherwise push the table past a phone's width. */
+    hyphens: auto;
+    overflow-wrap: anywhere;
+  }
+  td:first-child { overflow-wrap: normal; }
+  .svc {
+    color: rgba(216,219,200,0.6);
+    font-size: 0.75rem;
   }
-  td:first-child { white-space: nowrap; }
 </style>
diff --git a/src/components/app/AboutDrawer.astro b/src/components/app/AboutDrawer.astro
index a77c5c8..d80d80a 100644
--- a/src/components/app/AboutDrawer.astro
+++ b/src/components/app/AboutDrawer.astro
@@ -1,6 +1,7 @@
 ---
 import { translations, LANGS, langPath, type Lang } from '../../lib/i18n';
 import AboutContent from '../AboutContent.astro';
+import AnalyticsOptOut from '../AnalyticsOptOut.astro';
 import githubIcon from '../../icons/github.svg?raw';
 
 interface Props {
@@ -31,6 +32,9 @@ const t = translations[lang];
       GitHub
     </a>
   </div>
+  <div id="about-optout">
+    <AnalyticsOptOut lang={lang} />
+  </div>
   <div class="footer-links">
     <a href={langPath(lang, 'about')} class="footer-link">{t.aria_about}</a>
     <span class="footer-link">-</span>
diff --git a/src/components/app/AppHead.astro b/src/components/app/AppHead.astro
index 9cc2a70..6a6058e 100644
--- a/src/components/app/AppHead.astro
+++ b/src/components/app/AppHead.astro
@@ -41,4 +41,4 @@ const t = translations[lang];
   "offers": { "@type": "Offer", "price": "0", "priceCurrency": "CHF" },
   "author": { "@type": "Person", "url": "https://github.com/paultursuru" }
 })} />
-<script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false"></script>
+<script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false" data-before-send="umamiBeforeSend"></script>
diff --git a/src/layouts/AboutLayout.astro b/src/layouts/AboutLayout.astro
index 56ebc21..e80e485 100644
--- a/src/layouts/AboutLayout.astro
+++ b/src/layouts/AboutLayout.astro
@@ -33,7 +33,7 @@ const pageUrl = (l: Lang) => langUrl(l, 'about/');
   <meta property="og:title" content={t.about_title} />
   <meta property="og:description" content={t.about_meta_description} />
   <meta property="og:image" content="https://meridian-way.ch/meridian-way-og.png" />
-  <script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false"></script>
+  <script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false" data-before-send="umamiBeforeSend"></script>
 </head>
 <body class="about-page">
 
diff --git a/src/layouts/PrivacyLayout.astro b/src/layouts/PrivacyLayout.astro
index 7582c35..c9ad74e 100644
--- a/src/layouts/PrivacyLayout.astro
+++ b/src/layouts/PrivacyLayout.astro
@@ -43,7 +43,7 @@ const backLabels: Record<Lang, string> = {
   <link rel="canonical" href={pageUrl(lang)} />
   {LANGS.map(l => <link rel="alternate" hreflang={l} href={pageUrl(l)} />)}
   <link rel="alternate" hreflang="x-default" href={pageUrl('fr')} />
-  <script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false"></script>
+  <script is:inline defer src="https://cloud.umami.is/script.js" data-website-id="3ed0ad98-8924-4e14-aa5b-6afe5d3dc7ac" data-domains="meridian-way.ch" data-auto-pageview="false" data-performance="false" data-before-send="umamiBeforeSend"></script>
 </head>
 <body class="privacy-page">
 
@@ -131,6 +131,8 @@ const backLabels: Record<Lang, string> = {
 <!-- Bundle par Astro (pas is:inline) : la CSP interdit les scripts inline. -->
 <script>
   import { trackPageview } from '../lib/analytics.js';
+  import { initAnalyticsOptOut } from '../lib/analyticsOptOut.js';
+  initAnalyticsOptOut();
   trackPageview();
 </script>
 
diff --git a/src/lib/analytics.js b/src/lib/analytics.js
index abeb721..de4ed90 100644
--- a/src/lib/analytics.js
+++ b/src/lib/analytics.js
@@ -35,6 +35,39 @@
 const RETRY_MS = 200;
 const MAX_WAIT_MS = 5000;
 
+// Umami keeps where routes are searched, not who searched them: route points
+// rounded to ~100 m (3 decimals), and the typed labels, which can be a home
+// address, dropped. Applied to the page URL and the referrer of every send.
+const DROPPED = ['fromq', 'toq'];
+const POINTS = ['from', 'to'];
+const LAT_LNG = /^-?\d+(\.\d+)?,-?\d+(\.\d+)?$/;
+
+export function coarsenUrl(url) {
+  if (typeof url !== 'string') return url;
+  const q = url.indexOf('?');
+  if (q < 0) return url;
+  const h = url.indexOf('#', q);
+  const hash = h < 0 ? '' : url.slice(h);
+  const params = new URLSearchParams(url.slice(q + 1, h < 0 ? undefined : h));
+  if (![...DROPPED, ...POINTS].some((k) => params.has(k))) return url;
+  for (const k of DROPPED) params.delete(k);
+  for (const k of POINTS) {
+    const v = params.get(k);
+    if (v && LAT_LNG.test(v)) params.set(k, v.split(',').map((n) => Number(n).toFixed(3)).join(','));
+  }
+  const query = params.toString();
+  return url.slice(0, q) + (query ? `?${query}` : '') + hash;
+}
+
+export function umamiBeforeSend(type, payload) {
+  if (!payload) return payload;
+  return { ...payload, url: coarsenUrl(payload.url), referrer: coarsenUrl(payload.referrer) };
+}
+
+// Named by data-before-send on the Umami tags; read at each send. Every page
+// sends its first payload through trackPageview(), after this has run.
+if (typeof window !== 'undefined') window.umamiBeforeSend = umamiBeforeSend;
+
 // Umami's global is absent until its script loads, and for good behind a
 // blocker: every custom event goes through here.
 export function track(...args) {
diff --git a/src/lib/analyticsOptOut.js b/src/lib/analyticsOptOut.js
new file mode 100644
index 0000000..026751a
--- /dev/null
+++ b/src/lib/analyticsOptOut.js
@@ -0,0 +1,35 @@
+// Umami's tracker reads this key before every send: any non-empty value stops
+// page views and custom events alike, with no reload. Removing it resumes.
+const KEY = 'umami.disabled';
+
+export function isOptedOut() {
+  try {
+    return !!localStorage.getItem(KEY);
+  } catch {
+    return false;
+  }
+}
+
+// False when storage refuses the write (private browsing, full quota).
+export function setOptedOut(out) {
+  try {
+    if (out) localStorage.setItem(KEY, '1');
+    else localStorage.removeItem(KEY);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Checked means "counted". Every switch is redrawn from storage after a change,
+// so one that couldn't be saved snaps back instead of lying.
+// No analytics event here: measuring who opts out would break the promise.
+export function initAnalyticsOptOut() {
+  const switches = document.querySelectorAll('.optout-switch');
+  const sync = () => switches.forEach((s) => { s.checked = !isOptedOut(); });
+  sync();
+  switches.forEach((s) => s.addEventListener('change', () => {
+    setOptedOut(!s.checked);
+    sync();
+  }));
+}
diff --git a/src/lib/errors.js b/src/lib/errors.js
index 69b7a93..80f1533 100644
--- a/src/lib/errors.js
+++ b/src/lib/errors.js
@@ -9,7 +9,7 @@ const TECHNICAL = {
 };
 
 // Codes whose message is already the sentence: shown as-is.
-const READY = new Set(['ADDRESS_NOT_FOUND', 'POSITION_UNKNOWN', 'NO_ROUTE']);
+export const READY = new Set(['ADDRESS_NOT_FOUND', 'POSITION_UNKNOWN', 'NO_ROUTE']);
 
 // The toast for a failed search. The technical detail stays on the error for
 // the console and Sentry.
diff --git a/src/lib/i18n.ts b/src/lib/i18n.ts
index 0536050..5fcbf7e 100644
--- a/src/lib/i18n.ts
+++ b/src/lib/i18n.ts
@@ -113,6 +113,8 @@ export const translations = {
     error_geo_denied: 'Localisation refusée par le navigateur.',
     error_geo_timeout: 'Localisation impossible, réessayez.',
     about_privacy: 'Confidentialité',
+    optout_label: 'Statistiques de visite',
+    optout_hint: 'Sans cookie. Désactivez pour que cet appareil ne soit plus compté.',
     share_btn_title: 'Partager cet itinéraire',
     toast_link_copied: 'Lien copié dans le presse-papier.',
     install_banner_android: '📲 Installez MeridianWay sur votre écran d\'accueil pour un accès plus rapide.',
@@ -218,6 +220,8 @@ export const translations = {
     error_geo_denied: 'Standortzugriff wurde verweigert.',
     error_geo_timeout: 'Standort nicht verfügbar, erneut versuchen.',
     about_privacy: 'Datenschutz',
+    optout_label: 'Besuchsstatistik',
+    optout_hint: 'Ohne Cookie. Deaktivieren Sie diese Option, wenn Sie nicht möchten, dass dieses Gerät gezählt wird.',
     share_btn_title: 'Route teilen',
     toast_link_copied: 'Link in die Zwischenablage kopiert.',
     install_banner_android: '📲 MeridianWay auf dem Startbildschirm installieren für schnelleren Zugriff.',
@@ -323,6 +327,8 @@ export const translations = {
     error_geo_denied: 'Localizzazione rifiutata dal browser.',
     error_geo_timeout: 'Localizzazione impossibile, riprova.',
     about_privacy: 'Privacy',
+    optout_label: 'Statistiche di visita',
+    optout_hint: 'Senza cookie. Disattiva perché questo dispositivo non venga più contato.',
     share_btn_title: 'Condividi il percorso',
     toast_link_copied: 'Link copiato negli appunti.',
     install_banner_android: '📲 Installa MeridianWay sulla schermata Home per un accesso più rapido.',
@@ -428,6 +434,8 @@ export const translations = {
     error_geo_denied: 'Location access denied by browser.',
     error_geo_timeout: 'Location unavailable, please try again.',
     about_privacy: 'Privacy',
+    optout_label: 'Visit statistics',
+    optout_hint: 'No cookies. Turn off to stop counting this device.',
     share_btn_title: 'Share this route',
     toast_link_copied: 'Link copied to clipboard.',
     install_banner_android: '📲 Install MeridianWay on your home screen for faster access.',
@@ -533,6 +541,8 @@ export const translations = {
     error_geo_denied: 'Refusà il lieu dal navigatur.',
     error_geo_timeout: 'Il lieu n’è betg stà pussaivel d’eruir. Empruvar per plaschair anc ina giada.',
     about_privacy: 'caracter confidenzial',
+    optout_label: 'Statisticas da visitas',
+    optout_hint: 'Senza cookie. Deactivai questa opziun, sche Vus na vulessas betg che quest apparat vegnia dumbrà.',
     share_btn_title: 'Parta questa ruta',
     toast_link_copied: 'Copià la colliaziun en l’archiv provisoric.',
     install_banner_android: '📲 L’installaziun da MeridianWay sin tes visur da partenza per in access pli svelt.',
diff --git a/src/lib/sentryScrub.js b/src/lib/sentryScrub.js
new file mode 100644
index 0000000..3e83f2b
--- /dev/null
+++ b/src/lib/sentryScrub.js
@@ -0,0 +1,53 @@
+import { READY } from './errors.js';
+
+// Keeps the route and the typed addresses out of error reports. Search URLs
+// carry them as from/to and fromq/toq, geocoder requests as q=.
+
+export function stripQuery(url) {
+  return typeof url === 'string' ? url.replace(/[?#].*$/, '') : url;
+}
+
+// A READY error's message is the toast, which can quote the user's input
+// (ADDRESS_NOT_FOUND). Its code says the same without it.
+function redacted(value) {
+  return value instanceof Error && READY.has(value.code) ? `${value.name}: ${value.code}` : null;
+}
+
+export function scrubEvent(event, hint) {
+  if (event.request) {
+    event.request.url = stripQuery(event.request.url);
+    const headers = event.request.headers;
+    if (headers?.Referer) headers.Referer = stripQuery(headers.Referer);
+  }
+  const err = hint?.originalException;
+  if (redacted(err)) {
+    for (const ex of event.exception?.values ?? []) {
+      if (ex.value === err.message) ex.value = err.code;
+    }
+  }
+  return event;
+}
+
+export function scrubBreadcrumb(crumb, hint) {
+  const { category, data } = crumb;
+  if ((category === 'fetch' || category === 'xhr') && data) {
+    data.url = stripQuery(data.url);
+  }
+  if (category === 'navigation' && data) {
+    data.from = stripQuery(data.from);
+    data.to = stripQuery(data.to);
+  }
+  if (category === 'console') {
+    const args = hint?.input ?? [];
+    if (args.some(redacted)) {
+      const safe = args.map((a) => redacted(a) ?? a);
+      crumb.message = safe.map(String).join(' ');
+      crumb.data = { ...data, arguments: safe };
+    }
+  }
+  // Autocomplete suggestions carry the place name as their title.
+  if (category?.startsWith('ui.') && crumb.message) {
+    crumb.message = crumb.message.replace(/\[title=".*?"\]/g, '');
+  }
+  return crumb;
+}
diff --git a/src/styles/main.css b/src/styles/main.css
index c9e4ca9..92462e1 100644
--- a/src/styles/main.css
+++ b/src/styles/main.css
@@ -1259,6 +1259,11 @@ p.opensource-badge {
 .github-link { color: #f0f2a0; border-color: rgba(240,242,160,0.3); background: rgba(240,242,160,0.05); }
 .github-link:hover { border-color: rgba(240,242,160,0.6); background: rgba(240,242,160,0.1); }
 
+#about-optout {
+  padding: 12px 20px;
+  border-top: 1px solid rgba(240,242,160,0.1);
+}
+
 .footer-links {
   display: flex;
   justify-content: center;
diff --git a/tests/analytics.test.js b/tests/analytics.test.js
new file mode 100644
index 0000000..b25f8c3
--- /dev/null
+++ b/tests/analytics.test.js
@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { coarsenUrl, umamiBeforeSend } from '../src/lib/analytics.js';
+
+const SEARCH_URL = 'https://meridian-way.ch/?from=46.51860%2C6.56800&fromq=Avenue+Probe+12%2C+Ecublens&to=46.53730%2C6.58530&toq=Renens&dt=2026-09-25T08%3A27';
+
+describe('coarsenUrl', () => {
+  it('rounds the route points to ~100 m and drops the typed labels', () => {
+    expect(coarsenUrl(SEARCH_URL)).toBe('https://meridian-way.ch/?from=46.519%2C6.568&to=46.537%2C6.585&dt=2026-09-25T08%3A27');
+  });
+
+  it('works on the relative referrer Umami sends for same-origin pages', () => {
+    expect(coarsenUrl('/de/?from=46.5186,6.568&fromq=x&to=46.5373,6.5853')).toBe('/de/?from=46.519%2C6.568&to=46.537%2C6.585');
+  });
+
+  it('keeps utm tags and the onboarding flag', () => {
+    expect(coarsenUrl('/?from=1.23456,2.34567&to=3,4&onboarding=1&utm_source=reddit'))
+      .toBe('/?from=1.235%2C2.346&to=3.000%2C4.000&onboarding=1&utm_source=reddit');
+  });
+
+  it('leaves the query alone when it holds no route', () => {
+    const url = 'https://meridian-way.ch/it/?utm_source=chatgpt.com';
+    expect(coarsenUrl(url)).toBe(url);
+  });
+
+  it('drops a query left empty and keeps the hash', () => {
+    expect(coarsenUrl('/?fromq=Home#map')).toBe('/#map');
+  });
+
+  it('does not touch a from that is not a point', () => {
+    expect(coarsenUrl('/?from=newsletter')).toBe('/?from=newsletter');
+  });
+
+  it('passes through a missing value', () => {
+    expect(coarsenUrl(undefined)).toBeUndefined();
+    expect(coarsenUrl('')).toBe('');
+  });
+});
+
+describe('umamiBeforeSend', () => {
+  it('coarsens the url and the referrer and keeps the rest of the payload', () => {
+    const payload = { website: 'w', url: SEARCH_URL, referrer: '/?fromq=Home&from=1,2', name: 'scrub', data: { a: 1 } };
+    expect(umamiBeforeSend('event', payload)).toEqual({
+      website: 'w',
+      url: 'https://meridian-way.ch/?from=46.519%2C6.568&to=46.537%2C6.585&dt=2026-09-25T08%3A27',
+      referrer: '/?from=1.000%2C2.000',
+      name: 'scrub',
+      data: { a: 1 },
+    });
+  });
+});
diff --git a/tests/analyticsOptOut.test.js b/tests/analyticsOptOut.test.js
new file mode 100644
index 0000000..97e58d9
--- /dev/null
+++ b/tests/analyticsOptOut.test.js
@@ -0,0 +1,49 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { isOptedOut, setOptedOut } from '../src/lib/analyticsOptOut.js';
+
+// No DOM in the "node" environment: an in-memory stand-in for localStorage.
+function memoryStorage() {
+  const store = new Map();
+  return {
+    getItem: (k) => (store.has(k) ? store.get(k) : null),
+    setItem: (k, v) => store.set(k, String(v)),
+    removeItem: (k) => store.delete(k),
+  };
+}
+
+function throwingStorage() {
+  const fail = () => { throw new Error('SecurityError'); };
+  return { getItem: fail, setItem: fail, removeItem: fail };
+}
+
+beforeEach(() => { globalThis.localStorage = memoryStorage(); });
+
+describe('analytics opt-out', () => {
+  it('counts the visitor by default', () => {
+    expect(isOptedOut()).toBe(false);
+  });
+
+  it('writes the key the Umami tracker checks before each send', () => {
+    setOptedOut(true);
+    expect(globalThis.localStorage.getItem('umami.disabled')).toBe('1');
+    expect(isOptedOut()).toBe(true);
+  });
+
+  it('removes the key to opt back in, since any stored value disables', () => {
+    setOptedOut(true);
+    setOptedOut(false);
+    expect(globalThis.localStorage.getItem('umami.disabled')).toBeNull();
+    expect(isOptedOut()).toBe(false);
+  });
+
+  it('treats a value set by hand as opted out', () => {
+    globalThis.localStorage.setItem('umami.disabled', '0');
+    expect(isOptedOut()).toBe(true);
+  });
+
+  it('reports a refused write instead of throwing', () => {
+    globalThis.localStorage = throwingStorage();
+    expect(setOptedOut(true)).toBe(false);
+    expect(isOptedOut()).toBe(false);
+  });
+});
diff --git a/tests/e2e/analytics-optout.spec.js b/tests/e2e/analytics-optout.spec.js
new file mode 100644
index 0000000..50954f4
--- /dev/null
+++ b/tests/e2e/analytics-optout.spec.js
@@ -0,0 +1,81 @@
+import { test, expect } from '@playwright/test';
+
+// The visit statistics switch, in the About panel and on the privacy page.
+// It writes the key Umami's tracker reads before every send. What this can't
+// show is the real tracker going quiet: it only sends from meridian-way.ch.
+
+const KEY = 'umami.disabled';
+const stored = page => page.evaluate(k => localStorage.getItem(k), KEY);
+
+// Umami never loads here, so stand one up before the app's module runs.
+async function collectEvents(page) {
+  await page.addInitScript(() => {
+    window.__events = [];
+    window.umami = { track: (...args) => window.__events.push(args) };
+  });
+}
+
+const eventCount = page => page.evaluate(() => window.__events.length);
+
+async function openAbout(page) {
+  await page.goto('/');
+  // initAutocomplete() puts role=combobox on the field: the app script runs.
+  await page.waitForSelector('#inp-end[role="combobox"]');
+  await page.click('#about-btn');
+  await expect(page.locator('#about-drawer')).toHaveClass(/open/);
+  return page.locator('#about-drawer .optout-switch');
+}
+
+test('the About panel switch opts out and back in, and the state survives a reload', async ({ page }) => {
+  let sw = await openAbout(page);
+  await expect(sw).toBeChecked();
+  expect(await stored(page)).toBeNull();
+
+  await sw.click();
+  await expect(sw).not.toBeChecked();
+  expect(await stored(page)).toBe('1');
+
+  sw = await openAbout(page);
+  await expect(sw).not.toBeChecked();
+
+  await sw.click();
+  await expect(sw).toBeChecked();
+  expect(await stored(page)).toBeNull();
+
+  sw = await openAbout(page);
+  await expect(sw).toBeChecked();
+});
+
+test('the privacy page switch shares its state with the app', async ({ page }) => {
+  await page.goto('/en/privacy');
+  const sw = page.locator('.privacy-optout .optout-switch');
+  await expect(sw).toBeChecked();
+
+  await sw.click();
+  await expect(sw).not.toBeChecked();
+  expect(await stored(page)).toBe('1');
+
+  await expect(await openAbout(page)).not.toBeChecked();
+});
+
+test('toggling sends no analytics event', async ({ page }) => {
+  await collectEvents(page);
+  const sw = await openAbout(page);
+  const before = await eventCount(page);
+
+  await sw.click();
+  await sw.click();
+
+  expect(await eventCount(page)).toBe(before);
+});
+
+test('a refused write leaves the switch on', async ({ page }) => {
+  await page.addInitScript(() => {
+    Storage.prototype.setItem = () => { throw new DOMException('Quota', 'QuotaExceededError'); };
+  });
+  const sw = await openAbout(page);
+
+  await sw.click();
+
+  await expect(sw).toBeChecked();
+});
diff --git a/tests/e2e/umami-before-send.spec.js b/tests/e2e/umami-before-send.spec.js
new file mode 100644
index 0000000..432cef3
--- /dev/null
+++ b/tests/e2e/umami-before-send.spec.js
@@ -0,0 +1,33 @@
+import { test, expect } from '@playwright/test';
+
+// Umami's tags name umamiBeforeSend, which rounds the route points and drops
+// the typed labels (tests/analytics.test.js). This pins the wiring on each page
+// that loads the tracker. The tracker itself never sends from localhost.
+
+const SHARED = '/?from=46.51860,6.56800&fromq=Chez+moi+12&to=46.53730,6.58530&toq=Renens&dt=2026-08-13T14:00';
+
+async function stubUpstreams(page) {
+  await page.route(/nominatim|photon|open-meteo|workers\.dev|stadiamaps/, route => route.abort());
+}
+
+for (const path of ['/', '/en/about', '/en/privacy']) {
+  test(`${path} names the hook on the Umami tag and defines it`, async ({ page }) => {
+    await stubUpstreams(page);
+    await page.goto(path);
+    await expect(page.locator('script[src*="umami"]')).toHaveAttribute('data-before-send', 'umamiBeforeSend');
+    await expect.poll(() => page.evaluate(() => typeof window.umamiBeforeSend)).toBe('function');
+  });
+}
+
+test('a shared link reaches Umami rounded and without its labels', async ({ page }) => {
+  await stubUpstreams(page);
+  await page.goto(SHARED);
+  await expect.poll(() => page.evaluate(() => typeof window.umamiBeforeSend)).toBe('function');
+
+  const sent = await page.evaluate(() => window.umamiBeforeSend('event', { url: location.href, referrer: '' }).url);
+
+  expect(sent).not.toContain('fromq');
+  expect(sent).not.toContain('toq');
+  expect(new URL(sent).searchParams.get('from')).toBe('46.519,6.568');
+  expect(new URL(sent).searchParams.get('to')).toBe('46.537,6.585');
+});
diff --git a/tests/sentryScrub.test.js b/tests/sentryScrub.test.js
new file mode 100644
index 0000000..3d40014
--- /dev/null
+++ b/tests/sentryScrub.test.js
@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+import { stripQuery, scrubEvent, scrubBreadcrumb } from '../src/lib/sentryScrub.js';
+
+const SEARCH_URL = 'https://meridian-way.ch/?from=46.51860%2C6.56800&fromq=Avenue+Probe+12&to=46.53730%2C6.58530&toq=Renens&dt=2026-09-25T08%3A27';
+
+function addressNotFound() {
+  const err = new Error('Adresse introuvable : "Avenue Probe 12"');
+  err.code = 'ADDRESS_NOT_FOUND';
+  return err;
+}
+
+describe('stripQuery', () => {
+  it('drops the query and the hash', () => {
+    expect(stripQuery(SEARCH_URL)).toBe('https://meridian-way.ch/');
+    expect(stripQuery('/de/?from=1,2#x')).toBe('/de/');
+  });
+
+  it('leaves a missing url alone', () => {
+    expect(stripQuery(undefined)).toBeUndefined();
+  });
+});
+
+describe('scrubEvent', () => {
+  it('strips the page URL and the referrer', () => {
+    const event = scrubEvent({ request: { url: SEARCH_URL, headers: { Referer: SEARCH_URL, 'User-Agent': 'UA' } } });
+    expect(event.request.url).toBe('https://meridian-way.ch/');
+    expect(event.request.headers).toEqual({ Referer: 'https://meridian-way.ch/', 'User-Agent': 'UA' });
+  });
+
+  it('reports a user-facing error by its code', () => {
+    const err = addressNotFound();
+    const event = scrubEvent({ exception: { values: [{ type: 'Error', value: err.message }] } }, { originalException: err });
+    expect(event.exception.values[0].value).toBe('ADDRESS_NOT_FOUND');
+  });
+
+  it('keeps the message of a technical error', () => {
+    const err = new Error('ORS 503 after retries');
+    err.code = 'ROUTING_UNAVAILABLE';
+    const event = scrubEvent({ exception: { values: [{ type: 'Error', value: err.message }] } }, { originalException: err });
+    expect(event.exception.values[0].value).toBe('ORS 503 after retries');
+  });
+});
+
+describe('scrubBreadcrumb', () => {
+  it('strips geocoder queries from fetch breadcrumbs', () => {
+    const crumb = scrubBreadcrumb({
+      category: 'fetch',
+      data: { method: 'GET', url: 'https://nominatim.openstreetmap.org/search?q=Avenue%20Probe%2012&format=json', status_code: 200 },
+    });
+    expect(crumb.data).toEqual({ method: 'GET', url: 'https://nominatim.openstreetmap.org/search', status_code: 200 });
+  });
+
+  it('strips both ends of a navigation', () => {
+    const crumb = scrubBreadcrumb({ category: 'navigation', data: { from: '/', to: '/?from=1,2&fromq=Avenue+Probe+12' } });
+    expect(crumb.data).toEqual({ from: '/', to: '/' });
+  });
+
+  it('replaces a user-facing error logged to the console', () => {
+    const err = addressNotFound();
+    const crumb = scrubBreadcrumb(
+      { category: 'console', level: 'error', message: `Error: ${err.message}`, data: { arguments: [err], logger: 'console' } },
+      { input: [err], level: 'error' },
+    );
+    expect(crumb.message).toBe('Error: ADDRESS_NOT_FOUND');
+    expect(crumb.data).toEqual({ arguments: ['Error: ADDRESS_NOT_FOUND'], logger: 'console' });
+  });
+
+  it('keeps other console messages', () => {
+    const crumb = scrubBreadcrumb(
+      { category: 'console', level: 'warn', message: 'Overpass vegetation failed', data: { arguments: ['Overpass vegetation failed'] } },
+      { input: ['Overpass vegetation failed'], level: 'warn' },
+    );
+    expect(crumb.message).toBe('Overpass vegetation failed');
+  });
+
+  it('drops the place name a clicked suggestion carries as its title', () => {
+    const crumb = scrubBreadcrumb({ category: 'ui.click', message: 'ul#ac-start > li.ac-item[title="Avenue Probe 12, Ecublens"] > span' });
+    expect(crumb.message).toBe('ul#ac-start > li.ac-item > span');
+  });
+});