1. Who is responsible for your data
The controller is Ferran Leiva Paton, C/ Bambylos, 8/08242 (registration number 39405846S). Contact for privacy matters: [email protected]. [Data protection officer, if one is required — to be determined.]
2. What we process today, and why
| Data | Purpose | Basis (draft) | Kept |
|---|---|---|---|
| Email address, hashed password, optional display name | Create and run your account; sign you in | Contract | Until you delete your account |
| Time you confirmed you are 18+ | Enforce our age requirement | Contract / legal obligation | Until account deletion |
| Settings: language (only if you choose one), default visibility, profile visibility | Apply your preferences | Contract | Until account deletion |
| Countries you choose to mark as visited (a country code and the time you marked it) | Draw your World map and show your statistics; include them in your data export | Contract | Until you remove the country or delete your account |
| Trips you create: name, dates, optional description and visibility; the stops of each trip with place name, region, country, coordinates, optional arrival/departure dates and notes; and how you travelled between stops | Record, show and draw your trips and routes; work out the countries of a trip | Contract | Until you edit or delete them, or delete your account |
| The text you type when searching for a place to add as a stop | Suggest places | Contract | Not stored (see below) |
| Photos you upload: the original file, a small thumbnail and a display-size copy (both re-encoded and stripped of embedded metadata), the file name, size, type, dimensions and a SHA-256 fingerprint of the file | Show your photos to you, place them on your trips, and detect a photo you have already uploaded | Contract | Until you delete the photo or your account |
| Metadata read from a photo: capture date and time as the camera wrote it, the time zone only if the photo states one, orientation and GPS coordinates if the photo has them. Camera make, model and serial numbers are not kept. | Suggest which stop of which trip each photo belongs to, and which country it was taken in | Contract | Until you delete the photo or your account |
| Which photo you placed at which stop, and the photo you chose as a country's cover | Show your photos with your trips and your map | Contract | Until you change it, or delete the photo or your account |
| The language you chose, kept in a cookie on your device | Show the site in your language | Your request (preference cookie) | Up to 1 year |
| The day-by-day itinerary of a trip: a title or note for a day, and the visits, activities and movements you add, each with a category, title, place, the country of the visit, optional coordinates, times, notes, and — only if you type them — an operator name, a booking reference, a web link and an approximate price | Show your trip day by day; work out which countries you visited | Contract | Until you edit or delete it, or the trip is deleted |
| Who belongs to a trip and in what role (owner, collaborator or viewer), and the invitations you create: role, an optional email address the invitation is restricted to, and an expiry. Only an irreversible fingerprint of an invitation link is kept, never the link itself | Let you keep one trip together with people you invite | Contract | While you belong to the trip; an invitation until it is used, revoked or expired |
| Which day, and which activity, of a trip a photo is filed under | Show your photos with the day they belong to | Contract | Until you change it, or delete the photo or your account |
| Which legal document versions you accepted, and when | Prove what you agreed to | Legal obligation / legitimate interest | Until account deletion |
| Marketing preference and cookie choices, with the time you set them | Respect your consent choices | Consent | Until account deletion |
| Security log: event type, time, IP address, browser/device string, limited technical detail (e.g. sign-in success or failure) | Protect accounts, detect and investigate abuse | Legitimate interest | Sign-in events 90 days; other events 12 months |
| Session cookie | Keep you signed in | Strictly necessary | Up to 14 days |
| Your public profile: username, optional bio and links (Instagram, TikTok, YouTube), and the avatar and cover image you choose (re-encoded and stripped of embedded metadata) | Run your profile and show it to others as described below; let people find you by username | Contract | Until you change or remove them, or delete your account |
| For each trip you choose to publish: whether it is public or by private link, how much of its dates to show, whether to show your photos, when you published it and — for a private link — a one-way hash of the link's secret (the secret itself is never stored) | Show the trip to the people you decided, and let you change or withdraw it | Contract | Until you unpublish (the link is erased then), delete the trip or delete your account |
| Reports of a published trip: the reason, the details and contact email the reporter chooses to write, their account if they are signed in, and a keyed, non-reversible fingerprint of their network address | Review reports, prevent abuse and answer notices | Legitimate interest / legal obligation | Until the report is resolved, then 12 months; the link to a reporter's account is removed if they delete it |
| Your choices about showing your own photos in published trips: for each photo, shown or not shown, and when you decided | Show only the photos you agreed to show, and stop showing them when you change your mind | Contract (your choice) | Until you change it; a choice to show ends by itself when the trip is unpublished, opened up to everyone, handed to another owner, or you leave it; all go with the photo, the trip or your account |
| Your Featured Photos: which of your photos, their order, and when you confirmed showing a photo that was not already public | Show them on your public profile | Contract (your choice) | Until you remove them; a photo you move to the Trash leaves your Featured Photos at once; all go with the photo or your account |
We do not use analytics or advertising cookies and do not share your data for advertising.
Your trips are private to you until you invite someone (they are then visible to the people you invited, with the role you give them) or until you yourself publish one. Publishing is always your explicit choice, one trip at a time, and you can undo it: a PUBLIC trip can be opened by anyone and is listed on your public profile, and search engines may index it while your profile is public; a PRIVATE LINK trip can be opened only by people who hold its secret link, is not listed or indexed, and you can replace or revoke the link at any time. A published trip shows its title, description, countries, route (places, never exact coordinates) and day-by-day plan — including entries your co-travellers added — but never private notes, prices, booking links or references, exact coordinates or your co-travellers’ names. Dates of a trip that has not finished are never shown publicly; for a finished trip you choose exact dates, month and year, or none. If you make your profile private, your public trips are hidden again (and return with the profile, without republishing); private links keep working until you revoke them. Stop and activity coordinates and notes are shared with the trip’s members; your photos’ own location is never shared (see below). Place search runs on our servers against a built-in open dataset (Natural Earth): what you type is not stored and is not sent to any other company. If the operator turns on online place search (not the default), the text of your search — without your name, email or account — is sent from our servers to that provider (currently OpenStreetMap Nominatim), which may log it under its own policy; we would then say so here. Deleting a trip is recorded in the security log with only the number of stops.
A country counts as visited if you marked it yourself or if one of your past (or begun) trips has a stop there, or a visit you recorded there for a day that has arrived — a day trip across a border counts without an overnight stay. Only the country you confirmed is used; it is never worked out from a photo. A person who only views a shared trip gets no visited country from it. Planned, future trips and days never mark a country as visited.
Your photos are private to you. A photo you place on a trip you share can be seen by the other members of that trip as a picture (the thumbnail and display copy), and nothing more — never the original file, its file name, where it was taken or its camera details; they cannot move, delete or reuse it. Nobody else can make your photos public: a photo only becomes visible outside a trip by your own choice. In a trip you publish, that is the photo you set as its cover and — if you turn on photos — your photos placed on it, any of which you can hide. In a trip someone else publishes, only the photos you choose to share there, which you can stop sharing at any time; they also stop being shown by themselves if that trip is unpublished, opened up to everyone after being shared by link, or handed to another owner, or if you leave it, and you are asked again. On your public profile, only the photos you choose as Featured Photos (up to 12), after confirming each one that is not already public. Visitors get display copies only — never the original, where or when it was taken, its camera details or its file name — and your name is never shown next to your photo on someone else’s trip. A Featured Photo is shown without its trip, place or date. Viewers cannot add photos. If you leave a shared trip, your photos are taken off it and stay in your library. The original file is kept in private storage and is never served publicly; every time a photo is shown, the request is checked against your account first. Thumbnails and display copies contain no embedded metadata. Where a photo was taken (GPS) is precise personal data: it is used only to suggest where the photo belongs, is only ever shown to you, and is never written to logs or the security log. The country of a photo is worked out on our own servers from an open dataset; photo coordinates are not sent to any map or geocoding company. Duplicate detection compares fingerprints of your own uploads only — nothing is compared across accounts. Deleting a photo deletes the file, its copies and its links to trips; deleting a trip keeps its photos in your library.
We do not currently scan uploaded files for malware, and we do not use your photos for advertising, to train models, or for face recognition. To choose the site language we read the language your browser sends and, if that is not enough, the country reported by our hosting network (not stored); we never ask your device for its location.
Your visited countries are private unless your profile is public: a public profile shows your World map (visited countries and the country covers you chose) and your statistics to anyone. Marking or unmarking a country is not written to the security log. The map is drawn from open geographic data (Natural Earth, public domain) that is served from ARREU's own servers, so viewing your map sends nothing to a map provider.
Your profile. Your profile is public or private, as you choose when you sign up and can change in Settings. Whatever you choose, signed-in people who look you up by username can see your username, display name and bio; a private profile shows nothing else. A public profile also shows your links, avatar, cover, World map, statistics and public trips to anyone, including people who are not signed in and search engines. Profile search finds usernames and display names. Making your profile public asks for your explicit confirmation each time.
Reports. Anyone, signed in or not, can report a published trip. The trip's owner is never told who reported it. We keep the report and the fingerprint described above to review it, to stop abuse of the form and to answer a substantiated notice, and we may take a trip out of public view while we do. Reports are removed 12 months after they are resolved.
3. Not processed yet
ARREU is meant to grow into a place for shareable travel pages. Public profiles and the publishing of trips described above exist. Generated videos, bookings or payments, comments, likes, followers and any analysis of the people or places shown in your photos do not exist today and we process none of them. Before any other feature launches we will update this policy and ask for your acceptance. Your content will be private by default.
4. Who receives your data
We use infrastructure providers to host the Service, its database and the private storage that holds your photo files, acting on our instructions. [List of providers, their locations and safeguards — to be completed.] We do not sell personal data.
The other members of a trip you share are also recipients of what you put on it, as described above. They see your display name or, if you have none, a masked form of your email address (for example j***@example.com) — never your full address.
5. Transfers outside the EEA
[Any transfers and the safeguards used — to be completed once hosting is chosen.]
6. Your rights
You can, from Settings → Data & privacy or by contacting us:
- get a copy of your data in a machine-readable file, and a download of your original photo files (access and portability);
- correct your details (Profile);
- delete your account and its data (erasure) — immediate and permanent;
- opt in or out of marketing communications and optional cookies at any time (withdraw consent);
- object to or ask us to restrict processing based on legitimate interests.
You may also lodge a complaint with your data protection authority (in Spain, the Agencia Española de Protección de Datos).
7. What happens when you delete your account
Your account, settings, visited countries, trips with their stops, coordinates and routes, photos (original files, copies and their metadata), and record of accepted documents are deleted. We keep only anonymised security statistics (event type and time) that can no longer be linked to you, for the retention period above.
If you own a trip you share, deleting your account passes the trip to another member (the longest-standing collaborator, otherwise the longest-standing viewer) so the others keep it; a trip nobody else belongs to is deleted with your account. The activities and notes you added to someone else's trip stay on that trip, no longer linked to you, and your photos are deleted with your account. If you delete a trip you own, it disappears for every member, but nobody's photo files are deleted.
8. Children
ARREU is for adults (18+). We do not knowingly process children's data.
9. Changes
We publish each version with an effective date and ask you to accept material changes.