Globetta Privacy Policy
Contents
- 1. Who is responsible for your data
- 2. Summary
- 3. Data stored only on your phone
- 4. Account and cloud
- 5. Friends, chat, travel companions and community safety
- 6. Location
- 7. Maps, terrain, weather and trails
- 8. Premium subscription
- 9. Advertising (if enabled in your version)
- 10. Purposes and legal bases
- 11. Recipients
- 12. Transfers outside the EEA
- 13. Retention
- 14. Deleting your account and data
- 15. Your rights
- 16. Is providing data required? Automated decisions
- 17. Age
- 18. iOS permissions
- 19. Security
- 20. Our website globetta.org
- 21. Changes
Effective date: 11.11.2026.
1. Who is responsible for your data
The controller (Art. 4(7) GDPR) is the developer and seller of the Globetta app:
Daniel Makaov
Boschstraße 24/3/5
1190 Wien, Austria
Email: support@globetta.org
Hereinafter "we". Full seller details are in the legal notice (Impressum) at https://globetta.org/impressum and in the app under "Settings → About → Impressum".
We are established in the European Union, so the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) apply directly, wherever you live. We have not appointed a data protection officer, as Art. 37 GDPR does not require one for us. Please send any question to the email above.
2. Summary
- The app works without an account and mostly offline. Countries, trips, journal, photos, voice notes, documents, places, cities, the people you travel with and your log of days are stored on your phone.
- An account is optional. If you create one, our server (Supabase, Frankfurt, Germany) stores your email, profile, country marks, basic trip details and — if you use friends and chat — friend requests, friends and the text of your messages. Photos, journal, voice notes and documents are never uploaded.
- No third-party analytics or crash-reporting SDKs. We do not sell your data.
- Location is requested only after you tap a button that needs it, and only "While Using the App". The app never tracks you in the background.
- Map and terrain are loaded from external servers (OpenFreeMap, Mapterhorn), which see your IP address and the map area. Weather, air quality, trail routing and points of interest along a route are requested through our own server: those providers see route points, but not your IP address or account.
- Premium subscriptions are sold by Apple. We never see payment details; RevenueCat verifies subscription status.
- Ads (Google AdMob) appear only in the free version and only if ads are enabled in your app version. Personalised ads only with your consent (section 9).
- Your rights: access, rectification, erasure, portability, objection, withdrawal of consent, and a complaint to the Austrian Data Protection Authority (section 15). You can download your cloud data and delete your account directly in the app: "Settings → My Data & Privacy".
3. Data stored only on your phone
We do not receive this data. It is kept in the app's sandbox, protected by iOS.
| Data | What exactly | Does it leave the phone? |
|---|---|---|
| Country marks | status (visited, wishlist, planned), favourite, dates, notes, souvenirs, dishes, photos | when signed in, status, favourite, dates and notes are synced (section 4); photos, souvenirs and dishes are not |
| Trips | title, description, dates, status, countries; cities, route points and track, checklist, expenses, rating, impressions, photos; lodging in the route's cities (name, address), the chosen cover; a plan for each day, the departure time | when signed in, title, description, dates, status and countries are synced; route points are only sent in weather and trail requests (section 7); lodging, cover, day plans and departure time are not synced |
| Profile | name, username, bio, home country, avatar | when signed in, everything except the avatar is synced |
| Journal | text, mood, photos, voice notes, country, trip | no. "I'm OK" with a postcard — city, country and the photo from today's entry for the trip (no entry — a mini map) — goes only to the person you choose in "Share". Thoughts and dreams (the "Thoughts" tab) are stored the same way — only on the phone: they never go into "Share", PDFs, widgets or "On This Day", but they are included in the backup; if you turn a dream into a trip, only the trip's title, which you see and can edit, is synced when signed in |
| Photos | copies of the pictures you chose; reduced copies for the "Memory of the Day" widget; screenshots for "From a Screenshot" | no. The capture location (EXIF) is read on the phone. Copies for the widget are kept in a folder shared by the app and its widgets on this phone and are erased with "Hide Photos in Widget", when the subscription ends and on reset. Text in screenshots is recognised on the phone; the copies are deleted after reading |
| Documents | type, title, expiry date (passport, visa, insurance); for a visa — country, entry date and number of days of stay; the insurer's phone number; whose document it is — yours or that of someone in "My People" | no. The app never asks for or stores document numbers. You create and send the "Trip Folder" (PDF) yourself: it contains your documents and those of the people travelling, with the companion's name on their documents |
| Boarding passes | scanned and parsed on the phone; flights in "Flights" — from, to and day, from a scan or entered by you | no. Only route, date and flight number are kept; passenger name and booking code are discarded. Flights are not sent to the cloud; they are included in the backup |
| Places, cities, time capsules, friends' maps from QR codes | names, ratings, notes, letters to yourself; for a place picked from Apple Maps suggestions, its Apple Maps identifier | no. What you type in "Add Place" goes to Apple Maps for suggestions (section 7) |
| Companions and loved ones | names of the people you travel with, who went on which trip, their countries and years, voice stories | no: they are not sent to the server or included in trip links and QR codes. People's names, trips and countries are included in the backup you save yourself |
| Log of days and Schengen 90/180 | which country you were in on which days — from trips, cities with dates and your answers; the Schengen day count | no: not sent to the server or included in links; included in the backup. We do not ask for your citizenship; the count is a guide, not a decision of the border authorities |
| Regions of countries | states, prefectures and other regions you have visited | no; included in the backup |
| Moving from other apps | export files you choose: trip.json from Polarsteps, Timeline.json from Google Maps Timeline | the files are read on the phone and their copies are erased; only countries and years are taken from the Timeline. What is found is saved only after you confirm; the trips and marks created are synced when you are signed in, like any others (section 4) |
| Voice messages in chat | recording | no: only text goes to the server |
| Offline maps and route data | downloaded map areas, saved weather, elevation, trail | no |
| Settings | theme, globe style, walking pace | no |
Backups. If iPhone backup (iCloud or computer) is on, the app's data will most likely be included — this is an Apple service under Apple's terms. A file created via "Settings → Data → Save Backup" is created and shared by you, as are GPX, PDF and calendar files, the CSV table of days, the "I'm OK" postcard and friend cards.
Deleting. "Settings → Data → Reset All Data" erases countries, trips, profile, journal, cities, places, capsules, documents, friends' maps, people, the log of days, flights, region marks, the goal for the year and "Country of the Day" results, as well as photo and voice files, photo copies for the widget, saved route data, downloaded offline maps and files prepared for sharing (backup, cloud export, GPX, PDF, CSV table of days, calendar, share images of cards and posters, the "I'm OK" postcard); delivered "On This Day" notifications with photos are removed from Notification Center. Settings (theme, globe style, walking pace) remain — deleting the app removes them along with everything else. The reset does not touch cloud data: to delete it, delete your account (section 14).
4. Account and cloud
An account is needed for syncing between devices and for friends and chat. Without it the app works fully, except for these features.
What we store if you create an account:
- email and password. The password is stored only as a hash; we never see it;
- an internal account number (random identifier);
- profile: name, username, bio, country of residence;
- country marks: status, favourite, visit dates, notes;
- trips: title, description, dates, status, countries; a deleted trip is kept with a "deleted" flag so that the deletion reaches all your devices;
- subscription status (section 8);
- server logs: IP address, time, type and URL of the request, account number (sections 7 and 13);
- sign-in log: email, IP address, time and action — sign-in, sign-out, password reset (section 13).
Who can see it. Country marks and trips — only you. Your full profile — only you. Other users who search for you or open your card see your username, name and country; your bio is shown only to your friends and to people you sent a friend request to. Messages — only the chat participants.
Where. Supabase — database in the Frankfurt region (Germany, EU). Supabase acts on our behalf as a processor (Art. 28 GDPR).
Signing out and another account on this phone. Signing out does not erase data on the phone — use "Reset All Data" for that (section 3). If the phone still holds another account's data, the app first asks when you sign in: move it into this account (the previous account's profile — name, username, bio, photo — is not moved), erase it from the phone, or not sign in. Nothing is synced until you answer.
Emails. Email confirmation and password reset emails are sent by Supabase's email service on our behalf. The emails you send us for support or about your data, and our replies, are kept in Google Workspace email: Google also acts on our behalf, as a processor (section 11).
5. Friends, chat, travel companions and community safety
Chat and the travel-companion search are disabled in version 1.0; what is said about them below applies from the version in which they become available.
- Friends. Username and name are used to find a person and send a request. Requests and friend lists are stored on the server.
- Chat. The text of direct messages is stored on the server until you or the other person delete it or the account is deleted. Voice messages stay on the phones.
- Travel companions. A companion request (countries, dates, budget, pace, interests, description) and replies to it are stored on the server.
- Community rules. Before first using friends and chat you accept the rules; we store the date of acceptance.
- Text filter. Messages, usernames and bios are checked against a list of prohibited words — on the phone and on our server, without external services. Text containing such words is not sent.
- Blocking. A blocked person disappears from your friends, search, chat and companions, and you from theirs. We store who blocked whom.
- Reports. You can report a person, a profile, a message or a request. We store who reported, whom and what, the reason, your comment (up to 1,000 characters) and a copy of the content at the time of the report — username, name and bio, or the text of the message or request. The copy is taken by the server, not the phone, so it cannot be forged.
- Who reviews. We review reports ourselves, manually, within 24 hours. We receive a short notification of a new report via the Telegram messenger — only the type, the reason and the report number, without names, usernames or content; we view the details on our own server.
- Decision. We may remove content, clear a profile (the removed name, username or bio cannot then be restored as it was — we keep what was removed and when) or suspend access to friends and chat. We inform the person concerned of the decision and its reasons, and they can contest it by writing to us (Art. 16–17 of the EU Digital Services Act, DSA).
6. Location
- The app asks for "While Using the App" access only. There is no background access: when the app is closed or in the background, it does not determine where you are and does not record your movements.
- Your location is determined once and at reduced accuracy (city level) when you tap "I'm here", "Find me on the globe", "Draft for today" or "Locate me" on the "Weekend" screen. "Where I Am" on the detailed map also determines your location once, but more precisely — to about 100 m — to show your dot on the map. The system permission prompt appears only after such a tap.
- If permission has already been granted, the "On the road" and "Weekend" screens determine your location the same way, once, when opened, to show the distance from home and nearby suggestions. A new journal entry opened from the "Evening Line" notification also determines your location once, to put the city and country into the draft right away.
- "You Are Here". If permission has already been granted, the "Globe" tab determines your location when you open the app or return to it — at most once every 30 minutes — to notice that you are in a country that is not in your passport yet and to offer to mark it. The country is worked out on the phone from the built-in map, without the geocoder; the coordinates are not sent anywhere or stored. The country is marked only when you tap "Mark"; the card never asks for permission itself.
- "I'm OK". The row on the "On the Road Today" screen puts a city into the message: from the route or, if permission has already been granted, the city nearest to the location determined when the screen opened (on the phone, from the built-in list of cities; no new permission prompt), otherwise the country. You send the message and postcard yourself via "Share"; they contain no coordinates and no map link.
- A route on the detailed map. After you tap "Start Route", the app determines your precise location continuously, every few seconds — but only while the detailed map with that route is open on screen: this is how it shows how far you have come and which points are behind you. Once you close the map, put the app in the background or finish the route, your location is no longer determined. Locations are processed only on the phone and are not sent anywhere; your path (track) is not recorded. The phone keeps only the state of the route: that it has started, how many kilometres are done and which points are ticked off. To erase it, tap "Done" in the route summary or use "Reset All Data".
- To name the country and city, coordinates are sent to Apple's geocoder (a standard iOS service) under Apple's terms. Offline, the country is determined on the phone. "Where I Am", routes on the detailed map and "You Are Here" do not use the geocoder.
- We do not receive or store coordinates. Only what you confirm is saved: a country mark, the city and country in a journal entry.
- To revoke access: "iOS Settings → Privacy & Security → Location Services → Globetta".
7. Maps, terrain, weather and trails
Directly from your phone. The detailed map and terrain are loaded from external servers. They see your IP address, the request URL (which reveals the map area and zoom) and device data from request headers (iOS version). Your email and account number are not sent.
- OpenFreeMap (tiles.openfreemap.org; Hungary, delivered via Cloudflare) — street map, fonts and icons, offline maps.
- Mapterhorn (tiles.mapterhorn.com, delivered via Cloudflare) — terrain; the same tiles are used on the phone to compute the route elevation profile. Logs are kept for up to 30 days according to their policy of 07.07.2026.
- Cloudflare — content delivery network in front of these servers.
Through our server. Weather, air quality, trail routing and points of interest are requested from our proxy — Supabase server functions in the EU region (Frankfurt, eu-central-1; the app pins the region in every request). The proxy forwards only the question itself — route points, dates, a route-name search — in its own name, without your IP address, device data, email or account number. For weather, points are rounded to about 2 km, for air quality to about 10 km. Identical answers are kept in a shared cache not linked to any person (keyed by a hash of the request): weather 3 hours, air quality 1 hour, route searches and the selected route 7 days, points of interest and trails 30 days; expired entries are deleted every hour (section 13). The proxy also keeps a daily cost counter per provider — no personal data, 40 days. So that no single source can use up the shared daily limit, the proxy counts paid requests per day from one address and, for signed-in users, from one account; signed-in users send their sign-in token to the proxy for this. The address and account number themselves are not stored — only a hash with a key that changes every day, plus the request count; these records are deleted after 2 days. The functions themselves log neither route points nor provider request URLs. However, the Supabase platform log records every function call: the URL of the call (for weather, air quality and trails it contains the exact route points), your IP address and, if you are signed in, your account number. These records are kept for up to 7 days and then deleted automatically (section 13). Route data is also cached on your phone until you delete it.
| Provider | What it receives | When |
|---|---|---|
| Open-Meteo (OpenMeteo GmbH, Switzerland) | rounded first route point and trip dates — for weather; up to 5 rounded points — for air quality | on the "Weather" tab of the route sheet and when you tap "Save for the hike" |
| Geoapify (KEPTAGO LTD, Cyprus) | route waypoints | when trail routing is on in the route sheet |
| Overspan (Miju Limited, New Zealand) — paid OpenStreetMap data server (Overpass) | a corridor of points along the route (about 300 m); a search for a known route by name | when points of interest along the route are on, or when you search for a route by name |
Place suggestions from Apple Maps. In "My Places" → "Add Place" on a country page, suggestions for the name come from Apple Maps search (MapKit): Apple receives the text you type and the area of the country being searched and processes them under its own terms as an independent controller. From the suggestion you pick, the phone keeps the name, city, kind of place and its Apple Maps identifier, so that "In Maps" opens exactly that place; we keep neither its coordinates nor its address. We do not receive your searches or places.
Links. Links to data sources and licences open in a browser, where those sites' terms apply. "Find an Embassy" in "In Case Something Happens" and "Directions in Maps" for your lodging open Apple Maps — with a search for your country's embassy near the trip's city (outside a trip, near the country's capital) or with the lodging address; Apple's terms apply from there.
8. Premium subscription
- The subscription is sold by Apple via the App Store. Only Apple sees payment details.
- Subscription status is verified by RevenueCat (RevenueCat, Inc., USA) on our behalf (processor). RevenueCat receives your internal account number (without an account — a random number created on the phone), purchase details from the App Store (product, dates, status, storefront country, price and currency) and technical data its module sends by itself: device model, iOS and app version, language. Like any server, RevenueCat also sees your phone's IP address. RevenueCat receives no advertising identifiers. We do not pass your email or name to RevenueCat. A purchase made without an account is linked at RevenueCat only to the random number and kept under RevenueCat's rules; to have it deleted, write to us at the email in section 1.
- Our database stores the result: whether Premium is active, product, store, period type (normal, trial, introductory), expiry date, whether it will renew, whether it is a test purchase, the last event. No payment data. Only you can see this record; only our server writes it, based on RevenueCat notifications.
- "Restore Purchases" and "Manage Subscription" are on the Premium screen ("Profile → Premium").
- Apple keeps your purchase history; we cannot delete it.
9. Advertising (if enabled in your version)
Ads are disabled in version 1.0. This section applies from the version in which they are enabled.
- The free version shows ads from Google AdMob (Google Ireland Limited, Ireland; Google LLC, USA). Premium removes ads.
- Consent (EEA, UK, Switzerland). Before the first ad, the app shows Google's consent dialog (UMP, a certified consent management platform). You can allow personalised ads, refuse, or choose purposes individually. To change your choice: "Settings → Ad Settings". Without consent, Google shows non-personalised or limited ads.
- Tracking (ATT). Google receives the device advertising identifier (IDFA) only if you tap "Allow" in the iOS system prompt. To change: "iOS Settings → Privacy & Security → Tracking".
- What Google receives: IDFA (only with permission), identifier for vendor (IDFV), IP address and approximate location derived from it, device model, iOS version, language, ad impressions and clicks, SDK crash data, your consent choice. For personalised ads Google is an independent controller under its own policy: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.
- App content (journal, trips, places, messages) is never passed to the ad network.
- Access to information on your device for advertising (§ 165 of the Austrian Telecommunications Act 2021, Art. 5(3) ePrivacy Directive) happens only with your consent; access needed for the app itself to work needs no consent.
10. Purposes and legal bases
| What we do | Data | Legal basis (GDPR) |
|---|---|---|
| Account, sign-in, syncing between devices | email, password hash, account number, profile, countries, trips | Art. 6(1)(b) — contract: you asked for this feature |
| Friends, chat, travel companions | username, name, requests, friends, message text, companion requests | Art. 6(1)(b) — contract |
| Community safety: rules, filter, blocking, reports, suspensions | date of accepting the rules, reports and content copies, blocks | Art. 6(1)(f) — legitimate interest in protecting users and the service; Art. 6(1)(c) — obligations under the DSA (Art. 16–17) |
| Weather, air quality, trail, points of interest via proxy | route points, dates, search text | Art. 6(1)(b) — contract: you requested information for your route |
| Map and terrain from external servers | IP, map area | Art. 6(1)(b) — contract; for the providers' own server logs — their legitimate interest |
| Locating you on tap and when the app opens ("You Are Here") | coordinates (on the phone; on tap also at Apple's geocoder) | Art. 6(1)(b) — contract; access to location — your iOS permission |
| Place suggestions from Apple Maps | the text you type, the area of the country | Art. 6(1)(b) — contract: you are looking for a place |
| Subscription | account number, purchase details | Art. 6(1)(b) — contract |
| Revenue accounting | Apple payout reports — no data about individuals | Art. 6(1)(c) — Austrian tax law (§ 132 BAO) |
| Server logs and the sign-in log | IP, time, request type and URL, account number; email in the sign-in log | Art. 6(1)(f) — legitimate interest in security and troubleshooting |
| Our website globetta.org (hosting by Cloudflare Pages) | IP, page address, browser data | Art. 6(1)(f) — legitimate interest in a working and secure website |
| Protecting the proxy against abuse | hash of the IP address or account number with a daily key, request count | Art. 6(1)(f) — legitimate interest in keeping external data available to everyone and costs under control |
| Personalised ads, IDFA (if ads are enabled) | see section 9 | Art. 6(1)(a) — consent; § 165 TKG 2021 |
| Non-personalised ads (if ads are enabled) | IP, device data, impressions | Art. 6(1)(f) — legitimate interest in funding the free version through ads |
| Answering your requests and emails | email, message text | Art. 6(1)(b) or (f) |
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR). Where it is based on legitimate interest, you have the right to object (section 15).
11. Recipients
| Recipient | Role | What it receives | Where |
|---|---|---|---|
| Supabase, Inc. | processor (Art. 28) | account, sync, chat, moderation and subscription data; runs the proxy; sends service emails (email address, email text) | database and proxy functions — Frankfurt, Germany; company — USA |
| RevenueCat, Inc. | processor | account number, purchase details, device data, IP address (section 8) | USA |
| Google (Google Workspace) | processor (Art. 28) | emails sent to us for support or about your data, and our replies: address, name, text | Ireland / USA |
| Cloudflare, Inc. (Cloudflare Pages) — hosting of globetta.org | processor (Art. 28) | when you open the website: IP, page address, browser data (section 20) | USA; servers worldwide |
| Apple (Apple Distribution International Ltd., Ireland) | independent controller | App Store purchases; coordinates for the geocoder; text of place searches (Apple Maps) | Ireland / USA |
| OpenFreeMap (via Cloudflare) | independent recipient | IP, map area | Hungary; Cloudflare — worldwide |
| Mapterhorn (via Cloudflare) | independent recipient | IP, map area | not stated by the provider; Cloudflare — worldwide |
| Open-Meteo | recipient via our proxy | rounded route points, dates (no IP, no account) | Switzerland |
| Geoapify (KEPTAGO LTD) | processor | route waypoints (no IP, no account) | Cyprus |
| Overspan (Miju Limited) | recipient via our proxy | route corridor, search text (no IP, no account) | New Zealand |
| Google (AdMob) — if ads are enabled | independent controller (personalised ads) / processor (restricted ads) | see section 9 | Ireland / USA |
| Public authorities | — | only where required by law | — |
You share data yourself when you show your QR card (name, username, countries) or share a collection, GPX, PDF or backup: these go directly to the recipient you chose, not through our server.
12. Transfers outside the EEA
Some recipients are US companies (Supabase, RevenueCat, Google, Cloudflare). Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the company is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the data processing agreements. Switzerland (Open-Meteo) and New Zealand (Overspan) benefit from adequacy decisions. You can request a copy of the safeguards at the email in section 1.
13. Retention
| Data | Period |
|---|---|
| On your phone | until you delete it or the app |
| Account and cloud data | while the account exists; deleted immediately with the account; in encrypted database backups for up to 30 days |
| Deleted trips (flag) | while the account exists |
| Chat messages | until deleted by the participants or while the sender's account exists |
| Reports and content copies | open — until decided; closed — 12 months after the decision, then erased. If the reporter or the reported person deletes their account, the report remains without a link to them |
| Blocks, date of accepting the rules | while the account exists |
| Suspension from social features | until we lift it or while the account exists |
| Profile cleared by a moderator (what was removed and when) | until we lift it or while the account exists |
| Supabase logs (IP, request type and URL, account number; for proxy calls — route points) | up to 7 days |
| Sign-in log (email, IP, time) | up to 30 days |
| Proxy cache (not linked to a person) | weather 3 h, air quality 1 h, route searches and selected route 7 days, points of interest and trails 30 days; expired entries deleted hourly |
| Proxy cost counter (no personal data) | 40 days |
| Proxy request counter per address or account (hash with a daily key only) | 2 days |
| Subscription record (ours and RevenueCat's) | while the account exists; deleted with the account; a purchase made without an account — at RevenueCat under its rules, deleted at your email request |
| Apple payout reports (no personal data) | 7 years (§ 132 BAO) |
| Support emails | 2 years after the last email in the conversation |
| External providers | under their own rules; Mapterhorn — up to 30 days |
14. Deleting your account and data
In the app: "Settings → Account → Delete Account".
- Immediately deleted: your account (email, password) and everything linked to it on the server — profile, countries, trips, friends, requests, blocks, chat memberships and your messages, companion requests, subscription record. Your RevenueCat customer record is deleted by the same action.
- The app then asks whether to erase the data on this phone too — the same as "Reset All Data" (section 3).
- Deleting your account does not cancel an Apple subscription. Cancel it in "iOS Settings → [your name] → Subscriptions", otherwise Apple keeps charging you. The app warns you about this.
- Data disappears from database backups within 30 days. The backups are encrypted; if the database ever has to be restored from a backup, we delete again any accounts that had been deleted.
- Deletion does not affect: copies held by recipients (messages on other people's phones, cards shared with friends), files you exported, iCloud backups, Apple's purchase history, server logs and the sign-in log, which are erased on their own schedule (section 13), external providers' logs, reports about you that are still under review.
Without access to the app — write from your account email to support@globetta.org. We will delete the account within one month at the latest, usually sooner.
15. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy (Art. 15). On the phone — "Save Backup"; from the server — "Settings → My Data & Privacy → Download My Cloud Data" (a JSON file). Sign-in records, server logs and reports filed against you are not in the file — we provide them on written request;
- rectification of inaccurate data (Art. 16) — in the app or on request;
- erasure (Art. 17) — section 14;
- restriction of processing (Art. 18);
- data portability (Art. 20) — backup, GPX and cloud export in open, machine-readable formats;
- object to processing based on legitimate interest (Art. 21), and to direct marketing at any time;
- withdraw consent at any time (Art. 7(3)): ads — "Settings → Ad Settings"; tracking and permissions — in iOS Settings;
- lodge a complaint with a supervisory authority (Art. 77). Ours is:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Vienna, Austria
dsb@dsb.gv.at · https://www.dsb.gv.at
You may also contact the authority in the country where you live or work.
Send requests to support@globetta.org. We respond free of charge within one month (Art. 12(3)); for complex requests this may be extended by two further months, and we will tell you so. To avoid disclosing data to someone else, we may ask you to write from your account email.
16. Is providing data required? Automated decisions
Providing data is not required: the app works without an account, and without a permission only the related feature does not work. An email address is needed to create an account; accepting the community rules is needed to use friends and chat.
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). The text filter automatically blocks messages containing prohibited words; only a human can suspend access to social features after reviewing a report.
17. Age
You must be at least 16 years old to use the app; the app asks you to confirm this when you sign up. We do not knowingly collect data from children under this age. If you believe a child has created an account, contact us and we will delete it.
18. iOS permissions
| Permission | Why | When asked |
|---|---|---|
| Location ("While Using") | where you are now: your country and city, your dot on the detailed map, progress along a route, a new country for "You Are Here" (section 6) | after you tap a button that needs it |
| Camera | scanning the barcode of a boarding pass (the image is processed on the phone and not stored); capturing moments for the Diary — the photo is stored only on the phone and goes to Photos or to other people only if you choose | on first scan or first Diary photo |
| Photos | adding pictures to countries, trips and entries; choosing screenshots of a country list for "From a Screenshot" | when choosing pictures |
| Microphone | voice notes, stories in "My People" and voice messages in chat; recordings stay on the phone | on first recording |
| Notifications | reminders about trips (before a trip — 8, 4 and 2 weeks, a week and a day ahead), documents, the length of stay on a visa and capsules; morning "On This Day" memories — with a photo of a trip or country, visible on the lock screen; optionally, the evening question and Schengen reminders from "My Days". Everything is scheduled on the phone and set up in "Settings → Notifications" | when you enable reminders |
| Tracking (ATT) — if ads are enabled | personalised ads (section 9) | before the first ad |
Without any permission the app still works, except for the related feature.
19. Security
All connections use HTTPS. Access to server data is restricted by database rules (row level security): everyone sees only their own data and what has been shared with them. Passwords are stored as hashes. Keys for paid providers are kept on the server, not in the app. Data on the phone is protected by iOS encryption while the phone is locked; the app adds no encryption of its own — which is why it never stores document numbers.
20. Our website globetta.org
The website globetta.org (this policy, the terms, support, the web map at /map/ and the page for shared links at /i/) is hosted on Cloudflare Pages (Cloudflare, Inc., USA), our processor (Art. 28). To deliver a page, Cloudflare necessarily sees your IP address, the address of the page and the technical data your browser sends (such as its version and language); Cloudflare also uses this data to protect the website from attacks. We do not keep visitor logs of our own.
- No cookies, no analytics, no tracking. The website sets no cookies, loads nothing from other servers and contains no analytics or tracking code.
- Web map /map/. The countries you mark and the name you enter are stored only in this browser (local storage, keys
globetta-map-v1andglobetta-map-name) and are never sent to us. To delete them, clear this website's data in your browser settings. - Shared links. In a shared link (/i/) and in a link to a friend's map (/map/), the content comes after the "#" sign. Browsers do not send this part of the address to the server, so neither we nor Cloudflare receive it: the page reads it in your browser.
21. Changes
We will announce material changes in the app before they take effect. If new processing requires consent, we will ask for it. The effective date is at the top of this policy.