Privacy Policy — GuideAway

The controller of your personal data is Magdalena Stefaniak.

GuideAway is an app with interactive educational walking routes on a map (iOS and Android). An account is needed to save progress and route access.

1. Data we process

  • Account: email, password (stored as a hash by the authentication provider), Google or Apple sign-in, display name, profile photo, language, date you accepted this policy and the terms.
  • Routes: unlocked routes, answers, scores, progress. We do not store your live GPS position on the server.
  • Location: on the device only, while you use the map, to unlock observation quizzes (about 150 m). You may refuse and use Trust mode. Basis: consent — withdraw it in system settings.
  • Camera / photos: profile picture only.
  • Diagnostics: in production, crash reports to Sentry (account UUID, app version, device data — not email or name) and short server logs (for example IP).

We do not process data for cross-app or cross-site advertising. We do not sell personal data. We do not knowingly collect children’s data; if a parent reports such an account, we will delete it.

2. Purposes and legal bases (GDPR Art. 6)

  • running the account, routes and progress sync — contract (Art. 6(1)(b)),
  • recording document acceptance — legal obligation and contract (Art. 6(1)(c) and (b)),
  • GPS location — consent (Art. 6(1)(a)),
  • profile photo — contract,
  • security and crash diagnostics — legitimate interests (Art. 6(1)(f)): operating and protecting the service.

3. Recipients

Data goes only to providers needed to run the service: Supabase (database, sign-in, files), Google (sign-in / Play), Apple (sign-in / App Store), Sentry (errors), hosting for guideaway.app (Seohost, Poland). Profile photos sit in a public bucket: anyone who knows the exact file URL can open it.

4. Transfers outside the EEA

Google, Apple and Sentry may process data outside the European Economic Area (including the United States). We use GDPR-compliant safeguards (standard contractual clauses or an adequacy decision).

5. Retention

Account, profile, progress and proof of acceptance — until you delete the account (longer only if the law requires it, for example a dispute). Logs and Sentry reports — typically up to 90 days. Deleting the account in the app removes the account, profile, avatar, route access and progress.

6. Your rights

You have the right of access, a copy, rectification, erasure, restriction, portability, to object to legitimate-interest processing, and to withdraw consent. Requests: support@guideaway.app.

You may complain to the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or to the authority in your EU country of residence.