Data Protection & Privacy (GDPR)

Contact: gdpr@ultreia.me

What data we collect

Casual visitors (no account)

Ultreia does not use cookies for tracking, does not use third-party analytics, and does not retain personal data for visitors who browse the map, view albergue or POI pages, or use the app without contributing. Map tiles are served from our own servers — no third-party tile providers are involved.

Contributors

When you choose to contribute (corrections, reviews, or photo uploads), we store:

  • Trail Name — your chosen public display name (required for credited contributions)
  • Email address — only if you provide one voluntarily, used to notify you when your contribution is reviewed
  • Contribution content — the correction, review text, rating, or uploaded photo
  • Photo EXIF data — GPS coordinates and date taken are extracted from uploaded photos to place them on the map. Other EXIF data (camera model, etc.) is not published.
  • IP address — stored temporarily for rate limiting and abuse prevention

We do not store passwords. Contributor identity is managed through a local device token and a recovery phrase.

How we use your data

  • Trail names are shown publicly on contributions (reviews, photo credits, leaderboard)
  • Email addresses are never shared, sold, or displayed publicly
  • GPS coordinates from photos are used solely to place them on the Camino map
  • Photos marked as "resharable" may be shared with open databases (Wikimedia, OpenStreetMap) with trail name attribution

Your rights

Under the GDPR, you have the right to access, correct, or delete your personal data.

To request your data or its deletion

Email gdpr@ultreia.me with:

  • Your Trail Name
  • Your email address (if you provided one)
  • Whether you want a copy of your data, or its deletion

We will respond within 30 days.

Content removal

If you believe a photo, review, or other content on Ultreia infringes on your rights, please contact legal@ultreia.me.

Data storage

Data is stored on servers within the European Union. Photos are served through a CDN (bunny.net, headquartered in Slovenia, EU). No data is transferred to non-EU jurisdictions.

Changes to this policy

We may update this page as features change. The current version is always available at guide.ultreia.me/gdpr.