Draft to be completed. The facts about data, providers and cookies were checked against the app’s code; the highlighted fields (controller, contacts, providers’ regions) must be filled in and the text reviewed before the public launch.

Privacy & Cookie Policy

Draft of 13 October 2026

1. Data controller

[Name or company, address, privacy contact email — to be completed]. For any request about your data, write to [email].

2. What we process and why

Browsing without an account — the map, countries, flights, hotel and attraction lists work without signing up. We use no analytics, advertising or profiling tools.
Account — email, password (stored by the provider only in hashed form), creation and last sign-in dates, the IP address of sign-ins in the provider’s security logs; with Google sign-in, also your Google name and profile picture. Profile: username, nickname, optional profile photo (reachable through a public link). Synced preferences: language, currency, departure country, home airport. Saved trips. Legal basis: providing the service you asked for (GDPR art. 6.1.b). An account is needed for the demo hotel booking and the Pathwyr Guide.
Demo hotel booking — it is simulated: the name and email typed at checkout stay in your browser and are neither sent nor stored; card fields are never read. No payment, no real booking.
Pathwyr Guide — messages are sent to our server to produce a reply and are not stored. Replies are simulated today: no external AI service receives your messages.
Flight search — airports, dates and passenger ages are sent, through our server, to Duffel to get offers.
Security and usage limits — to protect the service from abuse we count requests per IP address or per account. The address or id is turned into a pseudonym (a keyed hash) before it is stored, and the counters delete themselves after a minute or a day. Legal basis: legitimate interest in security (art. 6.1.f).
Password check — when you choose a password we check the password against known breaches by sending Have I Been Pwned only the first 5 characters of its hash: the password never leaves your device.

3. Providers that receive data

Supabase — accounts, profiles, preferences, saved trips and profile photos (region: [to be stated]).
Upstash — pseudonymised security counters.
Cloudflare — hosting and content delivery (IP address and technical request data).
Google — only if you choose to sign in with Google.
Cloudflare Turnstile — when enabled, the anti-bot check on the sign-in and sign-up forms.
Duffel — flight search.
Map and data services, which receive your IP address and the area shown when your browser contacts them: OpenFreeMap (map), Amazon S3 (terrain relief), jsDelivr (relief imagery), OpenStreetMap’s Overpass servers (boundaries), Frankfurter (exchange rates), Have I Been Pwned (see above).

Some providers may process data outside the European Economic Area; where they do, the transfer relies on the safeguards the GDPR provides (standard contractual clauses or an adequacy decision). [Check the chosen providers’ regions and safeguards]

4. Retention

Account data is kept while the account exists. You can delete it at any time from Settings → Data & Privacy → Delete my account: profile, preferences, saved trips and photos are erased immediately. Security counters expire within 24 hours.

5. Your rights

You can ask for access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interest (GDPR arts. 15–21) by writing to [email]. A copy of your account data can be downloaded at any time from Settings → Data & Privacy → Download your data. You may lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali). The service is not intended for children under 14.

6. Cookies and local storage

Pathwyr uses only the technical cookies and local storage it needs to work. No analytics, advertising or profiling cookies and no third-party cookies — so no consent is required and no banner is shown.

Name	Type	Purpose	Duration
`sb-…-auth-token` (may be split into `.0`, `.1`)	technical cookie, first party	keeps you signed in; only created when you log in	up to 400 days, renewed while in use; removed on log out
`sb-…-auth-token-code-verifier`	technical cookie, first party	completes Google sign-in or email confirmation securely	for the duration of that sign-in
`pathwyr:theme`	local storage	chosen light/dark theme; only written when you change the setting	until you clear it in your browser
`pathwyr:language`	local storage	chosen site language; only written when you change the setting	until you clear it in your browser
`pathwyr:currency`	local storage	chosen currency; only written when you change the setting	until you clear it in your browser
`pathwyr:pinnedToolbar`	local storage	whether the toolbar is pinned; only written when you change the setting	until you clear it in your browser
`pathwyr:reduceMotion / reduceTransparency / textScale`	local storage	accessibility settings; only written when you change the setting	until you clear it in your browser
`pathwyr:mapColors`	local storage	custom map colours; only written when you change the setting	until you clear it in your browser
`pathwyr:layout:v1`	local storage	window layout; only written when you change the setting	until you clear it in your browser
`pathwyr:travelDocsFromCountry`	local storage	departure country for travel documents; only written when you change the setting	until you clear it in your browser

You can clear cookies and local storage in your browser settings; doing so signs you out and restores the default settings.