Privacy policy

1. Who is responsible

The controller of your data is YNot, the owner of Treep. For any privacy question, write to us from the contact page of the application.

2. What data we process

Only what we need for the application to work:

• Account: nickname, email address and password (stored encrypted, never in plain text), language and, if you provide them, birth date, nationality and city of residence.
• Profile: photo, bio, name, occupation and social network usernames, if you choose to add them. You control who sees them in Account settings > Privacy.
• Content you create: trips and their planning (destinations, stays, transport, activities, planned spending), blogs (with their language), reviews, posts and comments, souvenirs, favorite cities, followers, private messages and alert settings.
• Trip diary: the moments you save while travelling (photo, text, date and the visibility you choose for each one: only you, your followers or everybody; followers by default). Photos are downsized on your device before uploading, which normally removes the image metadata (such as the GPS location); still, avoid uploading photos with data you do not want to share.
• Achievements: the medals, points and level you earn, calculated from your own activity in the application. You choose who sees them in Account settings > Privacy.
• Sign in with Google (optional): if you choose to sign in with Google we receive from Google your name, your verified email and an identifier of your Google account. We do not receive your Google password nor store your Google photo, and you can disconnect it in Account settings > Connected accounts.
• Reports and incidents: if you report content or tell us about a problem, we keep the reason, the details you write and who sent it so we can review it. The reported person does not see who reported.
• Technical data: date of your last visit; and, if you tick “Remember me”, the IP address and browser of that device so you can see and close those sessions.
• Security records: temporary counters of sign-in attempts to prevent abuse.

3. Purposes and legal basis

To provide the service you asked for when creating the account (performance of the contract); to send you the emails that are needed (confirm an email change, recover the password, say goodbye when you delete the account); to keep the service secure and prevent abuse (legitimate interest); and to comply with the legal obligations that apply to us. You can turn off the application alerts and reminders at any time.

4. Who else receives data

We do not sell your data or use it for advertising. Some providers take part in the service:

• Server hosting and email delivery provider: they process the data needed to deliver the application and the messages.
• WeatherAPI (weather information): receives only the name of the city you look up.
• OpenAI (guidance texts about destinations): receives only the destination name and a generic question; it receives no personal data.
• Google (sign-in, only if you use it): when you click “Continue with Google” your browser goes to Google, which processes your data under its own privacy policy and may use its own cookies on its sign-in page. We only receive the data listed above.
• OpenStreetMap (map of your trip route): your browser downloads the maps from their servers, so they can see your IP address and the map area you look at. They do not receive your account or the content of your trip.
• Google Fonts and content delivery networks (jQuery, DataTables, jsDelivr): your browser downloads typefaces and interface libraries from them, so they can see your IP address.

5. How long we keep it

While you keep the account. If you delete it from Account settings, we erase your personal and private data immediately (including your trip diary with its photos, your achievements, your messages and the reports you sent); you choose whether your public content (blogs, reviews and comments) is deleted as well or kept anonymously as “Deleted user”. Backups are renewed periodically and the data disappears from them in that cycle.

6. Your rights

You can access and correct your data in your profile and in Account settings, and erase all of it with “Delete account”. To ask for restriction of processing or portability, or to object, write to us from the contact page. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Minors

The application is for people aged 16 or over. If we detect an account belonging to someone under that age, we will delete it.

8. Security

We store passwords with irreversible encryption, limit sign-in attempts, let you close remembered sessions and email you when someone asks to change the email of your account. Still, no system is infallible: if we discover a breach that affects you, we will let you know.

9. Changes to this policy

If we change something important we will update the date and version of this page and, when needed, tell you.