Privacy Policy

1. Data We Collect

When you create an account we store your email address, display name, and profile photo. During tour playback we use your device's precise GPS location to trigger audio waypoints and show your position on the tour map. Location is processed on your device during active tour sessions only — we do not track or store a history of your location, and we never access it outside of active tour sessions.

Content you choose to submit. We store what you post in the app, and who posted it:

• Travel journal — the photos you upload and the title, intro text and per-photo captions you write.
• Reviews — your star rating and review text for a tour. Reviews are public and shown with your display name and profile photo.
• Local events — if you or your venue post an event, we store its title, description, venue name, start and end times, the external link you provide, and any image you upload. Published events are public, including the image, which is served from a public address.
• Creator profile — if you sign up to publish tours, we also store your short bio, the languages you guide in, and your primary city, plus the tours you create. These are shown publicly on your creator profile and tour pages.
• Reports — if you report a tour or an event, we store the reason you selected, any details you add, and your account id, so moderators can act on it.

Lists you build. We store the tours on your wishlist, the events you save, and the cities you follow. Tours you download for offline use are not stored on our servers — they are saved only on the device you downloaded them to (see section 4).

If you purchase tours or subscribe, we store your purchase history (payment card details are handled by our payment processor and never touch our servers). If you arrived through a creator's share link or QR code, we store which link it was alongside the purchase, so we can pay that creator. To keep the app reliable, we collect crash and error diagnostics via Sentry; these reports may include device and usage information related to the error.

To know which tours people actually finish, we record anonymous playback statistics: which tour was started and how many stops were reached. These are tied to a random identifier generated in your browser's local storage — not to your name, email, account or IP address — and are never shared with anyone or used to advertise to you. Clearing your browser storage resets the identifier.

2. How We Use Your Data

• Provide and improve the Giro tour experience
• Publish the content you choose to post
• Review reports and moderate content posted by others
• Process purchases, manage subscriptions, and pay creators
• Send transactional emails (receipts, account security)
• Aggregate anonymous analytics to improve content quality

3. Data Storage

Your data is stored in Supabase-hosted PostgreSQL databases located in the EU (Frankfurt). All connections are encrypted via TLS. Passwords are hashed and never stored in plain text.

4. Cookies & Local Storage

Giro uses essential cookies for authentication sessions. If you open Giro through a creator's share link or QR code, we also set one first-party attribution cookie (giro_src) recording which link you came from. It lasts 30 days, cannot be read by JavaScript, and is used only to credit that creator if you later buy a tour.

We use browser local storage to save your playback progress, your downloaded tour data for offline use, and the random identifier behind the anonymous playback statistics described above. We do not use third-party tracking cookies.

5. Third-Party Services

We use a small number of service providers to run Giro:

• Supabase — hosting, authentication, database, and file storage (our data sub-processor; EU region)
• Paddle — payment processing (merchant of record)
• Sentry — crash and error diagnostics
• MapLibre / PMTiles and Stadia Maps — map tiles and walking routes (your approximate position is sent to compute routes)
• Nominatim (OpenStreetMap) — city and place search. Searches are relayed through our own servers, so what reaches OpenStreetMap is the text you typed, not your IP address.

These services process limited data as described in their respective privacy policies.

6. AI-Generated Content

Some tours on Giro include content generated with the help of AI (text and synthesized narration). AI-assisted content is always labeled as such in the app. Your personal data is not used to train AI models.

7. Your Rights & Account Deletion

You may request a copy of your data or correction of inaccurate information at any time by contacting us at the address below.

You can delete your account and associated data at any time from your profile settings in the app, or by visiting giro-one.vercel.app/delete-account. Deletion permanently removes your profile and profile photo, your journal entries and photos, your reviews, the events you posted together with any images you uploaded for them, your saved events, wishlist, and followed cities.

Deletion does not reach your device. Tours you downloaded for offline use stay in your device's storage until you remove them: open the Downloads screen and use the delete button on a tour (or swipe it left), or clear the app's storage / uninstall the app to remove all of them at once.

Two things are not removed from our servers. Records of purchases are retained where required for legal, tax, and accounting purposes, with your account id removed from them. Tours you published as a creator stay available to the people who bought them, under the distribution license in our Terms.

8. Contact

For privacy-related inquiries, email privacy@giro.tours.