Privacy Policy

This page explains what personal data craiul.ro (the website and the phone apps) processes, why, on what legal basis, who we share it with and how long we keep it. It describes what the app actually does, not a template.

Who is responsible for your data

The data controller is the entity whose identification details (name, tax ID, registered office) appear at the top of this page and in the website footer. For any question about your data, write to salut@craiul.ro. We have not appointed a data protection officer; we are not required to, and messages to the address above are read directly by the team.

What data we process and why

Your account

• What: your name, email address, password (stored only as a hash, which we cannot read), the language you use the app in, and your choice about notifications.
• Optional, if you fill them in: a profile photo, a public profile (public name and `@` handle), a phone number and links to Facebook, Instagram or TikTok. The public profile is off until you turn it on. Your phone number is never shown publicly.
• Why: so you can have an account, keep your favourites, lists, visits and badges, and receive account emails.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR), namely the terms you accept when you create the account.

If you sign in with Google, Facebook or Apple, we receive only your name and email address from them. We do not ask for your friends list, photo or anything else. With Apple you can hide your real address ("Hide My Email"): we then receive a forwarding address from Apple, and our messages reach you through it.

What you publish: reviews, photos, lists, submissions

• What: reviews and ratings, photos, lists of places, reports and event submissions.
• How they appear: nothing becomes public without a moderator's approval. Your name appears next to your contributions only if your public profile is on. Otherwise they appear without a name.
• Legal basis: performance of a contract. Moderation relies on our legitimate interest (Art. 6(1)(f)) in keeping the guide clean and lawful.

Photos: before storing them, we strip the file's metadata (EXIF), including the phone model. If the photo contains where and when it was taken, we keep that separately and internally, so a moderator can check that the photo is really from that place. It is never shown or sent to anyone. Rejected photos are permanently deleted 30 days after the decision.

Event submissions (the form on the home page, no account needed) ask for your name and email. We use them only to ask you something if anything is unclear. They never appear on the site.

Claiming a venue

If you ask to manage a venue's listing, you give us your name, your role there, a phone number and, optionally, a message. We verify you by calling the venue's public phone number. Legal basis: steps taken at your request before giving you access (Art. 6(1)(b)).

Your device's location

We use it only when you ask: "near me" in search, the starting point of an itinerary and the map in the app. Your position is read once, when you tap. We do not store it in your account and we do not track where you go; the app has no background location access.

• A computed itinerary is kept in the server's memory for 5 minutes, with the starting point rounded to about 100 m, so it is not recalculated every time it is opened.
• QR check-in (app only) sends your position once, to check that you are within 150 m of the venue. The position is not kept; we keep only the fact that you visited the place and the date.

Legal basis: performance of a contract, at your request. You can revoke the location permission at any time in your phone's settings.

Notifications

• In the app and by email: email confirmation, password reset, the decision on a venue claim, removal of a profile photo. We do not send advertising or newsletters through your account.
• Push on your phone: after you sign in, if the system allows notifications, the app registers your device's push identifier. We send push notifications (event changed, new badge, photo rejected, etc.) only if you have turned on "Notifications" in your account. Without consent they appear only in the in-app notification list.
• Legal basis: contract for account messages; your consent (Art. 6(1)(a)) for push. You can withdraw it at any time in your account.

Usage statistics (only with your consent)

Only if you say "Yes" (the banner on the website or the step in the app), we use Google Analytics 4 on the website and Firebase Analytics in the app. We see which pages and screens are opened, what people search for (the text typed in search), what they do on listings (share, call, directions), plus the device type and the city or country, as estimated by Google. On the website Google sets the `_ga` cookies; in the app it uses an installation identifier.

• We do not use the data for advertising. Google Signals, ad personalisation and the phone's advertising identifier are off.
• We do not send account data (name, email) and we do not link statistics to your account.
• Google keeps the data for 14 months.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004). You can withdraw it at any time from "Cookie settings" (website footer) or Account → "Usage stats" (app). When you withdraw it, we delete the `_ga` cookies from your browser, or the statistics data on your phone.

Cookie details are in the Cookie Policy.

Security and operation

• Server logs (IP address, requested page, browser) help us detect attacks and errors. Application logs are kept for 14 days; web server logs are rotated automatically by size.
• Rate limiting: your IP address is used temporarily, in memory, to stop abuse (for example, too many sign-in attempts).
• Change log: records changes to content and to accounts (for example, your public name or profile visibility), with author and date. Entries are deleted after 2 years. Failed sign-in attempts to the admin and partner panels are recorded with the IP address.
• App errors go to Sentry, without email, name or IP address.
• Legal basis: our legitimate interest in keeping the service secure and working (Art. 6(1)(f)).

Who we share data with

We do not sell data and we do not share it with anyone for advertising. It is processed on our behalf, under a contract (data processing agreement), only by:

• the hosting provider, on whose servers in the European Union the database, photos and backups are stored;
• Resend (Resend, Inc.), which delivers account emails and email notifications, sent from its data centre in the European Union (Ireland);
• Sentry (Functional Software, Inc.), for errors, with data stored in the EU;
• Google Ireland Limited, for statistics (Google Analytics and Firebase), only with your consent;
• Expo (650 Industries, Inc.), which delivers push notifications through Apple (APNs) and Google (Firebase Cloud Messaging).

When you sign in with Google, Facebook or Apple, they act as separate controllers under their own policies. The maps, their labels, the website fonts and route calculation are hosted by us, so opening a map sends nothing to a third party.

We may also disclose data to public authorities, only when the law requires it.

Transfers outside the European Union

Google, Sentry, Expo and Resend are US companies (or have US parent companies). When data reaches them, the transfer relies on the EU–US adequacy decision (Data Privacy Framework), for certified companies, or on the standard contractual clauses approved by the European Commission.

How long we keep data

• Your account and everything tied to it: for as long as you have the account. When you delete it (Account → Settings → Delete account), deletion is permanent and immediate, with no waiting period. Reviews, photos (with their files), lists, favourites, visits, badges, notifications, venue claims and sessions all go. In the change log, the changes you made remain without an author, and the entries about your account are deleted.
• Database backups are made daily and kept for 7 days, so a deleted account disappears from them within 7 days at most.
• Website session: 2 hours of inactivity. With "remember me" (ticked by default) or when signing in with Google, Facebook or Apple, up to 400 days. App sign-in: 90 days.
• Rejected photos: 30 days after the decision.
• Event submissions (the submitter's name and email): for as long as the event exists in the guide.
• Change log: 2 years. Application logs: 14 days.
• Google Analytics statistics: 14 months.
• Email confirmation and password reset links: expire after 60 minutes.

Your rights

You have the right to access your data, have it corrected, erased, its processing restricted, and to data portability (a copy in a structured format). You can object to processing based on legitimate interest and you can withdraw your consent at any time, without affecting what was done before.

• Directly from your account: edit your data and profile, hide your profile, turn off notifications and statistics, delete your account.
• For anything else, including a copy of your data, write to salut@craiul.ro. We reply within one month.

If you are not satisfied with our answer, you can complain to the Romanian data protection authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28–30, Bucharest, www.dataprotection.ro, or to the authority in your EU country of residence.

Minimum age

You must be at least 16 to create an account. If you learn that a younger child has created an account, write to us and we will delete it.

Automated decisions

We do not make decisions based solely on automated processing that legally affect you. We do not build advertising profiles. Content moderation is done by people.

How we protect data

All connections are encrypted (HTTPS). Passwords are stored only as hashes. In the app, the sign-in key is kept in the phone's secure storage. Access to administration is limited to the team, by role.

Changes

When we change this policy, the update date at the top of the page changes. We announce important changes on the website or in the app before they take effect.

This is a translation. If it differs from the Romanian version, the Romanian version prevails.