Privacy & Security

Learn how we protect your data and keep your information secure.

Your Privacy Matters

At Vestigia, we take your privacy seriously. We believe you should have full control over your personal information and how it's shared. This page explains our practices and the tools available to protect your data.

Data We Collect

Account Information: Email, username, nationality, birthday, and profile details you provide.
Trip Data: Trips, itineraries, custom places, and notes you create.
Memories: Photos and location data you upload. EXIF/GPS metadata is stripped on upload to protect your privacy.
Usage Data: On the website, anonymous analytics may be used to improve the service. The Android app does not currently embed a third-party analytics SDK.
Location Data: Extracted client-side from photo EXIF to suggest tags or verify POIs. The raw metadata is removed prior to storage.
Billing Data: Checkout email and transaction metadata are passed securely to Stripe. We do not store credit card details.

Privacy Controls

Profile Visibility: Choose who can see your profile (Public, Friends, Private).
Trip Visibility: Control who can view your trips and itineraries.
Hide Sections: Hide achievements, friends list, or visited places from your profile.
Search Privacy: Control whether you appear in user search results.

Security Measures

Encryption: All data is encrypted in transit (HTTPS) and at rest.
Secure Authentication: Passwords are hashed using industry-standard algorithms.
Session Security: Automatic session expiration and secure cookie handling.
Two-Factor Auth: Optional 2FA for additional account protection (coming soon).

Your Rights

Data Access: Request a copy of all data we have about you.
Data Correction: Update or correct any inaccurate information.
Data Deletion: Delete your account and all associated data permanently.
Data Portability: Export your data in a portable format.

Third-Party Services

Map Provider: We use OpenStreetMap and MapLibre for maps (no personal data shared).
Authentication & DB: Supabase handles secure authentication and database storage.
Media storage: Travel photos are stored on our media origin (`media.vestigiatravel.app` / MinIO).
Payment Provider: Stripe handles Vestigia+ billing on the website. The Android app opens checkout in your browser — we do not use Google Play Billing for Plus today.
Push notifications (Android): Expo / Firebase Cloud Messaging delivers optional push alerts when enabled.
Weather (optional): OpenWeather may receive approximate coordinates to show map weather when configured.
3D Models (web): Sketchfab provides embedded 3D models of historical landmarks on the website.
Advertising (web): Google AdSense may serve display ads on the website under our cookie consent rules. The Android app does not currently ship AdMob production ads.
Travel affiliates (web): WeGoTrip, Jetradar, and Hotellook widgets may appear on the website. Vestigia+ hides affiliate widgets.
Event integration: Ticketmaster event suggestions and ticket links in itinerary planning.

Android App Notes

Precise location: Used for nearby landmarks, map follow mode, optional landmark-arrival chimes, and tagging memories — only with permission.
Camera & photos: Used to capture and upload travel memories.
Offline cache: Saved places, a limited landmark set, and queued memory uploads may be stored on-device for airplane-mode use.
No Magellan narration packs: The Android app does not download narrated audio city packs in the current release.
Account controls: Export your data or delete your account from Android Settings.

Managing Your Privacy

You can manage all your privacy settings from the Settings page. We recommend reviewing your settings periodically to ensure they match your preferences.

Go to Settings