Privacy Policy

Who is responsible

Explore25 is the data controller. It is operated from Madrid, Spain. Privacy questions and requests can be sent to support@explore25.com.

Who may use Explore25

You must be at least 16 years old to create an account. If we learn that an account belongs to someone under 16, we will delete it and the associated personal data.

Data we handle

• Account and profile details including email address, username, display name, account identifiers, account creation date, and email confirmation status.
• Content and social activity including lists, list items, completion history, reactions, friendships, friend requests, activity-feed entries, recommendations, and sharing choices.
• Trip-planning content including cities, places, dates, notes, pasted recommendations, uploaded screenshots, and search input. Inputs used for matching or extraction are processed to answer the request. Saved results remain in your account until you remove them or delete the account.
• Settings and technical information including your selected or locale-derived viewing region, theme, authentication session, browser or app information, network information received by our providers, rate-limit records, and security logs.
• Website analytics after consent. PostHog receives a user UUID, username, display name, account creation date, pages, selected clicks, and product events. Google Analytics receives page and device usage information. Explore25 does not send your email address to either analytics provider.

Why we use the data

• To create and secure your account, provide lists and social features, process searches, run the trip planner, and honour your sharing choices. The legal basis is performance of the service you requested under Article 6(1)(b) GDPR.
• To prevent abuse, protect accounts, rate-limit requests, diagnose failures, and maintain the service. The legal basis is our legitimate interest in a secure and reliable service under Article 6(1)(f) GDPR.
• To comply with legal requests and data-protection obligations. The legal basis is Article 6(1)(c) GDPR.
• To understand website use through PostHog and Google Analytics. The legal basis is your consent under Article 6(1)(a) GDPR. You may reject or withdraw that consent without losing any core feature.

Visibility and sharing

Your account, profile, friendships, activity, and media lists require sign-in. Shared media lists are available only to accepted friends. Public media links may show catalogue information about a movie, show, or book without showing the list owner or other user identity.

Do not add personal or confidential information to content you share with friends. A friend may copy or record information they can see.

Services that process data

• Supabase provides authentication and the main database. Vercel hosts the website and API. Upstash supports rate limiting and short-lived operational controls.
• Cloudflare Turnstile performs security checks during sensitive account actions.
• PostHog EU and Google Analytics provide optional website analytics after consent.
• TMDB, Google Books, Google Places, and Google Maps provide media, book, place, map, image, and availability information. Search terms and the information needed for a request may be sent to the relevant provider.
• OpenAI may process bounded trip-planning text or images to extract candidate places. Provider facts are verified separately before they are saved.

Images loaded directly from TMDB, Google Books, or another catalogue host cause your browser or app to contact that provider, which will receive ordinary network information such as your IP address and user agent.

International transfers

We favour European hosting where available, including PostHog EU. Some providers may process data outside the European Economic Area. When required, those transfers rely on an adequacy decision, Standard Contractual Clauses, or another safeguard recognised by EU law. Provider privacy terms also apply to their processing.

How long data is kept

• Account content is kept while your account is active and removed from active systems when account deletion succeeds.
• Security and operational records are kept only as long as needed to protect and diagnose the service, normally no longer than 30 days unless an incident requires a longer investigation.
• Consented analytics events are kept for no longer than 14 months. Analytics identifiers and accessible cookies are cleared when you withdraw consent, while earlier processing remains subject to this retention limit and your erasure rights.
• Encrypted provider backups may retain deleted data for up to 30 days before automatic expiry. Backup data is not returned to ordinary product use.

Your choices and rights

You may ask for access, correction, deletion, restriction, or a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw analytics consent at any time through Cookie settings in the website footer. You can delete your account from Settings on the website or in the iOS app.

Send a request to support@explore25.com. We may need to verify that the request belongs to you and normally respond within one month. You may also complain to the Spanish Data Protection Agency.

Cookies and changes

The Cookie Policy explains necessary storage and optional analytics. We may update this policy when the service or its providers change. Material changes will receive a new date and, where required, a renewed choice.