Timbrello

Privacy policy

Effective: 2026-11-14

This policy explains which personal data we process when you use the Timbrello app and this website, what we use it for, who we share it with, how long we keep it and what rights you have. Processing is governed by the EU General Data Protection Regulation (GDPR) and the Hungarian Act on Informational Self-Determination.

1. The controller

  • Name: [CÉGNÉV]
  • Registered office: [CÍM]
  • Company registration number: [CÉGJEGYZÉKSZÁM]
  • Tax number: [ADÓSZÁM]
  • E-mail (also for privacy matters): [EMAIL]

2. What data we process

  • Account data: e-mail address, name (if you give one), Google or Apple account identifier (if you sign in with it), interface and guide language, appearance setting, the state of your statistics consent.
  • Purchases: the store transaction identifier, the guide and language you bought, price and currency, time and refund status. We never see card details: payment is handled by Google Play.
  • Visits and journal: the place you visited, the date, your rating and your note.
  • Photos: the pictures you add to a visit. Each photo is re-encoded on your phone and again on our server, and all metadata (EXIF), including GPS coordinates, is removed. Photos are stored privately, only you can open them, through links that expire after a short time.
  • Tours: the state of the tours you start and the stops you have reached.
  • Device data: a device identifier created by the app, the platform, the app version and the token used for notifications.
  • Location: your precise location is only used while a tour is running in the foreground of the app, and only on your phone, to know which stop you have reached. We do not track you in the background, and we neither send nor store your location history.
  • Usage statistics: only with your consent. A pseudonymous identifier, events (for example which screen you opened), app version and language. We never send your e-mail address or name.
  • Crash reports: technical data when the app crashes (device type, system version, error message, app version), without personal data.
  • Contact: your e-mail address, your message, the language and your IP address (to filter abuse).
  • Website: for security, the server logs requests (IP address, time, browser). We only use a cookie with your consent (statistics). Your theme and consent choices are kept in your browser's local storage.

We do not collect your contacts, your advertising ID or your location history.

3. Purposes and legal bases

  • Performance of a contract (GDPR Art. 6(1)(b)): account, purchases, preparing and providing the guide, syncing between your devices, journal and photos, customer support.
  • Legal obligation (Art. 6(1)(c)): keeping accounting records.
  • Legitimate interest (Art. 6(1)(f)): crash reporting, service security, abuse prevention, server logs. Crash reports contain no personal data.
  • Consent (Art. 6(1)(a)): usage statistics in the app and on the website. You can withdraw it at any time: in the app with the Profile → Anonymous usage statistics switch, on the website with the Cookie settings link in the footer. Withdrawal does not affect earlier processing.

4. Processors and recipients

We use the following partners to run the service. Each has signed a data processing agreement with us and only receives the data it needs for its task.

  • DigitalOcean, LLC – servers, database and file storage, in an EU data centre.
  • Google Ireland Ltd. (Google Play) – purchases and payment, Google sign-in.
  • Apple Distribution International Ltd. – Sign in with Apple, where available.
  • RevenueCat, Inc. – verifying and recording purchases.
  • PostHog Inc. (EU cloud, Frankfurt) – usage statistics, only with consent.
  • Functional Software, Inc. (Sentry) – crash reporting.
  • ActiveCampaign, LLC (Postmark) – sending e-mails (sign-in codes, notifications).
  • Mapbox, Inc. – maps. When maps are downloaded, your IP address reaches Mapbox.
  • 650 Industries, Inc. (Expo) – delivering notifications.
  • Anthropic, PBC and ElevenLabs, Inc. – services we use to write and translate the guide texts and to produce the narration. They only receive data about places taken from public sources (buildings, historical facts) – never your personal data.

We only disclose data to authorities where the law requires it. We do not sell personal data or use it for advertising.

5. Transfers outside the EU

Some partners (for example RevenueCat, Sentry, Postmark and Mapbox) may also process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep data

  • Account, journal, tours and device data: until you delete your account.
  • Photos: until you delete the visit or your account.
  • Sign-in codes: valid for 10 minutes, then deleted.
  • Data export: downloadable for 7 days, then deleted.
  • Purchases: after account deletion, without name or e-mail address, for 8 years (Hungarian accounting law).
  • Support messages: up to 2 years after we answer them.
  • Server logs: up to 30 days; crash reports: up to 90 days.
  • Usage statistics: up to 12 months, or until you withdraw consent or delete your account.

7. Your rights

  • Access and portability: in the app, Profile → Download my data gives you a ZIP file (JSON data and your original photos); we e-mail you a download link valid for 7 days.
  • Rectification: change your profile in the app, or write to us.
  • Erasure: delete your account in the app (Profile → Delete account and data permanently) or on the Delete account page of this website.
  • Restriction and objection: you can object to processing based on legitimate interest.
  • Withdrawing consent: at any time, as described in section 3.

We answer requests within one month. Write to [EMAIL].

8. Complaints

If you think we have infringed your rights, please write to us first. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9; www.naih.hu) or with the data protection authority of your EU country of residence, or go to court.

9. Security

All connections are encrypted (HTTPS). Sign-in tokens and codes are only stored hashed, photos are kept in private storage and opened through short-lived links. The admin interface requires two-factor authentication.

10. Children

Children under 16 may only use the service with the consent of a parent or guardian.

11. Changes

If this policy changes materially, we tell you in the app or by e-mail. The current version is always on this page.