Privacy policy
1. Controller
The controller for the data processing in this app is Steffen A. Pfeiffer, Agencia Cada Día, Editorial Investigasteve, Apartado 3, E-15155 Fisterra, A Coruña, Galicia, España, email: steffen.pfeiffer.29966@gmail.com. You can contact this address with any questions about data protection.
2. Principle
The app works without advertising or analytics services. We use no tracking cookies and build no user profiles. Ads are only counted (views and clicks per day), without any link to a person.
3. Hosting and access data
The app runs at IONOS SE (Germany), which processes data on our behalf. When you open the app, the server may briefly store technical access data (IP address, time, requested file, browser identifier) in logs. Legal basis: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
4. Protection against abuse
To protect the app from overload and automated scraping, we store your IP address (for IPv6, the network range) together with the number and rhythm of requests. Conspicuous access may be blocked temporarily or permanently. Unremarkable entries are deleted after 7 days, the security log after 30 days; permanent blocks remain until they are lifted. Legal basis: legitimate interest in the security of the service (Art. 6(1)(f) GDPR). A blocked person can contact us by email.
5. Location
“Near me” and stamping use your device’s location only when you trigger them and your device allows it. For “Near me”, the coordinates are sent to our server to find places nearby; they are not stored. When you stamp with a pilgrim account, the location is stored with the stamp (see point 6).
6. Pilgrim account (voluntary)
Purpose: storing your pilgrim stamps so that you can view them, download them as a PDF and restore them after losing your device.
Data: email address (stored only as an irreversible check value and as a masked display, e.g. j***@mail.com); stamps with place, date, time and location (when stamping through a partner venue’s QR code, your device’s location if you allow it, otherwise the venue’s location); technical check notes, such as an unusual speed between two stamps; the time of your consent; when a code is requested, your IP address for a short time to limit abuse.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the account.
Retention: up to 12 months after your last stamp, then automatic deletion. Earlier on request: in the app under Pilgrim passport › Delete account (final deletion after 14 days, revocable until then) or by message to us (immediate deletion). Accounts without stamps are deleted after 90 days.
Recipients: no disclosure to third parties. The code email is sent through our web hosting provider IONOS SE.
7. Stamp photos (voluntary)
Purpose: you can photograph real pilgrim stamps and add them to your pilgrim account so that they appear in your PDF and your memory book.
Data: the photo, your details about it (name of the place or hostel, town), the time of upload and your choice regarding the stamp archive. The image is reduced in size and re-encoded before it is saved; location and device data that a photo may contain are removed in the process. Please photograph only the stamp, not people.
Stamp archive: only if you tick the box may you release the image for a shared stamp archive. The archive is published only after we have reviewed it; without the tick the photo stays private. You can change or withdraw the release at any time.
Storage: the images are kept on our server at IONOS SE in a non-public folder that only your signed-in account can access. You can delete every photo yourself; when the account is deleted, all photos are deleted as well.
Legal basis: your consent (Art. 6(1)(a) GDPR) by uploading and, for the archive, by ticking the box.
8. Diary notes (voluntary)
Purpose: in the pilgrim book you can write notes about your experiences on the way; they appear in your PDF and your memory book.
Data: your text, an optional place, the date of the note and your decision about use. Please do not write details about other people who would not want that.
Use for books and articles: only if you tick “This experience may be used for books & articles” may we use the note in our own books and articles; without the tick it stays private. If we use it, we name neither your account nor your e-mail address. You can withdraw the tick or delete the note at any time.
Storage: on our server at IONOS SE; deleting your account also deletes all notes.
Legal basis: your consent (Art. 6(1)(a) GDPR) by saving and, for the use, by the tick.
9. Contact and report form (voluntary)
Purpose: with the form you can draw our attention to a hint, for example a path closure or a closed hostel. With the same form you can also write us a message, ask a question or make a suggestion for improvement. We check the hint and, if it is confirmed, pass it on to other pilgrims – without your e-mail address and without your name.
Data: the chosen type of report, place, your free text, the language of the view and the time; optionally your e-mail address if we should reply to you; also a non-reversible check value of your device (calculated from the IP address; the IP address itself is not stored for this), used solely to protect against spam and mass submissions.
Transmission: the report is delivered to us by e-mail and is sent through the mail server of our hosting provider IONOS SE.
Legal basis: legitimate interest in checking hints and protecting against abuse (Art. 6(1)(f) GDPR); for the voluntary indication of your e-mail address, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Retention: as long as needed for checking and handling; afterwards we delete the report. On request we delete it earlier.
Please do not enter data of third parties or sensitive information in the free text.
10. Notifications (push)
If you allow notifications, we store the delivery address assigned by your browser, your language and the topics you chose. Delivery runs through the push service of your browser or device maker (e.g. Google, Apple, Mozilla). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your browser or device settings; addresses that can no longer be reached are deleted automatically.
11. Map
Your device loads the map tiles directly from tile.openstreetmap.org (OpenStreetMap Foundation, United Kingdom). The operator receives your IP address for technical reasons. Legal basis: legitimate interest in a working map (Art. 6(1)(f) GDPR).
12. Weather data
Our server fetches weather data from Open-Meteo.com. No data about you is transmitted, only the coordinates of places along the route.
13. Data stored on your device
The app stores settings (e.g. language), locally collected stamps and, if you are signed in, a sign-in token in your device’s local storage. These are not tracking cookies. You can delete this data at any time in your browser settings.
14. External content
Articles and images are loaded from steffenpfeiffer.es. Only when you open a link to services such as Substack or YouTube do their privacy policies apply.
15. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. You can also lodge a complaint with a supervisory authority, for example the Spanish Agencia Española de Protección de Datos (www.aepd.es) or the authority where you live.