Privacy

Controller and contact

The data controller is Pablo Rodríguez Garijo, an individual. Identification and address: Pablo Rodríguez Garijo, Albacete (España). Data protection contact: pabloroga6@gmail.com.

This information refers to the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

What data we process and why

• Account and access: email, name, user ID and avatar, and any profile details you choose to add (bio, phone, location, or website). These are used to identify you, manage access, and display your profile. Legal basis: performance of the service you request (GDPR Art. 6(1)(b)).
• Trip planning: trips, activities, bookings, tasks, expenses, budgets, notes, and alerts. Journal: entries, ratings, and photos. This data is stored to provide trip-planning and memory features. Legal basis: performance of the service (GDPR Art. 6(1)(b)). Do not include unnecessary sensitive information.
• Google sign-in, only if you choose it: InsForge receives the identity data needed to sign you in, such as email, name, and avatar. The legal basis for access in TravelPal is performance of the requested service (GDPR Art. 6(1)(b)). Authorization to the provider is handled on its OAuth screen; you can use email sign-in instead.
• Rights requests: identity, contact details, and request content, so we can respond and verify your identity proportionately. Legal basis: compliance with GDPR obligations (Art. 6(1)(c)).

We do not use your data for advertising or tracking analytics, or for automated decisions with legal effects.

Providers and recipients

InsForge provides the database, authentication, and storage backend. Cloudflare serves the static website as hosting and CDN. These services may process data needed to provide their functions; web requests include technical data such as IP address. Google acts as an identity provider if you choose its OAuth and also applies its own policy.

The backend is configured in the eu-central region of InsForge. Cloudflare serves the site through a global delivery network, so a request may be routed through facilities outside the European Union; both companies process data on behalf of the controller and under their published terms. If you need specific detail about this processing or about international transfers before using the application, write to the contact address above and it will be provided.

Your trip content is not intended to be disclosed to other users. Requests from authorities may be handled where there is a legal obligation.

Retention and deletion

Your content remains associated with your account while you use the service, until you delete it or request erasure. In Settings, you can download it and delete your own files and rows. Deletion is irreversible and may be partial if an operation fails; if so, you will be informed so you can retry.

The deletion feature currently signs you out but does not delete your authentication identity: your email, ID, and sign-in profile data may remain in InsForge. Contact the controller to request full erasure; this feature is not presented as permanent account deletion.

The sign-in identity (email, ID, and authentication profile) is deleted on request after verification, within the period stated in the previous section. Technical logs and provider backups (InsForge and Cloudflare) follow their own retention cycles, which the application cannot change; no other period is stated here without verification.

Your rights

You may request access, rectification, erasure, portability, objection, and restriction of processing where applicable. Send your request to pabloroga6@gmail.com, stating the right and your account email. Additional identity information will only be requested if necessary. Requests are handled within one month of receipt, which may be extended by two further months for complex requests, under GDPR Article 12.

In Profile, you can correct data; in Settings, you can export a JSON file containing your identity, profile, content, and files stored in TravelPal. Images stored only as external links are included as URLs. The file is downloaded to your device: keep it safe. Downloading does not delete service data.

If you believe the processing or handling of your rights is inadequate, you may complain to the Spanish Data Protection Agency (AEPD). See also its guidance on exercising your rights.

Cookies and local storage

We do not use tracking, advertising, or analytics cookies. Your chosen theme is stored in localStorage under the key theme. You can reset it in Settings or by clearing site data in your browser. The authentication SDK uses technical session cookies to keep you signed in; Google may use its own mechanisms when you choose OAuth.

There is no consent banner because the described storage supports requested sign-in and a chosen appearance preference without tracking. This assessment is based on the AEPD cookie guidance; it must be reviewed before adding uses or third parties that require consent.