Privacy Policy

Trevurs ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use the Trevurs mobile application and website (collectively, the "Service").

By using Trevurs you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Information you provide directly

• Account data: name, email address, username, and password (stored as a one-way bcrypt hash — we never store your plain-text password).
• Profile data: optional avatar image and bio text you choose to add.
• Tour content: tour titles, descriptions, stop locations (latitude/longitude), text blocks, images, and audio recordings you create and publish.
• Comments & interactions: comments and ratings you leave on tours, likes, favorites, and content reports you submit.
• Support messages: name, email, subject, and message text you send through our support form.
• Legal consent data: date and version of Terms & Conditions you accepted, marketing email consent status, and your IP address at the time of registration — retained as an audit trail for legal compliance.
• Access codes & Premium plan: if you enter a referral or access code, we record the code and, if it grants a Premium subscription, the activation date and plan details.

1.2 Information collected automatically (mobile app)

• Login sessions: each time you log in we record your IP address and resolve it to an approximate country and city (via ip-api.com) for security and analytics purposes.
• App usage data: tours you start, complete, download, favorite, and interact with — used to compute creator statistics and personalize recommendations.
• Device & log data: IP address, device type, operating system, and app version collected via standard server logs.
• Location data: your approximate position while navigating a tour (to show you on the map). We do not store your precise location history on our servers.
• Push notification tokens: if you grant permission, we store a device push token together with your preferred language, country code, and platform (iOS/Android) to route notifications to your device. You can revoke permission at any time in your device settings.
• Advertising data: free-plan users see ads served by Google AdMob, which may collect device advertising identifiers and usage signals. Premium users do not see ads. See Section 9 for details.

1.3 Information collected automatically (website)

• Session cookie (tt_session): a randomly-generated identifier stored in a cookie for up to 365 days. It correlates your page views and clicks for internal traffic analysis. It does not identify you personally.
• Pageviews & events: pages visited, referrer URL, user-agent string, and IP address (resolved to approximate country) — stored in our own database, not shared with third-party analytics services.
• Link click tracking: when you click links on our public profile or "linktree" pages, we log the link clicked, traffic source, IP address, user-agent, and referrer. Used only for internal traffic analysis.
• Google Tag Manager: our website loads GTM (GTM-M4NCTS33), which may activate additional Google tags such as Ads conversion tracking. See Section 9 for details.

2. How We Use Your Information

• To create and manage your account and authenticate your identity.
• To display your published tours, profile, and creator statistics to other users.
• To personalize your experience (recommendations, language preferences).
• To track tour completions and calculate creator statistics.
• To respond to support requests.
• To moderate content and enforce community guidelines (including review of reported content and automated flagging of banned words).
• To send transactional emails: email verification, password reset, tour/place approval or rejection notices, and account deletion confirmation.
• To send push notifications about activity related to your account or tours — only if you have granted device permission.
• To send marketing emails with Trevurs news and offers — only if you have explicitly opted in at registration or via your account settings.
• To serve advertisements to free-plan users via Google AdMob.
• To maintain a legal record of your consent to our Terms & Conditions.
• To understand how the website and app are used (via our own analytics) so we can improve the Service.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with applicable legal obligations.

3. Sharing of Information

We do not sell your personal information. We share data only in these limited cases:

• Public content: tours, comments, ratings, and your username are visible to all users as part of the Service's core functionality.
• Resend (email delivery): your email address and message content are transmitted to Resend (resend.com) to deliver transactional emails on our behalf.
• Expo (push notifications): your device push token is transmitted to Expo's push notification infrastructure solely to route notifications to your device.
• Google AdMob: if you are on the free plan, the AdMob SDK communicates with Google's servers and may share device identifiers. See Section 9.1.
• Backblaze B2 (media storage): images and audio recordings you upload are stored on Backblaze B2 servers. Files are served via public URLs embedded in tour content.
• ip-api.com (geolocation): your IP address is sent to ip-api.com on login and on website visits to resolve an approximate country and city. No personal account data is shared.
• Google Maps: the mobile app uses Google Maps to display tour routes. When the map is visible, Google may process location and device data under Google's own privacy policy.
• Google Tag Manager / Ads: our website loads GTM, which may share interaction data with Google. See Section 9.4.
• Legal requirements: if required by law, court order, or to protect the rights, safety, or property of Trevurs or others.

4. Cookies

The Trevurs website uses two first-party cookies:

• tt_session — a random UUID valid for 365 days. Correlates your page views and events for internal analytics. Does not identify you personally. Set on all public web pages; excluded from /admin and API routes.
• admin_token — a short-lived JWT (24 hours) used exclusively to authenticate administrator sessions. Only present for admin users accessing /admin.

The mobile application does not use browser cookies. Authentication tokens are stored in your device's secure, encrypted storage (Expo SecureStore).

5. Data Retention

We retain your account data for as long as your account is active. When you request account deletion, your account is immediately removed from public view (soft-deleted). Underlying records may be retained for a period before permanent deletion to prevent abuse and satisfy legal obligations.

Tour content, comments, and associated media are retained while the account that created them is active. Support ticket records are retained for up to 12 months for quality-assurance purposes. Web analytics data (pageviews, events) is retained in our database indefinitely in aggregated form.

6. Security

We implement technical and organizational measures to protect your information: bcrypt password hashing (never stored in plaintext), HTTPS-only communication, HttpOnly cookies with Secure and SameSite flags, JWT-based authentication, rate limiting on sensitive endpoints, and role-based access controls. No system is 100% secure; we encourage you to use a strong, unique password.

7. Your Rights

Depending on your jurisdiction (including under the GDPR and similar laws) you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated personal data.
• Object to or restrict certain processing of your data.
• Withdraw consent at any time (where processing is based on consent), without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us through our support page. We will respond within 30 days.

8. Children's Privacy

Trevurs is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Third-Party Services & Advertising

9.1 Google AdMob

Free-plan users see advertisements delivered by Google AdMob (Google LLC). AdMob may collect device advertising identifiers (Android Advertising ID or iOS IDFA), IP address, and in-app interaction signals to serve relevant ads.

On iOS, we display Apple's App Tracking Transparency (ATT) prompt before enabling personalized advertising. If you decline, only non-personalized ads are shown. You can also change this preference later in your device settings:

• Android: Settings → Privacy → Ads → Opt out of Ads Personalization.
• iOS: Settings → Privacy & Security → Apple Advertising → turn off Personalized Ads.

Users on the Premium plan do not see ads — AdMob is not initialized for Premium sessions.

9.2 Expo (Push Notifications)

We use Expo (expo.dev) as push notification infrastructure. Your device token is transmitted to Expo's servers solely to route notifications to your device. Expo does not use this data for advertising. You can disable push notifications at any time in your device settings.

9.3 Resend (Email Delivery)

Transactional emails (verification, password reset, approval/rejection notices) are sent via Resend (resend.com). Your email address and message content are transmitted to Resend under a data processing agreement.

9.4 Google Tag Manager & Ads

Our website uses Google Tag Manager (GTM-M4NCTS33), which may load additional scripts including Google Ads conversion tags. These tags may collect interaction data and share it with Google. In addition, we run our own first-party analytics using the tt_session cookie (see Section 4).

9.5 Google Maps

The mobile app uses Google Maps (react-native-maps) to display tour routes and stop locations. When the map is visible, Google may process your location and device data under Google's Privacy Policy.

9.6 Backblaze B2 (Media Storage)

Images and audio recordings you upload are stored on Backblaze B2 servers (an S3-compatible cloud storage provider). Files are served publicly via CDN URLs embedded in tour content. Backblaze processes this data as a storage sub-processor.

9.7 ip-api.com (Geolocation)

When you log in via the mobile app, and when you visit our website, your IP address is sent to ip-api.com to resolve an approximate country and city. No personal account data is shared with ip-api.com — only the IP address. The result is stored alongside the session record for security and analytics purposes.

9.8 Other third-party links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices and encourage you to review their policies independently.

10. Marketing Communications

If you opted in to marketing communications during registration (or later via your account settings), we may send you emails about new features, tours, and offers from Trevurs. You can withdraw this consent at any time by:

• Clicking the "unsubscribe" link in any marketing email, or
• Contacting us through our support page.

Withdrawing consent does not affect any processing carried out before withdrawal. We will never share your email address with third parties for their own marketing purposes.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, where required by law, by notifying you directly. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact

If you have questions or requests regarding this Privacy Policy, please contact us through our support page.