Privacy policy

Who is responsible for your data

Folkroute is being built by Valeriy Sablin, a private individual in Croatia — there is no company behind it yet. He is the data controller for everything on this page. You can reach him about privacy at [email protected].

What we collect, and why

To run the pilot test, the Folkroute app and the sign-up form collect:

• The email address of your Folkroute account — so we can give you access to the pilot and reach you if something goes wrong with your test.
• An anonymous install ID — a random code tied to your copy of the app, not to your name.
• The steps you take in the app — viewing the catalog, opening a route, "buying" it, downloading it, starting the walk, finishing it, rating it. This tells us where people get stuck.
• Which version of a screen you saw — just a letter, like "A" or "B": during the pilot we test two small design choices (for example, two button colours), and we record which one you saw.
• Your answer if we show you a test price — some testers see a question like "would you pay €X for this route?" with no real charge. If you see it, we record your answer.
• Purchase records inside the app — which routes you "bought" (free during the pilot) and when, the same way any app remembers what you've unlocked.

What we do not collect: your location never leaves your phone. Folkroute uses GPS on your device to show you where you are and when you've reached the next stop on a walk, but those coordinates are processed on your phone only — the app does not send them to our server or to anyone else. We do not know, and cannot find out, where you actually walked.

We don't collect your name, phone number, home address, nationality or background. If you signed up through our testers form, that form (not the app) also asked for your first name and which city you're visiting from — that is handled by the form provider directly and described in the consent text on the form itself, not repeated here.

The pre-launch waitlist

Before the pilot itself, our waitlist form at /waitlist collects five things: your email address, your preferred language, whether you're a tourist, a local or a guide, the date you signed up, and the exact text of the consent you agreed to at that moment. Nothing else — no name, no IP address, no tracking, no cookies, no analytics on that page or in the emails it sends.

Signing up needs double opt-in: we send one confirmation email, and the request is only kept if you click the link in it within 3 days — an unconfirmed request is deleted automatically after that. Once confirmed, you can leave the waitlist and have your data deleted at any time with one click in any email we send, no account or login needed.

This data is stored on our own server in the EU, same as the rest of this page describes. Questions, or a deletion request outside of email, go to [email protected].

Why we process this data

Only to run and improve the pilot test: to see whether the app works, where people get stuck, and whether the way we price routes makes sense, before we show Folkroute to anyone else.

Who else sees it

• Our own server, hosted in the EU, is where this data lives. We don't use ad networks or third-party analytics — the events above go straight to our stand, nowhere else.
• Google Play sees your Google account email, because that's how closed testing works — Google needs to know who you invited to the test. That is governed by Google's own privacy policy, not this one.
• The sign-up form provider (the service we use to collect testers' applications) processes what you filled in on that form, under its own privacy policy. We will name the exact provider here once it is chosen and tell you if it is based outside the EU.
• Brevo, our email provider (based in France, in the EU), delivers the copy of a support request to us and keeps a record of what it sent. It only processes this because we told it to, under a data processing agreement, and never uses it for its own purposes.
• Brevo, our email provider (based in France, in the EU), also delivers the emails on this page that go to you directly — the acknowledgement of your support request, our reply to it, and the waitlist confirmation — and keeps a record of whether each one arrived. These emails carry an open-tracking pixel added by Brevo itself, which we do not use to build a profile of you; we have set it to anonymous mode, so an opened email is not linked back to your contact record. Brevo processes all of this only because we told it to, under a data processing agreement, and never for its own purposes.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

• If you applied to be a tester but weren't selected, we delete your application within 30 days.
• Pilot test data (the events and answers described above) is kept for 6 months after the pilot ends, then deleted or made anonymous.
• If you ask us to delete your account or your data sooner, we do it within one month, as described below.

Your rights

You can ask Valeriy Sablin at [email protected] to:

• see the data we hold about you,
• correct it if it's wrong,
• delete it,
• get a copy of it to take elsewhere,
• withdraw your consent to being part of the pilot at any point — this does not affect anything you did before withdrawing.

You can also delete your own account and export your own data directly in the app, under Settings → Account.

If you're not happy with how we handle a request, you can complain to Croatia's data protection authority, AZOP: azop.hr.

The legal basis for all of this

We only process your data because you agreed to it — by ticking the consent boxes on the sign-up form before joining the pilot (GDPR Article 6(1)(a)). You can withdraw that consent at any time, the way described above.