Draft for legal review. Fill in the details in [brackets] and have a lawyer check this policy before publishing.
Privacy Policy
This policy explains what data the Tourpod apps and services collect, why we collect it, who processes it for us and how you can delete it. "Tourpod", "we" and "us" mean [COMPANY LEGAL NAME], [REGISTERED ADDRESS], the controller of your personal data. Questions: privacy@tourpod.app.
Who uses Tourpod
- Guides create an account and run tours (events).
- Tourists join a tour by scanning the guide's QR code. Tourists don't create an account.
What we collect
| Data | Whose | What it is and why |
|---|---|---|
| Account | Guides | Name, email and password. We store the password only as a one-way hash (Argon2). Used to sign in and to identify your tours. |
| Tour content | Guides | Tours, descriptions, cover and content images, saved polls. Stored so you can show them during tours. |
| Event records | Guides and tourists | Event name, join code, start and end time, the display names of tourists who joined, questions, poll votes, ratings and reviews, and a timeline of the event (joins and leaves, breaks, shown content, polls, questions). Used to run the tour and to show the guide its history. |
| Display name | Tourists | The name a tourist types when joining, visible to the guide during the tour and in the event history. |
| Voice | Guides | The guide's voice is transmitted live to the listeners of the tour. We do not record or store the audio. |
| Live captions | Guides | Only when the guide turns captions on: the guide's audio is sent to OpenAI for speech-to-text, and the finished caption text is saved in the event timeline. Tourists on Android 13 or newer can also caption on their own phone; that audio stays on the phone. |
| Location | Guides and tourists | During an active tour, the precise location of tourists and of the guide, so the guide sees the group on a map and a tourist can walk back to the guide. Live positions are kept in server memory only while the tour runs. If a tourist taps "I'm lost", their name and last position are sent to the guide and saved in the event timeline. |
| Device and technical data | Guides and tourists | Push-notification token and platform, measured voice delay, audio output (speaker or headphones), IP address and server logs. Used to deliver notifications, keep audio working and protect the service. |
Caption translation runs on the tourist's phone with Google ML Kit. Language packs are downloaded from Google; the caption text is not sent anywhere for translation.
Legal bases
- Providing the service (contract): accounts, tours, live audio, captions, questions, polls and event history.
- Legitimate interests: security, abuse prevention, reliability and troubleshooting.
- Consent: location and notifications, through your phone's permissions. You can withdraw it in your phone's settings at any time.
Who processes data for us
- Cloudflare: real-time audio relay over the internet and website hosting.
- OpenAI: speech-to-text for live captions, only when the guide turns captions on.
- Google: Firebase Cloud Messaging (Android notifications), Google Maps (maps and walking routes), ML Kit language packs.
- Apple: push notifications on iPhone.
- [HOSTING PROVIDER]: our servers and database in [COUNTRY].
Some of these providers process data outside your country, including in the United States. We rely on [Standard Contractual Clauses / adequacy decisions] for these transfers. We do not sell personal data and we do not show ads.
How long we keep data
- Account and tour content: until you delete your account.
- Event records: until the guide deletes the event or the account.
- Live locations: only while the tour runs.
- Server logs: [30] days. Backups: up to [30] days after deletion.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict its use, and withdraw consent. Write to privacy@tourpod.app. You can also complain to your data protection authority.
Deleting your account
Guides can delete their account in the app (Settings → Account → Delete account) or on the web: see Delete your Tourpod account. This deletes the account and everything linked to it. Tourists have no account; their name, questions and votes are deleted together with the guide's event, or earlier on request.
Children
Tourpod is not directed at children under 13. Guides must be at least 18. If you believe a child has given us personal data, contact us and we will delete it.
Security
Data travels over encrypted connections (HTTPS/TLS). Passwords are hashed, and sign-in tokens expire. No system is perfectly secure, so please use a strong, unique password.
Changes
We will post changes on this page and update the effective date. We will tell you in the app about significant changes.
Contact
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: privacy@tourpod.app.