This privacy policy applies to the website discovertrail.app. The mobile app is covered by its own policy: App Privacy Policy
This privacy policy explains how personal data is processed when you visit the website discovertrail.app and its language versions (the “Website”), including the route map that can be embedded on other websites.
Controller
The controller of your personal data is Averra Labs sp. z o.o., Trzebownisko 1035D, 36-001 Trzebownisko, Poland (NIP: 5170473964, KRS: 0001257164). You can contact us about anything related to your data at [email protected].
Server logs
Every time you open a page, our web server automatically records technical data: your IP address, the date and time of the request, the requested address, the referring page, and your browser and operating system. We use this data only to deliver the Website, keep it secure and fix errors. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The logs are kept only as long as needed for these purposes and are then deleted. Our hosting provider processes this data on our behalf.
Cookies and browser storage
The Website itself does not set cookies. It saves a few settings in your browser’s local storage. These entries stay on your device and are not sent to us:
- dt-consent – your cookie choice (accepted or declined);
- dt-lang – the language version you picked;
- dt-lang-dismissed – that you closed the language suggestion.
These entries are needed for the features you use, so they do not require consent. You can delete them at any time in your browser settings. Cookies set by Google Analytics are described below.
Google Analytics
We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how the Website is used, for example which pages are visited and how often the app store buttons are clicked. Google Analytics runs in Consent Mode, so what happens depends on your choice in the cookie banner.
If you accept cookies, Google Analytics sets the cookies _ga and _ga_DFN7NKE817, which expire after 2 years. They let Google recognise your browser across visits. Google then receives data such as the pages you visit, clicks on app store buttons, the referring page, your device type, browser, screen size and approximate location derived from your IP address. Google Analytics 4 does not store IP addresses. The legal basis is your consent (Art. 6(1)(a) GDPR).
If you decline or have not decided yet, no Google Analytics cookies are set. Google only receives cookieless signals that a page was viewed or a button was clicked, together with the technical data your browser sends with every request (such as IP address and browser type). These signals contain no identifier that links visits together. Google uses them to produce aggregated, modelled statistics. The legal basis is our legitimate interest in basic statistics about the Website (Art. 6(1)(f) GDPR).
Advertising features are switched off: we do not use the data for advertising or ad personalisation, and we do not share it with Google for those purposes.
You can change your choice at any time with the “Cookies” link in the footer. If you withdraw consent, the Google Analytics cookies are deleted straight away. Withdrawing consent does not affect processing that took place before.
Branch (app links)
If you open the Website on a computer after following a DiscoverTrail link (for example a shared route), the Website asks Branch Metrics, Inc. (USA) for that link so it can be put into the QR code. You can then scan it and open the same route in the app on your phone. For this, Branch receives your IP address, browser data and the link you came from, and may save session data in your browser’s storage. We do not use Branch for analytics or advertising on the Website. The legal basis is our legitimate interest in making shared links work across devices (Art. 6(1)(f) GDPR).
Embedded route map
Routes shared from the app can be shown as an interactive map, on the Website or embedded on other websites. To display it, your browser loads the route data from Google Firebase (servers in the EU), map libraries from the content delivery networks unpkg and jsDelivr, and map tiles from our server. These services receive your IP address and browser data, which is technically necessary to deliver the files. The map sets no cookies. The legal basis is our legitimate interest in displaying the map (Art. 6(1)(f) GDPR). The owner of a website that embeds the map is responsible for their own website.
Contact by email
If you email us, we process your email address, your name if you give it, and the content of your message in order to answer you. The legal basis is our legitimate interest in replying to enquiries (Art. 6(1)(f) GDPR), or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep the correspondence as long as needed to deal with your enquiry and any follow-up.
Links to other sites
The Website links to the App Store, Google Play, Discord and other sites. They are run by other companies, and their own privacy policies apply once you follow a link.
Recipients and transfers outside the EEA
Your data is processed by our hosting provider and by the services named above. Google and Branch may process data in the United States. Transfers to Google LLC are covered by the EU–US Data Privacy Framework. Other transfers outside the European Economic Area take place only with the safeguards required by the GDPR, such as the European Commission’s Standard Contractual Clauses.
Privacy policies of these providers:
- Google – Privacy Policy
- Google – How Google uses information from sites that use its services
- Branch – Privacy Policy
- Firebase – Privacy and Security
- jsDelivr – Privacy Policy
- UODO (Polish data protection authority)
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- have incorrect data corrected;
- have your data deleted;
- restrict processing;
- data portability;
- object to processing based on our legitimate interest;
- withdraw your consent at any time;
- lodge a complaint with a supervisory authority – in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa – or the authority in your country.
To exercise your rights, write to [email protected]. Providing data is voluntary, but without the technical data described above the Website cannot be displayed. We do not use automated decision-making or profiling that has legal effects on you.
Changes to this policy
We may update this policy when the Website or the law changes. The current version is always available on this page, with the date of the last update at the top.