Privacy Policy

1. Data We Collect

1.1 Location Data

The App requests device GPS coordinates to discover nearby points of interest. Location data is processed on-device and sent to third-party services only as described in Section 3. We do not store your location on any server we operate.

1.2 Crash & Performance Reports

The App uses Sentry (sentry.io) to collect anonymous crash reports and performance traces. These may include device model, OS version, app version, and stack traces. No personally identifiable information (name, email, precise GPS) is included in crash reports.

1.3 User-Provided API Keys

The App allows you to optionally enter API keys for third-party services (MapTiler, OpenRouteService, Cloud AI providers). These keys are stored locally on your device using encrypted storage (flutter_secure_storage) and are never transmitted to our servers.

1.4 Preferences & Settings

Your preferences (language, basemap choice, TTS voice, notification radius, etc.) are stored locally on your device. We do not collect or sync these.

2. Data We Do NOT Collect

• We do not create user accounts.
• We do not collect your name, email address, or phone number.
• We do not use advertising SDKs or tracking pixels.
• We do not sell, rent, or share any user data for marketing or advertising purposes.
• We do not operate any backend server that stores user data.

3. Third-Party Services

The App communicates with the following third-party services for its core functionality. Each service receives only the minimum data necessary.

3.1 Optional Services (User-Activated)

The following services are only contacted if you provide your own API key in the App's Preferences:

When you use these services, your data is subject to each provider's own privacy policy. We encourage you to review their terms before providing your API key.

3.2 External Links

The App may open links to Google Maps (for navigation), Wikipedia articles, or Google Search results in your device browser. These are standard deep links — no additional data is shared beyond what is visible in the URL.

4. Data Storage & Security

• All user data (preferences, cached discoveries, API keys) is stored locally on your device.
• API keys are stored using Android Keystore-backed encrypted storage (flutter_secure_storage).
• All network requests use HTTPS (TLS encryption in transit).
• We do not operate any server that stores user data.

5. Data Retention & Deletion

Since all data is stored locally on your device:

• Uninstalling the App removes all local data.
• You can clear the App's data from Android Settings → Apps → Surroundings → Clear Data.
• Sentry crash reports are retained on Sentry's servers according to Sentry's privacy policy and our configured retention period.

6. Children's Privacy

The App is not directed at children under the age of 13. We do not knowingly collect personal information from children. The App does not include age-gated content, in-app purchases, or advertising.

7. Your Rights

Because we do not collect personal data on our servers, there is no personal data for us to access, correct, or delete on your behalf. All data is under your direct control on your device. For Sentry crash data, you may contact us to request deletion.

8. GDPR Compliance

Under the General Data Protection Regulation (EU 2016/679) and the Italian Codice in materia di protezione dei dati personali (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018):

• No Data Controller/Processor relationship. Unlike apps that store user data on servers, Surroundings does not operate any backend server that stores or processes user data. We do not act as a Data Controller or Data Processor for your personal data beyond what is described in this policy.
• Legal Basis. The limited processing that occurs (Sentry crash reports, transmission of GPS coordinates to third-party APIs for core functionality) is carried out on the basis of legitimate interest (Art. 6(1)(f) GDPR): providing the location-based discovery service you explicitly requested by installing and using the App.
• Data Minimisation. We apply the principle of data minimisation (Art. 5(1)(c) GDPR). Only the minimum data necessary for each function is transmitted, and no personal identifiers are included in crash reports.
• No DPA Required. Because we do not store or process personal data on our servers on your behalf, no Data Processing Agreement is necessary for this App.
• Supervisory Authority. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.

9. International Data Transfers

Some third-party services used by the App (Sentry, Wikipedia, WikiData, Wikimedia Commons, CARTO) may process data on servers located outside the European Economic Area (EEA). These services operate under their own privacy policies and data protection commitments. When you optionally provide API keys for services such as Google Gemini, OpenAI, Anthropic, or Groq, your data may be processed in the United States or other jurisdictions under each provider's terms.

We do not directly transfer personal data outside the EEA. The GPS coordinates sent to these services for core functionality are not linked to any personal identifier by us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised effective date. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or the App's data practices, contact us at:

• Email: info@surroundings.otenz.it
• Website: https://surroundings.otenz.it