DRAFT — for Jean's review. Not legal advice. Check it matches the final app and your legal entity/country (e.g. LGPD in Brazil, GDPR in the EU) before publishing.

Privacy Policy

Effective date: [DATE] · Controller: [Jean's full name or company], [address], privacy@easeabroad.app

EaseAbroad ("we") is a travel-guide app. This policy explains what data we process, why, and your choices. We do not sell your personal data and we do not show third-party ads.

1. Data we collect

• Account: name, email address, password (stored only as a salted hash), email-verification status.
• Location: your device's precise location while you use the map or a guided tour, to find nearby places and trigger tour stops. Location is sent to our server only as coordinates in a request for nearby places/tours; we don't store a location history linked to your account. Tour progress is kept on your device.
• Content you create: trips/itineraries, places you add, people you share trips with (their email), travel preferences, language and app settings.
• Purchases: subscription product, Google Play purchase token and order ID, status and expiry. Payments are processed by Google; we never see your card details.
• Usage counters: daily counts of AI insights/recommendations, to enforce free-plan limits.
• Diagnostics: crash reports and error logs (device model, OS version, app version, stack traces), and server logs including IP address, used for security and rate limiting.

2. How we use it

To provide the app (nearby places, guides, tours, trips, sharing), operate your account and subscription, keep the service secure and prevent abuse, fix bugs, and contact you about your account (e.g. verification and password-reset emails). Legal bases: performance of our contract with you, our legitimate interests (security, improvement), and your consent for location access (you can revoke it in your device settings).

3. Service providers

• Google — Google Play (billing), Google Maps SDK/JavaScript API (map display; Google may receive your IP and map viewport). Google Privacy Policy.
• Amazon Web Services — hosting and database.
• AI provider (OpenRouter and the model providers it routes to) — receives place names and public Wikipedia text to write guide narration. We don't send your name, email or account data.
• OpenStreetMap / Overpass, Wikipedia / Wikidata, Wikimedia Commons — public data queried by our server about places (not about you).
• Sentry — crash and error reporting.
• Email provider — sends account emails.

4. Retention

Account data is kept while your account exists. When you delete your account we delete your profile, trips, preferences, subscription record and usage counters immediately; backups and logs expire within 30 days. Cached public place information is not personal data.

5. Your rights and choices

You can access and edit your data in the app, export it on request, and delete your account at any time (in the app: Profile → Delete account). Depending on where you live you may also have rights to object, restrict processing, and complain to a data-protection authority (e.g. ANPD in Brazil). Contact privacy@easeabroad.app.

6. Security

Data is encrypted in transit (HTTPS) and at rest on our hosting provider. Passwords are hashed with bcrypt.

7. Children

EaseAbroad is not directed to children under 13 (or the minimum age in your country) and we don't knowingly collect their data.

8. International transfers

Our servers and providers may be located outside your country (e.g. the United States/EU). We rely on appropriate safeguards such as standard contractual clauses.

9. Changes

We'll post updates here and, for material changes, notify you in the app.