Data, photos and security in FARON

• The backend runs in Lovable Cloud, with Supabase as the underlying infrastructure.
• Core data is processed in Supabase's Ireland region (eu-west-1), within the EU.
• Exact backup and deletion periods depend on FARON's active supplier agreements; current information is available on request.

• You choose the photo in a standard file picker. FARON never scans or syncs your camera roll automatically.
• JPEG, PNG and WebP photos with a longest edge of up to 4096 px are uploaded without re-encoding.
• Larger JPEG, PNG and WebP photos are normally resized to 4096 px in your browser. JPEG is saved as JPEG; PNG and WebP as WebP.
• If image processing fails, the file may be uploaded without resizing, even when it exceeds 4096 px.
• HEIC/HEIF and DNG are converted locally to JPEG before upload. For DNG, an embedded JPEG may be used.
• The same upload path is used for overnight stays, stops, trip photos and galleries.

FARON can read EXIF metadata locally in the browser to suggest a place and date.

• Read locally: GPS position and DateTimeOriginal / DateTime.
• Stored as extracted database fields: coordinates (lat/lng), the date or time for the overnight stay or stop, the photographed day for trip album photos, and a boolean recording whether EXIF was used.
• Camera model, serial number, lens data and the full EXIF record are not stored as separate extracted database fields. These details may still remain in the stored image file.

FARON has no general metadata removal step. Photos uploaded without re-encoding retain their metadata, which may include GPS position, the date taken and camera details. Resizing or format conversion does not guarantee that all metadata is removed.

• User photos are stored in private Storage buckets (night-photos, stop-photos, trip-photos and replay-videos).
• Photos are displayed through signed URLs with a limited lifetime, normally one hour.
• Public buckets are reserved for marketing assets, blog images and email assets — never private trip photos.
• Sharing a trip is an active choice, not the default.
• An unlisted collection link contains only trips the owner has already shared and selected one by one.

• You.
• Travel companions on trips where you have granted them access.
• People with a shared trip link or unlisted collection link, limited to the trips you chose to share.
• Not other FARON users. Database Row Level Security and Storage policies prevent that access.

For shared trips, an edge function issues time-limited signed photo URLs. A collection page can only request the chosen cover photo for each selected trip. When sharing is disabled, new links stop being issued.

• The normal admin view does not display private user galleries; it only shows aggregated metadata.
• Full technical access exists through the Supabase dashboard and service role for the person responsible for development and infrastructure.
• That access is outside the ordinary app experience and should only be used when support, troubleshooting or operations require it.

• The deletion flow collects and removes Storage files from your own archive, including overnight-stay photos, stop photos, trip photos, replay videos and yearbooks.
• Database rows for your own travel archive are removed in the same flow.
• Content you added as a co-traveller to someone else's trip remains with the trip owner; technical author fields are transferred to the owner and the account link is removed.
• The authentication user is deleted last.
• Deletion is permanent in the active service; it is not a recycle bin.
• Exact backup and deletion periods depend on FARON's active supplier agreements; current information is available on request.

Deleting an account is different from moving one trip to the recycle bin. A trip in the bin can be restored for 30 days before permanent removal.