Privacy policy

Alexander Döss, sole trader, Swedish registration number 980522-2313, Grönviken 261, 816 92 Lingbo, Sweden.

Contact: alexander@faron.se

Account data (legal basis: contract)

• For password-based sign-in, Supabase Auth handles your email address and stores only a salted bcrypt hash of the password. FARON does not store passwords in plaintext.
• Profile information you add yourself

Travel data (legal basis: contract)

• Logged overnight stays, stops and trips with place data you enter yourself
• Notes, tags and photos you upload
• Exported reports and yearbooks

Payment data (legal basis: contract)

• FARON stores subscription status, Stripe customer and invoice references, the amount paid, currency and payment time to administer subscriptions and reconcile payments. Stripe also processes payment details under its policy. FARON does not store card numbers.
• For gift purchases, the buyer's and recipient's names and email addresses, personal greeting, payment status, validity and redemption are stored to deliver the gift and prevent duplicate redemption.

Withdrawal notices (legal basis: contract and legal obligation)

• Name, agreement or purchase type, purchase email, agreement reference, acknowledgement email, locale, receipt time, status and acknowledgement-delivery status.
• The details are used to document, assess and answer the request. A short acknowledgement is sent to the chosen email address. Personal and purchase details from the notice are sent after address confirmation, or immediately if a valid signed-in session proves the same verified address. A hidden bot field and sending limits help prevent misuse. Confirmation status, a hashed verification token and email jobs are stored; the token may temporarily be present in protected email content. Account and buyer records are not searched to approve the acknowledgement address. Any purchase is checked during manual handling.

Product feedback (legal basis: legitimate interests)

• When you submit feedback, FARON stores the chosen category, the text you write, the current feedback milestone, the time and your user ID.
• Bug reports, requests and feedback with a written comment may trigger an internal push notification to current FARON administrators. If push cannot be used, the same information may be sent as an administrator email. A satisfied response without a comment is stored for summaries only. No travel data, photo, position, note or support diagnostics are added automatically.

Website analytics (legal basis: consent)

Only if you actively consent in the cookie banner, FARON collects:

• Page views, limited button and registration events, and random visitor and session identifiers
• Page path, referring domain, campaign parameters, travel interest and any partner link
• Blog analytics such as scroll depth and time on page
• Google Analytics 4 (measurement ID G-LG2CGMGKVB) for aggregated page and usage statistics. It is not used for advertising or remarketing.

FARON uses Basic Consent Mode. The Google tag is not created and no request or cookieless ping is sent to Google before an active yes on the device. A profile value never enables analytics on a new device. When consent is withdrawn, future hits are disabled and analytics storage is cleared where the browser permits.

FARON's own analytics never store an IP address, full referrer URL, user agent or free text. If an account is created, the visitor identifier may be linked to the account to measure the path from visit to registration.

Sharing and public links (legal basis: contract)

• Curated sharing displays the content you choose. Full sharing displays all stops and overnight stays with notes, reviews, ratings, weather, tags, accommodation type, places and every photo. The link does not provide account access.
• You can create a separate unlisted collection link with its own title and introduction and choose which already-shared trips appear there. Account name and email address are not displayed.
• Photos are delivered through time-limited URLs that expire after one hour.
• FARON counts views of shared links in aggregate without storing visitors' personal data; IP addresses, device information and cookies are not stored.
• You can disable sharing or change the collection link at any time, after which the old link stops working.

Invitations and travel companions (legal basis: contract)

• Invitations may contain an email address, inviter and recipient user IDs, status, timestamps and a single-use token.
• Favourite and recently used co-traveller addresses may be retained for your own choices. Reusable group links, connection requests and push notifications have their own statuses and timestamps.
• No automatic email is sent to the invited person; you share the invitation link yourself.
• Data is removed when it is no longer needed for the actual invitation, group or connection lifecycle. Content you added to someone else's trip remains with the trip owner after the account link is removed.

Technical operation (legal basis: legitimate interests)

• Strictly necessary cookies for authentication and session management
• Support diagnostics are shared only when you choose to do so under Profile → Support. They contain app and platform version, sync status, the number of local queue entries and stable error codes — never travel content, photos, notes or positions. You can revoke the diagnostic and it is deleted automatically after seven days.

FARON never shares data for marketing. The following services process data as part of providing the service:

• Lovable Cloud, with Supabase as the underlying infrastructure — accounts, database, storage and server functions. Core data is processed in Supabase's Ireland region (eu-west-1).
• Stripe — payment recipient and provider for subscriptions and gifts.
• Lovable Emails — underlying delivery of authentication and transactional emails. Brevo — marketing email only after opt-in.
• Google — user-initiated sign-in; Analytics only with consent; Fonts as an external resource.
• Esri — geocoding and maps. Geoapify/OpenStreetMap — secondary place search. Open-Meteo — external weather data. BRouter and OSRM — external routing services.
• OpenFreeMap/OpenStreetMap, Thunderforest and CARTO — external map and place-data sources.
• The browser's push provider — delivers push notifications when enabled; the provider depends on browser and operating system.
• User-initiated external links open the selected third party and do not give FARON control over that service's processing.

FARON uses Lovable Cloud with Supabase as the underlying infrastructure. Core data is processed in Supabase's Ireland region (eu-west-1), within the EU. Some providers and subprocessors may process data outside the EU/EEA under their applicable transfer safeguards. Contact FARON for a copy of the applicable transfer safeguard. Exact backup and deletion periods depend on FARON's active supplier agreements; current information is available on request.

• Account data and your own travel archive — while the account is active and then according to the technical deletion process. Co-traveller content in someone else's trip may remain without the account link.
• Payment data — FARON's payment events are retained while the account is active and deleted when the account is deleted. Separate accounting records held by Stripe or FARON may need to be retained for longer where required by law.
• Gift purchases — retained during the gift's three-year redemption period and afterwards for as long as accounting or claims requirements apply.
• Website analytics — aggregated continuously. Local analytics storage is cleared when consent is withdrawn where the browser permits.
• Support diagnostics — deleted automatically after seven days or earlier if you revoke them.
• Product feedback — deleted automatically after 12 months or immediately when the account is deleted. Administrator fallback emails already received follow the administrator's separate retention rule.
• Invitations and connections — according to status and actual lifecycle; ended records are removed when no longer needed for operations, security or disputes.
• Withdrawal notices — while needed to handle the request, demonstrate compliance and while a claim can be made.

Under the GDPR, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion; the right is not absolute and remaining co-traveller content is assessed separately
• Request restriction of processing
• Request data portability (an export of your data)
• Withdraw consent for website analytics at any time
• Object to processing based on legitimate interests
• Receive information about and a copy of the applicable safeguard for an international transfer

FARON's legitimate interests are security, abuse prevention, technical operations, support and product feedback. An objection is assessed against FARON's reasons for continued processing. You can delete your account from Profile; for other requests contact alexander@faron.se.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe your data is being handled incorrectly.