Privacy and cookies

The data controller is Francesco Pagano. If you have any questions about privacy, you can write to [email protected].

• Browsing data: when you visit the site, the server logs your IP address, the page requested, the date and your browser type. We use this for security and to prevent abuse (for example, too many requests from the same address).
• Account: if you sign up, your email address. If you sign in with Google, we also receive your name, profile picture and the tokens needed to sign you in. For each active session we store the IP address and browser type to protect your account.
• Trips: the destination, the places you picked, your preferences (pace, interests, who you're travelling with) and the itinerary created. If you're signed in, the trip is linked to your account.
• Swipe choices: the places you like or skip and your latest preferences stay in your browser only (local storage) and are not sent to our servers until you create an itinerary.

• Providing the service (search, itineraries, account, sending the sign-in link): performance of the service you requested (Art. 6(1)(b) GDPR).
• Site security and abuse prevention: legitimate interest (Art. 6(1)(f) GDPR).

We don't use your data for advertising, we don't sell it and we don't build marketing profiles.

Some providers process data on our behalf or receive your IP address because your browser loads some content from them:

• Oracle Cloud: hosts the site and database on servers in Milan, Italy.
• Brevo (France, EU): sends sign-in and confirmation emails.
• Google: only if you choose to sign in with Google. Google may transfer data to the United States, with the safeguards of the EU-US Data Privacy Framework.
• OpenFreeMap: provides the itinerary map; your browser downloads map tiles from them.
• Wikimedia Foundation (United States): photos are loaded directly from Wikimedia Commons, so its servers receive your IP address.

External links (for example, the route on Google Maps) open third-party sites, which have their own privacy policies.

• Account and linked trips: until you delete your account.
• Trips created without an account: remain available at their link (which can be shared) and contain no data that identifies you.
• Browsing data: normally no longer than 30 days.
• Database backups: up to 6 months, after which they are overwritten. Deleted data disappears from backups within this period.

Swaypoint only uses technical tools that are necessary for the site to work, which don't require consent:

• a session cookie, which keeps you signed in after you log in;
• your browser's local storage, to remember your swipe choices, your latest preferences and the trips created before you signed in.

We don't use profiling, advertising or analytics cookies. The third-party servers your browser loads photos and maps from may set their own technical cookies, according to their own policies. You can clear cookies and local storage at any time in your browser settings.

You can ask at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) or object to processing based on legitimate interest. Write to [email protected].

You can also delete your account and all your saved trips yourself, from the “My trips” page.

If you believe the processing breaches data protection law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

The service is not intended for children under 14, who cannot create an account.

If we change the way we process data, we'll update this page and the date at the top. For important changes, we'll notify account holders by email.