Privacy Policy

1. Controller

tripto.guide (the “Service”) is operated by Bartosz Kołodziej, sole trader, Łubowo 127, 62-260 Łubowo, Poland, Polish tax ID (NIP) 7842438640 (the “Operator”, “we”, “us”).

We comply with the Personal Information Protection Act of the Republic of Korea (PIPA) and, as an operator established in the European Union, with the General Data Protection Regulation (GDPR). For any privacy matter, write to [email protected]. You may write to us in Korean, English or Polish.

2. Key points

• You can browse attractions, the map and search without an account and without giving us any personal data.
• We do not sell personal data or share it with third parties for advertising. We use no advertising or marketing cookies and no affiliate tracking.
• We do not use third-party analytics or tracking services.
• The website server is in Germany and the database in Frankfurt am Main, Germany. As the Operator is based abroad (Poland), personal data is processed outside Korea — see section 8.
• The Service sells nothing and does not process payment data.

3. Data we process, purposes and how we collect it

We process only the minimum data needed for the following purposes. If a purpose changes, we will tell you in advance and ask for consent where required.

• Visiting the Service (everyone): IP address, date and time, requested URL, referrer, browser and operating system, error records — delivering the website, troubleshooting, security and abuse prevention (limiting excessive requests per IP address). Generated automatically when you connect.
• User account (optional): email address, password (stored only as a hash), user ID, registration and sign-in times, sign-in security logs (including IP address); when signing in with Google, the data Google shares according to your settings (email address, name, profile picture URL, Google account ID) — creating and managing the account, sign-in, security, account emails (address confirmation, sign-in link, password reset). Entered by you or received from Google.
• Saved places: without signing in, stored only in your browser (localStorage) and not sent to us; when signed in, your saved and visited places are stored in your account so they are available on all your devices (places saved in the browser before are carried over).
• Attraction reviews (signed-in users): rating (1–5), text, optional month of visit, creation and edit times, status and link to your account — publishing the review, automatic filtering of prohibited content, handling notices. Reviews show only a pseudonym such as “Traveller #1234”; we never publish your email address or name. Please do not include personal data in the text.
• Correction suggestions: the suggestion, the attraction and type of change, an optional email address for follow-up, time of submission — reviewing and applying corrections, replying if needed.
• Email enquiries ([email protected]): your email address, your name if given and the content of your message — answering enquiries, handling content notices and complaints.
• Search: your query is sent to our server to show results. To improve search we may store the normalised query, language, number of results and the clicked result, without IP address or any identifier. Your recent searches are kept only in your browser.
• Own usage statistics: simple events such as viewing an attraction, saving a place or running a search are counted without cookies, user identifiers or storing IP addresses (the IP address is used only briefly in memory for rate limiting) and are not linked to your account.

We do not collect resident registration numbers or other unique identifiers, sensitive data or payment data.

4. Location (“Near me”)

We use your device location only if you use “Near me” and allow location access in your browser. On the map, the coordinates are rounded to about 10 m and put in the page address to move the map; in search, they are sent to our server for that single search request to find nearby attractions. We do not store these coordinates in your account or in logs.

If you turn on location-based autoplay in an audio guide, your location is processed only in the browser on your device and is not sent to our server.

You can withdraw location access at any time in your browser settings; all other features work without it.

5. Audio guides

Audio guides on tripto.guide are free and can be used without an account or payment. We process no name, email address or payment data for audio guides.

Playback progress, selected language, playback speed and display settings are stored only in your browser (localStorage). If you choose “Save offline”, audio and page files are stored in browser storage (Cache Storage, service worker) and are not sent to us. They are removed when you clear your browser data.

6. Retention and destruction

• Server logs: as a rule no longer than 30 days. IP addresses used for rate limiting are kept in server memory only for a few minutes up to one hour. We keep data longer only where needed to investigate a specific security incident.
• Account data, saved places and reviews: until you delete your account or the data. After account deletion, only to the extent needed to deal with legal claims, until the statutory limitation period expires.
• Correction suggestions: as long as needed to review and document the change; we delete a contact email address immediately on request.
• Email enquiries: until the matter is resolved; where the correspondence may be relevant to legal claims, until the limitation period expires.
• Data in your browser: until you remove it or clear your browser data.

When the retention period ends or the purpose has been achieved, we destroy the data without delay. Electronic files are deleted so they cannot be restored; we do not keep personal data on paper. Data remaining in backups is deleted as the backups rotate.

7. Provision to third parties

We do not provide personal data to third parties, except where competent authorities such as investigative agencies or courts request it under a legal procedure.

Reviews are written for publication: the rating, text, month of visit, date and pseudonym are visible to visitors of the Service.

When you sign in with Google you use a Google service; Google (Google Ireland Limited, Ireland / Google LLC, USA) processes your data as a separate controller under its own privacy policy. We never receive your Google password.

8. Processors and transfers outside Korea

We entrust processing to the following providers, all of which are located outside the Republic of Korea. The Operator itself processes data in Poland (European Union).

• Bartosz Kołodziej (Operator, Poland) — operating the Service, answering enquiries, handling reviews and notices — all data described in this policy.
• Hetzner Online GmbH (Germany; data centres in Germany) — server hosting — server logs and all data transmitted while using the Service.
• Supabase, Inc. (US company; data stored in Frankfurt am Main, Germany, region eu-central-1) — database, authentication, account emails, file storage — account data, saved places, reviews, correction suggestions, search statistics.
• Cloudflare, Inc. (USA; global network) — domain (DNS), content delivery (CDN) and security, photo storage and delivery (R2, img.tripto.pl) — IP address, browser information, requested URL.
• Zoho Corporation B.V. (Netherlands; EU data centres) — receiving and sending email for [email protected] — email address, name, message content.

Timing and method: each time you use the Service or submit data, transmitted over an encrypted connection (TLS/HTTPS).

Retention: as set out in section 6; providers must delete the data when the contract ends.

Legal basis: these transfers are entrustment and storage necessary to conclude and perform the service agreement with you and are disclosed in this policy (PIPA Article 28-8(1)(iii)). Our contracts with providers impose data protection obligations (including processing agreements under Art. 28 GDPR); for US providers we rely on the EU-U.S. Data Privacy Framework certification or the European Commission’s standard contractual clauses.

If you do not want your data transferred abroad, do not create an account or submit data, or ask us to delete your account. As the Service is provided only from servers abroad, it cannot be used without such transfers.

Map tiles (OpenFreeMap, openfreemap.org) are loaded by your browser directly from its servers, which receive your IP address, browser information and the map area shown. Weather data (Norwegian Meteorological Institute, MET Norway) is requested by our server only with the rounded coordinates of the attraction, so none of your data is passed on. Photos are served from our own storage (img.tripto.pl); your browser does not connect to Wikimedia servers.

9. Your rights and how to exercise them

You may at any time exercise the following rights:

• access to your personal data,
• correction of inaccurate data,
• deletion (including deleting your account),
• suspension of processing and withdrawal of consent,
• refusal of, or an explanation about, automated decisions (we make no automated decisions with legal effect).

To exercise these rights, write to [email protected] from the email address linked to your account. A legal representative or an authorised agent may also act for you (with proof of authority). We act without delay, as a rule within 10 days, and tell you the outcome; if the law requires us to refuse or limit a request, we explain why.

When you delete your account, we also delete your saved places and your reviews.

Your rights under the GDPR (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) can be exercised the same way.

Please keep your data accurate and do not post other people’s personal data, e.g. in reviews.

10. Children under 14

Accounts are only for people aged 14 and over; we do not collect personal data of children under 14 without the consent of a legal guardian. If we learn that we have such data without consent, we delete it immediately — please tell us at [email protected].

11. Cookies and similar technologies

We use only cookies and browser storage that are necessary to provide the Service: the Supabase sign-in cookie (only after you sign in) and browser storage (localStorage) such as saved places and recent searches. We use no cookies for advertising, marketing or behavioural tracking.

You can block or delete cookies in your browser settings; if you block necessary cookies, some features such as sign-in will not work. The full list and retention periods are in the Cookie Policy.

Cookie Policy

12. Behavioural information

We do not collect behavioural information for targeted advertising and do not allow third parties to collect it on the Service.

13. Security measures

• encrypted transmission (TLS/HTTPS),
• passwords stored only as hashes,
• row-level access control in the database and minimal administrator access,
• rate limiting and automatic spam and link filters,
• data minimisation.

If a personal data breach occurs, we notify the affected data subjects and the competent authorities without delay as required by law (as a rule within 72 hours) and take steps to limit the harm.

14. Chief Privacy Officer

• Name: Bartosz Kołodziej
• Position: Operator (owner)
• Contact: [email protected]

The following person is responsible for personal data processing and handles enquiries and complaints:

15. Remedies

For advice or remedies regarding a privacy infringement in Korea you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

As the Operator is established in the EU (Poland), you may also lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the EU supervisory authority of your place of residence.

16. Changes

This privacy policy applies from 20 October 2026. We update it when features, providers or the law change and announce changes on this page 7 days before they take effect (30 days for changes material to your rights). Where new processing requires consent, we ask for it separately.

This policy is available in Korean and English; the Korean version prevails.