Privacy policy

Who is responsible

GlobeTempo is an early-stage project run by its founder, Jędrzej Gołębiewski, who is responsible for your data (the “controller” under the EU General Data Protection Regulation, GDPR).

Postal address: ul. Haliny Poświatowskiej 22, 60-461 Poznań, Poland. NIP: 7812108234. For anything about your data, email founder@globetempo.com.

In short

• No third-party analytics or advertising trackers, and we never sell your data. We count how the service is used in totals that hold no identifier and are not linked to any day or account.
• The app works without an account. Once its location features launch, it reads your device’s location only with your permission, and sends us a point only when you ask to plan or update your day “from here”.
• A day you plan is kept until you delete it. Deleting it removes it from our database at once; copies in our backups are removed within 7 days.
• When accounts launch, the only contact detail an account holds is your email address.

This website

If you request an invitation to the private alpha, we collect the email address you type and, if you add it, your answer to “Where are you going next?”. We use it only to write to you when the private alpha opens and to decide whom to invite first. The legal basis is your consent, which you can withdraw at any time by emailing us; we then delete what we hold.

Requests are received and stored by Netlify, the company that hosts this website, whose form service also checks them for spam, and a copy of each may be emailed to the founder’s inbox. We keep them until invitations to the private alpha have gone out, or until you ask us to delete them, whichever comes first.

The website sets no cookies, runs no analytics and loads nothing from other companies’ servers. If you choose a theme, the choice stays in your own browser and is never sent anywhere. Like any web host, Netlify sees the technical details of each page request, such as your network (IP) address, in its own server logs.

Your days in the app

The app is in private testing and not yet open to everyone; this section describes how it handles data whenever you use it.

To build a day, the app sends our server what you enter: the city and date, your hours, limits such as budget and walking, your interests, and the places where you start, end or want to go. The server keeps the day, each version of it, and the changes you make, such as locking, swapping or skipping a stop and marking your progress. We use this to build your day, check it and repair it when plans change. The legal basis is providing the service you ask for (performance of a contract). The planner builds the day automatically, but it makes no decision with legal or similarly significant effects on you.

Day ratings (when they launch): when a day ends, the app asks you once to rate it from 1 to 5, and you may add a few words on why. Answering is optional: “Not now” skips it, and you can rate the day later from its screen or change your rating. The rating and your words are kept with the day. We use them to learn how well the planner served you and to improve it, which is our legitimate interest. They are deleted with the day, and with your account if it claimed the day, and your account’s download includes them.

When you replan, you tell it the stop you’re at or just left, and that choice is kept with the day. Once its location features launch, the app reads your device’s location only with your permission: on your phone, to follow your day’s progress and give its cues, and it sends us a point only when you ask to plan or update your day “from here”, as the next section explains.

Each day has a random link that works as its key: anyone who has it can open, change or delete the day, so share it only with people you trust. Without the link, only the account that claimed the day can find it; as the service’s administrator we can see the days on our server too, as “Accounts” below explains.

With each day, the server also records how the planner reached it: codes, counts, place ids and timings, never your own words or map coordinates. We use these records to check every plan, to improve the planner and to count how the service is used, which is our legitimate interest. They are deleted with the day; the daily totals described under “How we count use” stay.

Your location and the addresses you type (when they launch)

When we receive your location: only when you ask us to plan or update your day “from here”, by tapping a spot on the map, by pressing “Use my location” (the app then reads your location once, with your phone’s permission) or by picking an address you typed. We never collect your location in the background and never track where you go. Without your permission the app works with places you pick from the list.

What we receive: one point, rounded, when it reaches us, to about the size of a building (roughly 11 × 7 metres in Kraków), and how accurate your phone said it was. Nothing more precise is kept.

Why we keep it: so we can plan your day from where you really are, and check the plan again later, for example when you ask to update it. The legal basis is providing the service you ask for.

How long we keep it: for as long as you keep that day. We keep it with the day and delete it when the day is deleted, by you, by anyone with its link or by the account that claimed it; copies in our backups go as set out in the section “How long we keep it” below.

On your phone: if you open a day on your phone, the app keeps a copy for offline use, and that copy can include the point. “Forget on this device” removes it.

What we never do with it: your location never goes into our logs, our usage statistics or any analytics, and we never pass it to anyone else.

Addresses you type (when that launches): when you type an address, we look it up on our own server, in our own map of the city built from OpenStreetMap data. It is never sent to another company. We do not keep or log what you typed or the matches we showed; only the point you confirm is used, as if you had tapped it on the map.

On your device and in our logs

The app keeps in your browser: the list of days you have opened (up to 50) with a copy of each for use offline; your theme if you choose one; the city you last picked; how different you last asked a refreshed day to be; whether you hid the sample-city note; whether you have seen the setup screen’s explanations; once day ratings launch, which days you chose “Not now” for when asked to rate them; while you sign in, the page to return to; and, until you close the tab, how far you scrolled. It also keeps the app’s own files there, so the app opens without a signal; those hold nothing about you. All this stays in your browser; only what you use reaches our server, such as the city of a day you build, the “how different” choice of a refresh, and the days you add to your account. “Forget on this device” removes a day from the list.

Our server logs each request with a random request id, the day’s id when there is one, the result and how long it took. It does not log your network address, what you typed or any request header. The web server in front of it keeps no access log, but when a request fails, for example while the app’s server restarts or if you close the page before an answer arrives, the web server’s error log records that request, including your network address, the address requested (which can include a day’s link) and the request’s headers, such as your browser’s details. All these logs stay in the server’s system journal until it rotates them out. To keep the service available, the server may count recent requests per network address; those counts are held only in memory and are never written to disk. The legal basis for logs and counts is our legitimate interest in a secure, working service.

How we count use

We count how GlobeTempo is used, so we can see what works and what fails. Once a day our server adds up the previous day’s records into totals, and it keeps a running count of a few actions. Our admin console shows these totals.

The totals are counts per day and, where it applies, per city and per place: days requested, and whether a plan was found, found after you accepted a change, or not found; replans and their causes; stops planned, locked, unlocked, swapped, rejected, skipped or marked done; queue reports and the options picked; how long planning took; days saved to an account or opened again; once day ratings launch, day ratings by score; accounts created and deleted; sign-ins by method; account exports; and the server’s own errors.

The totals hold no day link, account id, email address, network address or device identifier. Nothing is stored on your device for this, no cookie is set and the app sends nothing extra: we count what the server does anyway. The admin console also shows today’s totals so far, refreshed about every 30 seconds.

Because the totals hold no identifier and are not linked to any day or account, they stay after a day or an account is deleted. No other company receives them. The legal basis is our legitimate interest in understanding and improving the service.

Accounts (when they launch)

Accounts are optional: every day works without one. An account holds your email address, the only contact detail it stores, beside random ids, timestamps, the days it has claimed and, if you use them, your passkeys and your Google account’s id. A day you plan while signed in becomes your account’s.

There are no passwords. You sign in with a passkey, or with a one-time link sent to your email. For a passkey we keep its public key, its id, technical details your device gives us and when it was created and last used; the private key never leaves your device or passkey manager. A sign-in link works once, for 15 minutes, and only in the browser that asked for it.

Signing in sets a cookie that keeps you signed in for 30 days from when you last used the app; signing out or deleting your account ends it sooner. A second, short-lived cookie ties a sign-in link to the browser that asked for it, and a third, also short-lived, does the same for Sign in with Google once that launches. All three are strictly necessary for signing in, and the app sets no other cookies.

To prevent abuse, we limit how many sign-in emails can be requested for an email address and from a network address and, once the human check launches, ask for it as described below; these counters are short-lived. Accounts are not deleted for inactivity while GlobeTempo is in its alpha. The legal basis is providing the service you ask for.

We can look up and manage accounts. As the service’s administrator, the founder can search for an account, for example by its email address, see what it holds (how it signs in, its sessions and its days) and manage it: to help when you ask, to end its sessions, or, once plans exist, to give it a plan or take one back. We keep an internal record of these actions for one year. It names the account only by a one-way fingerprint, and it stays for that year even if the account is deleted. The legal basis is providing the service and our legitimate interest in running it.

Sign-in emails (when accounts launch)

Sign-in emails are sent by Brevo, an email service based in France. Brevo receives your email address and the email itself, including your one-time sign-in link, and records delivery data about it: when it was sent and delivered and, because tracking cannot be turned off on our Brevo account, when it was opened and whether the link was clicked, with the device and network address used to open it or click the link. Brevo keeps this in its logs for as long as its terms say.

The email’s button passes through Brevo’s link-tracking address; the plain link printed under it goes straight to GlobeTempo. Because a link works once, for 15 minutes, and only in the browser that asked for it, a link in Brevo’s logs cannot sign anyone else in.

Human check on sign-in emails (when it launches)

If many sign-in emails have been requested from your network address in one day, which can happen on a shared mobile or office network, the app asks you to complete a short check by Cloudflare Turnstile before it sends you one. Only then does your browser contact Cloudflare, only on the sign-in screen, and in a separate frame that cannot see your days or your account. While the check runs, Cloudflare receives your network address, your browser’s details (such as its user agent and TLS fingerprint) and the website the check runs on, and uses them to tell people from automated requests. To do this, Cloudflare also stores a random identifier in your browser (named cf.turnstile.u, kept under Cloudflare’s address and only for our site), which it reuses at later checks. It stays until you clear your browser’s data for the site. It is needed only for this security check, so we do not ask for consent to it.

Our server then asks Cloudflare whether the check passed. It sends Cloudflare only the check’s one-time result, never your email address, and does not store Cloudflare’s answer. Cloudflare handles this data for us to run the check, and also on its own behalf to improve its bot detection, as its Turnstile privacy addendum explains. Our legal basis is our legitimate interest in keeping sign-in available and protected from abuse. You can avoid the check by signing in with a passkey, or with Google where it is offered.

Sign in with Google (when it launches)

If you choose Sign in with Google, Google tells us your Google account’s unique id and your email address, and we keep only those two. We do not ask for your name, photo or anything else. If Google has verified the email and it matches an existing GlobeTempo account, you are signed in to that account.

Google learns that you signed in to GlobeTempo, as with any Sign in with Google. What Google does with that is covered by Google’s own privacy policy.

Who else handles your data

These companies handle data for us, each only for the job named:

• Hetzner: our server, in Helsinki, Finland, runs the app and holds its database, backups, logs and street map.
• Netlify: hosts this website and receives the early-access form.
• Brevo, in France: sends sign-in emails, once accounts launch.
• Cloudflare: the human check on sign-in emails, once it launches, only when many have been requested from your network address.
• Google: we read our mailbox in Google’s Gmail app, so Google may also process the emails you send us and copies of early-access requests; and, once it launches, Sign in with Google if you choose it.
• Namecheap Private Email: our mailbox, which receives the emails you send us and copies of early-access requests. We read this mailbox in Google’s Gmail app.
• GitHub: holds our source code. No data about you is stored there.
• Tailscale: while the app is in invite-only testing, testers reach it through Tailscale’s private network, so Tailscale, and we in its admin console, see their Tailscale login (email address), device and network address. This ends when the app opens to everyone.

Netlify, Namecheap, GitHub, Tailscale and Cloudflare are US companies and Google, including for the Gmail app we read our mailbox in, processes data worldwide, so data they handle may be processed outside the European Economic Area.

The street map is drawn from OpenStreetMap data (© OpenStreetMap contributors, available under the Open Database License) and served from our own server, so no map company sees which places you look at. Planning runs on our own server too: your days are not sent to any other company.

We do not sell or rent your data, and we share it with no one else unless the law requires it.

How long we keep it

• Days, with their records and, once day ratings launch, their ratings: until you, anyone with the link, or the account that claimed them deletes them. There is no automatic expiry yet. While the app is in testing, we may also remove days before the public release. After a deletion we keep only a one-way fingerprint of the day’s id and when it was deleted, so that nothing more can be recorded for it and a restored backup cannot bring it back.
• Backups: the database is copied every day and before each software upgrade, and every copy is deleted within 7 days of being taken. A deleted day or account can remain in these copies for up to 7 days. If a backup is ever restored, everything deleted since it was taken is deleted again.
• Daily usage totals: without a time limit. They hold no identifier and are not linked to any day or account.
• Accounts: until you delete them. Sessions end 30 days after last use; sign-in links expire after 15 minutes. After a deletion we keep a one-way fingerprint of the account’s id and when it was deleted, so that a restored backup cannot bring it back.
• Usage analytics choices (when optional analytics launch): when you withdraw a “yes”, we keep a one-way fingerprint of that choice and the time you withdrew it for 30 days, even after your account is deleted, so that restoring a backup cannot turn your “yes” back on.
• Server logs, including the web server’s error log: until the system journal rotates them out.
• Early-access requests: until invitations have gone out, or until you ask us to delete them.

Your rights

Under the GDPR you can ask to see your data, correct it, delete it, receive it in a portable form, restrict or object to how we use it, and withdraw any consent you gave. We answer within one month.

You can delete a day yourself at any time from its “Save or delete this day” panel; it is removed at once. Once accounts launch, the account screen lets you download a copy of what your account holds, or delete the account and every day it claimed, after signing in again. For anything else, email us.

You also have the right to complain to a data-protection authority. Ours is the Polish one, the President of the Personal Data Protection Office (UODO, uodo.gov.pl); you can also complain where you live or work.

Age

GlobeTempo is for people aged 18 or over. If you are under 18, please do not use it or send us your data. If you think someone under 18 has given us their data, email founder@globetempo.com and we will delete what we can find.

Changes

If what we collect or how we use it changes, this page changes first. Third-party analytics, an advertising pixel or any other new recipient of your data needs a change to this page before it is added, and anything optional stays off until you agree to it.