Privacy and cookie policy

Last updated: 30 August 2026

⚠️ This is an English summary. The full Polish version is the binding one — it is the original and the one we keep current.

In short

• You can use the map and search without an account and without giving us any data.
• We do not sell your data and do not share it for purposes other than those listed below.
• Analytics and ads only start after your consent — refusing takes one click.
• You can delete your account yourself: on the site Account → Settings → Delete account, in the Android app Profile → About → Delete account. Your data and reviews go with it — see the Android app section.

What we process

• Account — name, e-mail address, password (stored as an irreversible bcrypt hash; we never see it), optionally date of birth, profile picture and background.
• Google sign-in — instead of a password we receive your e-mail address, name and Google account id.
• Activity — favourites, your “want to go” list and any reviews you post. Reviews are public and signed with your name.
• Contact form — name, e-mail, subject and message.
• Technical data — IP address, browser type and request time, kept in server logs and used for rate limiting.
• Location — only with your consent in the browser dialog. We ask on arrival (to open the map around you) and when you tap “Directions” (to build a navigation link). Coordinates are never sent to our server: they stay in your browser and expire after a day. Declining blocks nothing — the map is then framed by the country from your IP.

Browser storage and cookies

Sign-in does not use cookies — the session token lives in localStorage (scianki.token, 30 days). We also store your cookie decision (scianki.consent.v1, 12 months). Google Analytics and Google AdSense cookies load only after your consent; until then Google Consent Mode signals are set to “denied”. You can change or withdraw consent at any time:

Cookie settings

Who processes data for us

• Vercel Inc. — site hosting and page-view statistics.
• Railway Corp. — application server (API).
• Supabase Inc. — the database holding your account.
• Resend — e-mail delivery (address confirmation, password reset).
• cyberFolks (H88 S.A.) — registrar of the wspin.com.pl domain and provider of the mailboxes on it, including the contact address named above.
• Google Ireland Ltd. — sign-in, analytics and ads (after consent).
• OpenStreetMap Foundation — map tiles; loading the map connects your browser to their servers, which see your IP address.

Data may be transferred outside the European Economic Area (some providers are US companies) under Standard Contractual Clauses or an adequacy decision (EU–US Data Privacy Framework).

Android app and account deletion

The Android app uses the same account and the same database as the site. Three things are specific to the phone: it asks Android for your approximate location (coordinates stay on the device and never reach our server), it stores a Firebase device id after you allow notifications (used only to tell you someone replied in your conversation), and it keeps the session token in app storage rather than in browser data.

Deleting your account — two equal routes, both immediate and irreversible: in the app, Profile → About → Delete account; on the site (also after uninstalling the app), sign in and go to Account → Settings → Delete account. Deletion removes the account, your saved lists, reviews, partner adverts with their conversations and any notification device ids. If you cannot sign in, write to the address below and we will delete the account once we confirm it is yours.

Your rights

You have the right to access your data, rectify it (name, e-mail and date of birth are editable in Account → Settings), erase it (“Delete account”), restrict or object to processing, port your data, and withdraw consent at any time — without affecting the lawfulness of processing before withdrawal. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

Controller

The controller is Maciej Kotlarz Project Manager, a sole proprietorship registered in Poland:

Contact for all data matters: biuro@wspin.com.pl. No data protection officer has been appointed.