Privacy policy

Rafael Torres García, data controller for Iterare (iterare.app). For anything to do with your data, including access or deletion requests: hello@rafatorresgarcia.com.

About your account: the name, email address and profile picture Google gives us when you sign in. Your password is never stored, because it never reaches us: Google handles that.

About your trips: everything you write in the app —places, routes, dates, notes, comments, lists and expenses— along with the coordinates of the spots you mark on the map.

In your browser: a few preferences that never leave your device, such as your chosen language, the base map and whether you have already seen the welcome tour.

Only to make the application work: saving your trip, showing it on any device where you sign in, and sharing it with whoever you decide.

There is no advertising, no commercial profiling, and your data is never sold or handed to anyone for marketing. The content of your trips is not used to train artificial intelligence models either.

We also measure, in aggregate, how the site is used: how many people arrive, by what route and which pages they read. It is the only way to know whether this is useful to anyone. How it works and what you get to decide is in the cookies section below.

Supabase, which hosts the database and handles sign-in. Vercel, which hosts the application and serves the pages. Google, when you choose to sign in with your Google account.

Two more for analytics: Vercel Web Analytics, which measures in aggregate without cookies, and Google Analytics, which is only switched on if you accept.

All of them process data on our behalf and under our instructions, not for their own purposes.

Your trips are stored in a database hosted in the European Union, so they never leave the European Economic Area. Vercel and Google, however, are US companies: those transfers rely on the EU-US Data Privacy Framework and, failing that, on the standard contractual clauses approved by the European Commission.

Iterare does not draw the maps or work out the routes itself: it asks free, public services from the open-source community. When the application queries one of them, that service receives your IP address and whatever is being asked —a set of coordinates, for instance— just as happens when you visit any website.

The services used are OpenFreeMap (map tiles), Photon and Nominatim (place search), FOSSGIS Valhalla (route calculation), Overpass and Waymarked Trails (waymarked trails), Open-Meteo (weather forecast) and Wikimedia Commons (place photos).

They are never told who you are or which trip the query belongs to, and they are only asked when you ask for something: searching for a place, tracing a route, checking the forecast. The application never queries anything on its own or «just in case».

When you share a trip by link, anyone holding that link can see it, even without an account. The link is the permission: treat it as such, and delete it from the application when you no longer want it used.

When you publish a trip as a guide, it becomes a public page on iterare.app, visible to anyone and indexable by search engines, along with your name and profile picture as its author. You can withdraw it at any time, although search engines may take a while to stop showing it.

Technical cookies —the one keeping your session open and the one remembering your language— are always used, because without them the application doesn't work. The law doesn't require consent for those.

Analytics cookies are a different matter: Google Analytics stores a cookie to recognise returning visitors, and for that reason **it is only switched on if you accept** it in the notice shown on your first visit. Until you answer, and also if you decline, none is written: measurement starts switched off and only changes with your «yes».

You can change your mind at any time using the button at the end of this page. There are no advertising cookies and nothing is shared with advertisers.

For as long as your account is open. If you want it deleted, write to hello@rafatorresgarcia.com and your account and all your trips will be removed; there is no in-app button for this yet, and until there is, email is the way.

A trip you delete from the application disappears immediately, unless it still exists in a recent database backup, which is overwritten over time.

You can ask to access your data, correct it, delete it, take it to another service, restrict its processing or object to it. Just write to hello@rafatorresgarcia.com from your account address.

The legal basis for processing is performance of the contract: without this data the application simply cannot provide you with the service.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (aepd.es).

If anything relevant changes —a new provider, a new purpose— this page will be updated and the date above will change. Changes that genuinely affect your data will also be announced by email.