Privacy Policy

1. Who we are

The Ubiwalker trademark is a registered trademark owned by Mr Stefano Manzini, who operates through Pixycap s.r.l. Pixycap runs the ubiwalker.com website (the “Site”) and the Ubiwalker app for Android and iOS (the “App”).

Data controller: PIXYCAP s.r.l. (single-member company), Via Caldumare 60, 36026 Pojana Maggiore (Vicenza), Italy. Legal representative: Nicola Turato. Email: info@pixycap.com

2. Who the App is for

Users must be at least 13 years old to access or use the Services. You can also use the App as a guest, without an account: in that case we save neither your location nor any profile data.

3. What data we collect

Account data

• Email address, username and an internal account identifier.
• Language and date of birth, requested at sign-up.
• Optional: gender, city and country, a short description (“about you”), a link and a profile photo.
• If you sign in with Google or Apple, we receive from them your name, your email and, with Google, your profile photo. With Apple you can choose to hide your email.

Location

• Only if you give us permission: precise or approximate location, as you choose in your phone settings.
• It is used for the map, nearby places, check-in and walks.
• For registered users we save the last detected location. We also save the location attached to the content you publish and to the routes of your walks.

Content you publish

• Photos and videos, with the audio recorded by the microphone.
• Text, titles and comments, and the itineraries you create.

Messages you send us through the App

• Booking or information requests addressed to our partners, with your name, email and the text you write.
• Support requests, reports of content or users, and account deletion requests.

Activity in the App

• Likes, content views, the people you follow and who follow you.
• The searches you make in the App: to show you the results they are sent to our search provider (see section 5). The list of recent searches stays only on your phone.

Technical data

• Reports on App crashes and data on its performance (start-up and loading times): they contain information about the device and the account identifier, but not your email, name, texts or location.
• Identifiers of the App installation and the code needed to send you notifications.

What we do NOT collect

• Contacts, calendar, SMS, emails, files on your phone, the list of installed apps or browsing history.
• We do not use the device advertising ID.
• The App contains no advertising.

4. Why we use the data and on what legal basis (GDPR)

• To run the App and the services you ask for: account, publishing content, map, search, notifications, forwarding requests to partners. Basis: performance of a contract (Art. 6(1)(b)).
• For safety and moderation: reviewing content before publication, handling reports, preventing abuse. Basis: our legitimate interest (Art. 6(1)(f)).
• To fix bugs and improve performance, through crash reports and performance data. Basis: legitimate interest (Art. 6(1)(f)).
• For service communications: verification and confirmation emails, moderation outcomes, notices of new App versions. Basis: contract and legitimate interest.
• To meet legal obligations, for example tax obligations. Basis: Art. 6(1)(c).

We do not use your data for advertising or for marketing profiling, and we do not sell it.

5. Who we share data with

• Other users: they see the content you publish and your public profile (username, photo, description, number of followers).
• Partners: they receive your booking or information request when you send it.
• Authorities: only where the law requires it.

Providers that process data on our behalf, only for the services listed:

• Google (Firebase): authentication, database, storage of photos and files, notifications, crash reports (Crashlytics), performance data (Performance Monitoring).
• Google: Google Maps Platform (maps, places and routes) and Gmail (sending emails).
• Algolia SAS (search).
• IONOS (servers in Germany), for storing and converting videos.
• YouTube, for YouTube videos embedded in content.
• The public OSRM service, for calculating routes when Google is not available.
• Google and Apple, if you choose to sign in with their account.

6. Transfers outside the European Union

Some providers, in particular Google LLC (USA), may process data outside the EU. In these cases the transfer takes place under Art. 44 et seq. of the GDPR:

• Google LLC participates in the EU-U.S. Data Privacy Framework (dataprivacyframework.gov/list);
• in other cases the standard contractual clauses approved by the European Commission are used.

7. How long we keep data

• Account data and content are kept as long as the account exists, or until you delete them: you can delete your posts at any time from “My posts”.
• When you ask to delete your account, we deactivate it immediately. For 30 days you can reactivate it by signing in again. Within 60 days of the request we delete all your data, except what the law requires us to keep (for example tax data for bookings).
• Crash reports are kept by Firebase for a limited period (90 days).
• We occasionally make backup copies of the database, kept in a protected area of Google Cloud and used only to restore the service after a failure. The data of a deleted account is never restored from these copies.

8. How to delete your account and data

• In the App: the three dots in your profile → “Delete profile” → confirm.
• Without the App: write to curator@ubiwalker.com or info@pixycap.com from the address you signed up with. Full details at ubiwalker.com/support/en/delete-account.

9. Permissions the App asks for

• Location: map, nearby places, check-in, walks.
• Camera and microphone: recording photos and videos to publish.
• Notifications: alerts about new posts, followers, moderation and new versions.
• Photos and videos on your phone: chosen by you through the system picker; the App only sees the ones you select.

You can deny or revoke any permission in your phone settings. The related features will stop working, but the rest of the App will keep working.

10. The Site and cookies

• The Site does not use analytics or advertising cookies.
• Some pages embed Vimeo videos, which may set their own cookies: see vimeo.com/privacy.
• Some resources are loaded from external services (e.g. jQuery), which receive the visitor’s IP address.

11. Security

• Data travels encrypted (HTTPS) between the App, the Site and our providers.
• Access to data is limited to the people who need it to run the service.
• We adopt appropriate technical and organisational measures in accordance with Art. 32 GDPR.

12. Your rights

You have the right to:

• access your data (the first copy is free);
• rectify it;
• erase it;
• restrict its processing;
• object to processing based on legitimate interest;
• receive it in a portable format.

Some rights are not absolute: in limited cases the law requires us to keep some data. We reply within one month. Write to info@pixycap.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. If the changes are significant, we will let you know in the App or by email.

14. Contact

For any question: info@pixycap.com

This English text is a translation provided for convenience. The Italian version of this privacy policy, available at ubiwalker.com/privacy, is the authoritative one: in the event of any discrepancy, the Italian text prevails.