YOUR PRIVACY

Privacy policy

Last updated: 27 September 2026.

This policy explains how Free Tour Go handles personal data in its website and mobile app when you explore cities, take walks, contribute photos or use the optional Instagram and TikTok connections.

1. Controller and contact

The data controller is Fernando Manuel Saez, established in Argentina. For privacy questions or to exercise your rights, contact fertandil87@gmail.com.

2. Data we use and why

Account and access. Firebase Authentication manages anonymous sign-in and the available registration methods. We receive the account identifier and profile details supplied by your chosen method. We store internal account and installation identifiers, your profile name, sessions and access, usage and security records to provide the service, apply limits and prevent abuse. Internet requests also transmit your IP address and technical device or browser information.
Preferences and downloads. The app stores selected languages, settings, maps, guides, audio and walk progress on your phone for offline use. Some preferences, such as your selected voice, may be associated with your account on the server.
Location. With your permission, the app uses precise location to find nearby places, accompany a walk and trigger alerts. An active walk may continue using location while the app is in the background or the screen is locked. You can stop the walk or revoke the system permission. To validate a photo, we receive a recent location and store the distance from the place and measurement accuracy. Automatic Stories send the detected place, time and a walk identifier; this feature does not send a complete GPS coordinate trail.
Visit history. Places you mark as visited are stored locally. Visit marks are sent with your account only when you explicitly enable leaderboard participation and synchronization. The leaderboard displays your chosen alias and counts of cities and places visited; it does not expose your list of places or a GPS trail. Withdrawing removes participation, the alias and synchronized visits from the server; local history is managed separately.
Walk history. The app stores the complete route of each walk on this device, along with its duration, approximate distance, time spent at places and stories played. You can view and delete this local history. That detailed history is not synced to your account or published. A new walk is sent to the server only if you separately enable “Contribute to the collective map,” as explained below.
Collective walk map and place visit times. If you enable “Contribute to the collective map” on this device, a walk started after you opted in sends the complete list of recorded GPS positions, with the exact date and time of each point, when it ends. It can also send up to 128 positions and times of photos taken during the walk. Your detailed history stays on your device; this feature does not send the images or their EXIF metadata. It can also send up to 128 place observations per walk, one per place, with the summed seconds of stays of at least 30 seconds closed on departure and the weekday, month and local hour of the first qualifying arrival. That hour comes from your phone’s settings and may be inaccurate. The request contains no name, account, walk identifier or walk hash. While it is received, the sequence of coordinates and times shows where the phone went. The server processes it on receipt: it adds the walk once to each area of about 200 m it crossed, including its start, end and short walks, and checks that photo positions match the walk in space and time. It also adds walks with a qualifying stay and their seconds of stay to calculate the average for each place and mode, and counts arrival times for each time dimension separately. It then discards the positions, times and individual request details. For this map it keeps only cumulative area and place counts and sums of seconds by place, without individual dates or contributions linked to an account or walk. The counts are contributed walks, not distinct people; resending the same walk could count again. The administrative view shows an area, time group or average stay only from 20 contributed walks. That minimum does not guarantee that results are anonymous. Like any internet request, the upload transmits technical data such as an IP address; those data are not part of the counts. To limit abuse, a temporary IP-derived key is kept in the rate-limit cache without linking it to areas, places or walks. You can use the guide without enabling this option. Turning it off stops future uploads, but a contribution already included in the counts cannot be separated from them. This choice is separate from the leaderboard and Google Analytics.
Contributions. Photos, votes, ratings and place reports are internally associated with your account so we can manage, moderate and remove them. Photos undergo automated review by a model running on equipment under our control. It may detect identifiable people, number plates, sensitive information or unrelated content and reject an image. You can contact us to request a review.
Enquiries and account deletion. We process your email, message and the minimum information needed to respond and verify ownership of a request.
Optional measurement. Google Analytics receives usage events only if you accept measurement. Declining does not prevent you from using the service. Events, controls and retention are explained in How we measure usage.

3. Content that may become public

Approved photos and published contributions may be viewed by other people in the app and on the website. When you upload a photo, the permission covers its display in Free Tour Go and sharing by other people in Instagram Stories, under the Terms of use. Avoid uploading private information or images of other people without permission.

If you connect a supported Instagram account and enable author credit, your verified @username is added to your photos when other people prepare a Story using them. This is a global preference for your photos; if it is off, we do not add your Instagram identifier. Changes affect newly prepared images, not copies already shared. The current permission for community photos does not include publication on someone else’s TikTok account.

4. Legal grounds for processing

In Argentina, processing is governed by Personal Data Protection Law 25,326 and its implementing rules. Data needed to manage your account, provide the features you request and protect their operation is processed within the service relationship. For optional features requiring consent, we ask for an express, informed choice. Publishing this policy or continuing to browse does not replace that consent.

Where the General Data Protection Regulation (GDPR) also applies, we use these legal grounds:

Providing the service you request (Article 6(1)(b)). Accounts, sessions, downloads, preferences, management of contributions you submit and handling your requests. We cannot provide a feature without the data it needs; features that do not need that data remain available.
Consent (Article 6(1)(a)). Optional measurement, contributions to the collective walk map, location for features you enable, synchronization and publication of your leaderboard alias, Instagram credit, and social connections and publishing. Location permission, the leaderboard, the collective map and Google Analytics are separate choices. You can withdraw consent without affecting earlier processing.
Legitimate interests (Article 6(1)(f)). Protecting the service and its users, detecting abuse, applying limits and moderating content to avoid exposing other people’s data. We use the data needed for these tasks; you may object on grounds relating to your situation and request a review of a decision.
Legal obligations (Article 6(1)(c)). Handling data protection rights and requests from authorities where applicable law requires it.

Reading public content does not require connecting social accounts or accepting measurement. Contributing requires an identifiable account; uploading a place photo also requires a recent, sufficiently accurate location. Device permissions and social account authorization are requested on their respective screens.

Instagram authorization allows profile access and publishing under the permissions you accept. We do not receive your Instagram password. We store the account identifier, username, account type and an encrypted access token. Automatic Story publishing requires a supported Instagram Business account; manual sharing is completed in Instagram.

Connecting does not enable automatic Stories. If you enable them, the app sends place events during a walk to prepare posts. The server may select one of your photos, an approved and authorized community photo, or an editorial cover cleared for that use. It prepares the content with the place and applicable credit; enabling an available narrated format also adds audio. Publishing a place may reveal where you have been.

You can pause automation and cancel pending Stories. Meta receives the prepared content through a temporary link and the authorization needed to publish. Disconnecting Instagram deletes stored tokens and cancels pending posts. Content already sent is managed in Instagram. In manual mode, you complete publication in that app’s editor.

6. Optional TikTok connection and publishing

You can prepare your own photo and share it through TikTok, completing publication there. To publish a photo directly to your profile, the available feature asks you to connect through TikTok Login Kit. We do not receive your password. We store account identifiers and names, permissions, and encrypted access and refresh tokens; we query the profile and publishing options allowed by TikTok.

Every direct post requires your confirmation. First you review the account, image, title, description, privacy and options for comments, commercial content, AI-generated content and music. Connecting does not publish photos by itself. This feature uses your own place photo or a photo selected on your phone; it does not select other people’s community photos or editorial covers.

To send the photo, the server stores a JPEG copy without the original metadata and provides TikTok with a temporary link. It also sends your confirmed text and options. We retain the submission identifier and status, privacy choice and confirmation time to check the result and avoid duplicates. In the test environment, TikTok may restrict submissions to authorized accounts and private posts.

Disconnecting TikTok deletes stored tokens, attempts to revoke authorization with TikTok and invalidates temporary copies for cleanup. Already published photos remain on TikTok until you manage them there.

7. Providers, recipients and international transfers

AWS: hosts the API, database and images. The main infrastructure is in Ohio, United States. The AWS data processing agreement incorporates standard contractual clauses where GDPR applies.
Google / Firebase Authentication: manages identity and access from the United States. Its privacy information and data processing terms describe the data and safeguards. Google states that it participates in the EU–US Data Privacy Framework for transfers covered by its certification.
Google Analytics: operates if you accept measurement, with international processing under Google’s safeguards and the settings described on our measurement page.
Meta / Instagram and TikTok: receive account information, authorizations and content you send through social features. They control processing on their own platforms, may process data internationally, and apply their Instagram and TikTok policies, including the safeguards and recipients for your region. Your audience depends on your settings there.
Photon / komoot and Open-Meteo: respectively receive city search text and the queried city’s coordinates for weather forecasts, together with technical connection information. We do not send them your visit history or social credentials. See the policies of komoot, established in Germany, and Open-Meteo, established in Switzerland.

For transfers from Argentina, providers’ terms must be read together with the AAIP rules on international transfers. Transfers to a destination without adequate protection require safeguards or an exception allowed by law, such as express consent to the transfer. The European safeguards mentioned above do not, by themselves, mean that Argentina considers a country adequate. You can request information about the destination and safeguards applicable to your data.

Administrative access and moderation are limited to authorized people and equipment. We may disclose information to authorities when legally required. Transfers subject to GDPR rely, depending on the recipient and service, on a valid adequacy decision or safeguards such as standard contractual clauses. Consult the linked documents or contact us for information about the safeguards applicable to your data.

8. How long we keep data

Account, contributions and associated records: while the account and feature remain active, until you withdraw a contribution or deletion is processed. Inactivity alone does not delete an account. Withdrawn or rejected photos stop being offered and are removed from storage; failed deletion attempts are retried.
Local data and visits: remain on your device until you delete them using the available controls or clear the app’s data. Synchronized visits and the leaderboard alias are removed from the server when you withdraw or delete your account.
Local walk history: the detailed route remains on your device until you delete it or clear the app’s data. There is no copy of that history linked to your account on the server.
Collective map: the trail, photo locations and details of an individual place visit are processed when received and are not retained as map records. Only cumulative counts by area and by place, mode, weekday, month or hour, plus summed stay seconds by place and mode, remain. They are kept while the collective map operates. Your sharing choice is stored on this device. Turning it off stops future uploads; a contribution already included in the counts cannot be located or removed individually, including when you delete your account.
Social connections: tokens are retained while you keep the connection and deleted on disconnection or account deletion. Token expiry and deletion are separate processes.
Publishing copies: TikTok links expire within two hours; Instagram links within six hours. TikTok cleanup removes copies after expiry; Instagram cleanup processes completed submissions after six hours. Storage also has a one-day expiration rule for both types of copies. Physical removal occurs through periodic processes and may be delayed by failures.
Publishing status: Instagram and TikTok records are deleted after they are more than 30 days old, once completed or marked as having an unknown result and their temporary copy has been removed.
Account deletion: the minimal record that prevents a recently deleted account from being reactivated is purged after 24 hours have passed since both identity and data deletion complete. Website requests remain while ownership is verified and the request resolved; resolved requests are purged after 30 days.
Security and backups: technical server logs rotate when they reach their size limit, rather than a uniform number of days. Account-associated access records are removed in the account deletion process. Manual recovery backups may contain older data and have no automatic expiry; handling a deletion request must also address these copies. They are not used to reactivate accounts or posts.
Providers: Firebase states that it completes deletion of authentication data, including backups, within 180 days of the deletion request. Accepted measurement retains events associated with identifiers for 14 months, as detailed in How we measure usage. Social platforms manage their own copies.

9. Your choices and account deletion

You can change preferences, withdraw photos, leave the leaderboard, stop sending new routes to the collective map, revoke phone location permissions, change your measurement choice and pause or disconnect social accounts. Counts already included in the collective map cannot later be separated by person. Revoking a permission may prevent the feature that needs it from working. Walk and prepared-content notifications can be managed in app and system settings.

To delete your account, use Account → Delete my account or the public account deletion page. An authenticated in-app request revokes access, cancels pending Stories and prevents new submissions. The public form starts an email-based request: we verify ownership first; submitting the form does not delete the account or stop posts. If you still have access, you can pause or disconnect social accounts while the request is handled.

The process deletes associated credentials, photos and records; some place information and statistics may remain without the link to your account. It does not delete existing Instagram or TikTok posts or copies saved or shared by other people. Those copies are managed on the relevant platform.

You may request access, correction, deletion and, where applicable, restriction, objection and portability, and withdraw consent. Contact fertandil87@gmail.com. We will request only the information needed to verify identity.

Rights in Argentina. You may access your data free of charge every six months, or sooner if you demonstrate a legitimate interest. The deadline to respond to access requests is ten calendar days from receipt; correction, updating or deletion must be handled within five business days, subject to applicable legal exceptions. The Agency for Access to Public Information (AAIP), the enforcement authority for Law 25,326, receives complaints about breaches of personal data protection rules.

Rights under GDPR. Where it applies, its general response period is one month; any lawful extension is explained. This does not replace shorter Argentine deadlines where applicable. You may also complain to the competent data protection authority, for example in your usual place of residence, work or the location of the possible infringement in the European Union.

10. Security and policy changes

We use encrypted connections, access controls and encryption for stored social tokens. These controls reduce risks, but no system can guarantee absolute security. Contact the email above if you discover a privacy issue.

Updates will appear on this page with their date. If a change requires new consent, we will request it before applying that processing; updating this text does not enable optional features by itself.