Privacy policy

Draft for legal review. This text sets out the MVP's actual data handling. It must be reviewed by a lawyer for the launch markets before going live.

What we collect

• Account details: name, email address, a hashed password, and an optional bio.
• If you sign in with Google or Facebook: your name, email address and an account ID from that service. We do not get your password, contacts, friends or posts, and we never post on your behalf.
• Optional community or heritage information, which you choose to add and choose whether to show. Because this may reveal racial or ethnic origin or religion, we treat it as special category data under GDPR and process it only with your explicit consent, which you can withdraw at any time in settings.
• Optional “About you” answers on a review: ethnicity, gender and the country you are from. Each one defaults to “Prefer not to say”. What you choose is shown on that review and lets readers filter reviews. Ethnicity is special category data under GDPR, so we only store it when you choose to give it, which is your explicit consent. To remove it from a review, email privacy@ourexperience.app, or delete your account in settings.
• Reviews, photos and tags you post, and reports you make.
• Your location, only when you tap “Use my location”. It is used for that one search and not stored.

How we use it

To run the service, show your public profile and reviews, keep the community safe through moderation, and measure overall usage. We do not sell personal data.

Your rights

You can access, correct, export or delete your data, and object to processing, by emailing privacy@ourexperience.app. California residents have equivalent rights under the CCPA. We respond within 30 days.

Deleting your data

You can delete your account yourself at any time: go to Settings and choose “Delete my account”. It removes your account and everything linked to it straight away, including your reviews, photos and any Google or Facebook sign-in. Places you added stay on the site without your name. If you can't log in, email privacy@ourexperience.app from the address on your account with the subject “Delete my account” and we delete it within 30 days. You can also remove Our Experience from your Google or Facebook account settings at any time.

Retention

We keep your account until you delete it. Reports are kept for 12 months after they are resolved. Server logs are kept for 30 days.

Processors

Hosting (Netlify), database (Neon), image storage (Cloudinary), and, only if you choose them, sign-in by Google or Facebook. Each is bound by a data processing agreement.