Privacy policy
Last updated: 10 October 2026
Controller
The controller is Patricia Simón Soleto (self-employed professional), NIF 53420421T, address Calle Valle de Oro 50, 28019 Madrid (España), email contacto@viajaconpatrosca.com. The app is at https://app.viajaconpatrosca.com and is part of https://www.viajaconpatrosca.com.
No data protection officer has been appointed, because none is required for this processing. For any privacy question, write to contacto@viajaconpatrosca.com.
Data we process
Account: email, username if you set one, a hash of the password, whether the email is confirmed, and the kind of account. The password is not stored in clear text. The kind of account is not changed from the app itself.
Session: a cookie that shows you are signed in.
What you save: your places, preferences, day-by-day trips and legs. You cannot upload or attach photos: the app does not ask for them and does not store them on your account.
Paid-map use: a per-account, per-day count of place and route lookups sent to Google, plus a monthly total for the whole server with no personal identifier.
Account email: signup and password reset create a single-use link. The confirmation link expires after 24 hours and the reset link after 30 minutes. The message is sent to your email.
Signup: a check against automated signups. When Cloudflare's check is on, that provider validates the step. Otherwise we use a local check that is not linked to the account.
Security: the IP address and, for limits on sending email, the email address as well, to stop abuse. Failed sign-in attempts are counted with the email or username for a short time.
The site's editorial catalogue is not your private file and is not deleted when you delete the account. Category images are served from this same site. An administrator may add photos of a place; this site serves those too, without location data. The browser does not request them from an external photo service.
On your device we store what the app needs to work: the session, your trips and preferences, and the fact that you closed the cookie notice. The Google map, when it is offered, loads only if you agree.
Purposes and legal bases
Providing the account, storing trips and places, confirming the email and resetting the password: performance of a contract, or steps you ask for before a contract (GDPR article 6.1.b).
The session cookie, abuse limits and the signup check: legitimate interest in keeping the service secure (article 6.1.f). You can object by writing to contacto@viajaconpatrosca.com.
Looking up the map, a place or a route: part of the service you request (article 6.1.b). Loading the Google map in the browser, which may set Google cookies: your consent (article 6.1.a), asked before the script loads.
How long we keep it
A confirmed account, its trips and usage counts stay until you delete the account. A normal account that was never confirmed, is older than 24 hours, and has no valid confirmation link is deleted with its data. That cleanup does not include accounts that are already confirmed, including those already confirmed when confirmation became mandatory, or test or admin accounts.
The session lasts 30 days, or 8 hours for an admin account. The confirmation link expires after 24 hours and the reset link after 30 minutes. Both are single-use.
Processors, recipients and transfers
We do not sell or otherwise hand over your personal data to third parties, except where the law requires it. There is no advertising and no third-party analytics.
We use providers that process data on our behalf:
OVHcloud (OVH SAS / OVH Hosting Ltd) hosts the app on a VPS in a United Kingdom datacenter. The United Kingdom has an EU adequacy decision. Email for the app is provided by OVHcloud in the European Union: the confirmation or reset message contains your address and the link.
Google LLC (United States), through Google Maps Platform (Maps, Places and Routes), for the in-browser map, place search and routes.
Cloudflare, with Turnstile, for the anti-bot check on signup.
OpenStreetMap (tile.openstreetmap.org) serves the default map tiles, and OSRM (router.project-osrm.org) calculates walking routes. Those services receive your IP and, for a route, the coordinates of the query.
Google LLC and Cloudflare may process data in the United States. Those international transfers rely on the safeguards in the GDPR: the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.
Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to contacto@viajaconpatrosca.com and saying which right you want to use. If we need to check your identity, we may ask for further information.
While you are signed in, “Download my data” gives you a copy of the account and of what you have saved, and “Delete account” erases the account and that content. Username, password and the trip are corrected in the app. The shared editorial catalogue is not part of your account.
If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
There are no automated decisions with legal effects. Daily limits only cap how many map lookups are made.
Children
This app is not directed at children under 14. If you are under that age, do not create an account or give us personal data.
Security
We apply appropriate technical and organisational measures against loss, unauthorised access or misuse: the password is stored as a hash, page scripts cannot read the session cookie, and the connection is encrypted (HTTPS).
Changes
We may update this policy when the law or the way the app works changes. The date at the top of this page is the latest update.