Privacy Policy

Who takes care of your data

Pombilds is run by [nome do responsável pelo Pombilds], the controller of the personal data processed here, under Brazil's General Data Protection Law (LGPD, Law 13,709/2018). For any privacy matter, including with the data protection officer, write to [e-mail de contato].

What we keep and why

• Your account. Your email, so you can sign in (with Google or with a 6-digit code) and so we can tell the person who made the map when the gift is opened. The code is valid for 10 minutes and is stored only as a hash, a fingerprint that doesn't reveal the number. Legal basis: performance of the contract (LGPD, art. 7, V). Kept: while the account exists.
• Sign in with Google. If you tap "Continue with Google", Google sends us your email and your Google account number (scopes openid, email and profile), and only those two are kept. Your profile name and photo come along and are discarded; we keep no Google access key, and signing in asks for nothing else in your account. Legal basis: performance of the contract. Kept: while the account exists. To remove Pombilds's permission from your Google account, use myaccount.google.com/permissions.
• Face or fingerprint (passkey). Recognition happens on your device. We receive and keep only a public key, which contains nothing of your face or fingerprint. Legal basis: performance of the contract. Kept: while the account exists.
• Session. A cookie keeps you signed in for up to 30 days. With the session, we keep the IP address and the browser type, for security and so you can sign out of other devices. To stop abuse, such as too many code requests, the server also counts requests per IP and per email, only in memory and for one day at most. Legal basis: performance of the contract and legitimate interest in keeping the service secure (art. 7, IX). Kept: until the session ends.
• Gift link. We keep only the link's hash, when it was opened and whether it was revoked. When the gift is opened, we create an account without an email for the person receiving it, which they can later save with their face, fingerprint or email. Legal basis: performance of the contract. Kept: while the map exists.
• Your map. The name or nickname of the two people, each dove's gender (she, he or they, only for the drawing and the wording of the text), the title and the dedication, the places (name, country and the point on the map) and the dates, the dishes, the mishaps, the travel dreams and what each of you writes, and the language of the person who made the map, for the gift link preview and the email notice. The person who makes the map writes the name and gender of the person receiving it; the person receiving it can change both in Settings. Legal basis: performance of the contract; for anything sensitive, see below. Kept: until it's deleted in the app or the account is deleted.
• Photos and videos. Before uploading, your browser reads the date, the time zone and, if present, the GPS of the photos, only to suggest the trips and places; this reading happens on your device, and the GPS is not sent. The browser removes the data hidden in the file (EXIF, XMP, IPTC) before uploading, the server makes copies in a few sizes, also without it, and deletes the uploaded file. For each photo we also keep the date it was taken. The video is trimmed to 30 seconds at most and shrunk on your device before uploading. Nothing is offered for download and we don't keep the original. Legal basis: performance of the contract. Kept: until you remove the photo or the video.
• Place search. Search runs on our server, in our own table of places (GeoNames). From 3 letters on, the server also queries Photon, from komoot: it receives only the text searched (or, when you mark a point on the map, that point's coordinates) and our server's address, never your IP, your name or your map. Legal basis: performance of the contract.
• The map on screen. The globe and the streets come from our own files; no third-party map service sees where you browse.
• Technical data. Errors and performance go to Sentry; app usage (which screens and actions, never the content) goes to PostHog. Both receive only ID numbers (of the account, the map, the chapter): texts, place names, emails, gift links and photo links are removed before sending, and there's no screen recording. The server logs (page requested, time and IP) are used for security and diagnosis. Legal basis: legitimate interest in keeping the app working and improving it (art. 7, IX, and art. 10). Kept: up to 90 days in Sentry, up to 1 year in PostHog and up to 30 days in the server logs.

Sensitive data

What you write may touch on your life as a couple, your health or your sex life, and the gender of the two doves may suggest a sexual orientation. The LGPD treats such data as sensitive (art. 5, II). It's used only to show the map to the two of you, and processing it relies on your consent (art. 11, I): you decide what you write and can withdraw your consent by deleting the text, changing the gender or deleting the account.

Who sees the map

Only the two people on the map. Each of you edits your own memories and your own travel dreams (a dream come true leaves the dreams when one of you puts the trip on the map with the box checked, and stays in the chapter, with its "Why there?", until the chapter is deleted); everything else, both of you edit. No one on the team reads what you write or sees your photos, unless you ask for help and allow it, to investigate an abuse report or because of a legal obligation. The gift link opens the map for whoever has it before it's used, so send it only to the person receiving it.

Google Photos

• If you choose "From Google Photos", Pombilds asks Google for permission to see only the photos you select in Google's own picker (scope photospicker.mediaitems.readonly). We have no access to your library, your albums or other parts of your account.
• The permission lasts 1 hour. In the open tab, it stays stored until it expires. On our server, it's kept encrypted only while we copy the photos you chose, for 1 hour at most, and it's deleted as soon as the copy is done. It's never written to logs.
• Right after you choose, we copy the chosen photos and videos to our storage, each with a thumbnail made by Google, so the import doesn't depend on Google afterwards. From them we receive the image or the video, the moment it was taken, the size and the camera. The photos you put on the map follow the same path as the other photos and become clean copies. For a video, Google gives us a copy it converts itself; we make a light preview from it so you can choose the clip, and only the chosen clip (up to 30 seconds) stays on the map. What doesn't go in is deleted when you save or discard, or within 7 days if left unsaved; the video's copy and preview are deleted as soon as the clip is saved. The thumbnail goes with them. The picker session is deleted at Google as soon as your selection arrives.
• We use these photos only to build your map. We don't use them for advertising, we don't sell them, we don't pass them on to third parties beyond the services that make Pombilds work (listed below), we don't train artificial intelligence with them, and no one sees them besides the two of you, except with your permission, for security or because of a legal obligation.
• Pombilds's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• To delete them, remove the photo from the map or delete the account. To remove Pombilds's permission from your Google account, use myaccount.google.com/permissions.

The pombilds.com website

• No cookies, no banner. The marketing website stores nothing in your browser. It counts visits anonymously, with a random number that lasts only for that visit: the page opened and its language, your browser's identification (to tell phone from computer and people from robots), where you came from, the buttons tapped, the questions opened, the postcard's mini film and whether you made a couple in the picker (never which pigeons). This goes to PostHog; never your name, email or anything you write. Legal basis: legitimate interest in knowing what works on the website (art. 7, IX). Kept: up to 1 year.
• The language at the door. At the bare address (pombilds.com/), Cloudflare reads your browser's language and, without it, your IP's country, only to open the page in English or Portuguese. We keep neither.
• From the website to the app. The buttons to the app carry the page's language, which becomes the app's language (the language cookie), and the visit's number after the # in the address, the part the browser never sends to any server. If you create an account, the visit counts together with your app usage, so we know which page brought the people who signed up.
• Errors. If something goes wrong on the website, the report goes to Sentry, like the app's.
• The website's photos. They belong to the person who made Pombilds, published with the permission of the people in them.

Who we share with

We hire these services to make Pombilds work, and each one receives only what it needs for its part:

• Cloudflare (United States): the site's network and protection, storage of photos and videos in a private space (each photo opens through a signed link that expires in 7 days) and sending the emails.
• Hetzner (server in the United States): where the app runs and the database lives.
• Sentry (United States): error and performance reports.
• PostHog (United States): usage metrics.
• komoot (Germany): place search through Photon, with none of your data.
• Google (United States): Sign in with Google and Google Photos, if you use them. When the Google Photos button appears, your browser already downloads Google's sign-in script, which sees your IP and your browser.
• flagcdn.com: country flags are images from this service, downloaded directly by your browser, which shows it your IP and your browser.
• Authorities: only by court order or legal obligation.

International transfers

Because these services are outside Brazil, your data goes to the United States and Germany. This happens when it's necessary to perform the contract with you, with the safeguards of the LGPD (art. 33), such as the ANPD's standard contractual clauses and each supplier's data protection agreements. Your rights, described below, apply just the same.

Cookies and storage on your device

• Session cookie: keeps you signed in. Without it you can't sign in.
• Language cookie (PARAGLIDE_LOCALE): remembers the app's language on this device, for up to 400 days.
• Last sign-in method cookie (better-auth.last_used_login_method): remembers whether you last signed in on this device with Google, with the code or with your face or fingerprint, to mark that button on the sign-in screen, for up to 400 days. It stays after you sign out.
• PostHog (cookie and local storage starting with ph_): an identifier to count app usage.
• Tab storage (gone when the tab closes): the Google Photos permission, for up to 1 hour, the selection in progress in Google Photos and the screen's own reminders.
• Browser database (pombo-photos): the draft of a photo import, with the chosen photos and thumbnails (from Google Photos, only the list: the photos stay in our storage), until you save or discard it. It stays only on your device.

The pombilds.com website uses no cookies. We don't use advertising or social media cookies. You can delete or block cookies in your browser; the session cookie is needed to sign in.

How long, and how to delete

What you remove in the app (a photo, a memory, a dream, a chapter) is gone right away. In Settings, "Delete my account" signs the account out of every device right away and blocks new sign-ins; its data is deleted within 30 days. Backups are replaced within 30 days, and with them goes what had already been deleted.

Your rights

Under the LGPD (art. 18), you can, free of charge:

• confirm whether we process your data, and access it;
• correct incomplete, wrong or outdated data;
• ask for the anonymization, blocking or deletion of unnecessary or excessive data, or of data processed unlawfully;
• receive a copy of your data to take to another service;
• ask for the deletion of data processed with your consent, and withdraw that consent;
• know who we share your data with;
• know that you may refuse consent, and what happens if you do;
• object to processing that doesn't comply with the law.

You can do a lot on your own in the app: edit, remove and delete the account. For the rest, write to [e-mail de contato]; we reply within 15 days. Pombilds doesn't make automated decisions about you. You can also file a complaint with Brazil's National Data Protection Authority (gov.br/anpd).

Security

The connection is always encrypted (HTTPS), photos stay in a private space and only open through signed links that expire, codes are stored as hashes and there are no passwords. No system is infallible: if an incident may put you at risk, we'll tell you and the ANPD.

Age

Pombilds is for people 18 and over. If we learn of an account belonging to someone younger, it is deleted.

Changes to this policy

If we change something important, we'll let you know in the app or by email at least 30 days before it takes effect. The date at the top shows the version in force.

Contact

[nome do responsável pelo Pombilds] · [e-mail de contato]

Terms of use