Privacy Policy - Ghummi Ghummi Travel Planner

Last Updated: 6 October 2026

Data Controller: Rakesh Kumar, Magstadt, Germany

1. Introduction

This Privacy Policy explains how Ghummi Ghummi (“the App”, “we”, “our”) collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). By creating an account or using the App, you agree to the practices described here.

2. Personal Data We Collect

2.1 Account Data

Email sign-up: email address and password credential used for authentication
Google sign-in: Google account identifier, email address, and profile information returned by Google, such as name or avatar

2.2 Usage Data

IP address, browser and device information, request and security logs generated by our hosting and service providers, web analytics data (page views, device types, performance metrics) collected by Vercel Web Analytics, and short-lived captcha verification tokens from Cloudflare Turnstile.

2.3 User-Generated Content

Travel itineraries, place names and addresses, notes, saved places, support messages and attachments, and rich text content created using Quill (sanitized via DOMPurify). You choose what to enter.

2.4 Invitation Data

When a trip owner invites a co-planner, we store the invitee's email address, invitation status, and link token, and send a transactional invitation email. Anyone who receives an active link can preview the invited trip. Owners can remove an invitation to revoke its link. We do not currently expire pending invitations automatically; declined invitations remain until the owner removes them or the associated account data is deleted.

2.5 Location and sensitive information

When you use map, nearby-place, route, weather, or current-location features, the app may process place searches and location coordinates. Browser geolocation is used only after you grant permission. We do not ask you to provide sensitive or special-category personal data. Please do not enter it in trip, place, support, or attachment fields. If you choose to submit such information, it may be processed with the content and by the providers described below; this notice does not limit any rights or responsibilities under applicable law.

3. Purpose of Processing

Account creation and authentication
Travel planning features
Map rendering and routing
Security and fraud prevention
Customer support
Sending support and trip-invitation emails via Zoho Mail SMTP
Web analytics and performance monitoring to understand usage patterns and optimize the application

4. Legal Basis for Processing

Art. 6(1)(b) - Contract performance
Art. 6(1)(f) - Legitimate interest (security, stability, fraud prevention)

5. Third-Party Services We Use

Supabase - authentication and database storage for accounts, trips, wishlists, support requests, and attachments
Google - OAuth sign-in and Google Maps/Places features; map resources are loaded in the browser when used
Cloudflare Turnstile - browser captcha and server-side token verification, including the request IP when available
Photon (photon.komoot.io) geocoding service and OpenStreetMap - place search/reverse geocoding and map tiles; search terms or coordinates are sent for lookups, and tile requests may disclose browser IP and viewed map area
OpenRouteService - route calculations using submitted waypoint coordinates when configured; otherwise an approximate route is calculated by the app
OpenTripMap and Wikipedia - nearby-place searches and place descriptions using coordinates or place names; Wikipedia is also used as a nearby-place fallback
Open-Meteo - weather forecasts using destination coordinates and requested dates
Vercel - application hosting and request/server logs
Vercel Web Analytics - collection of page views, visitor session data, device types, and web vital metrics to monitor application usage and performance
Zoho Mail SMTP - delivery of support messages, attachments, and trip invitation emails

Some requests are made by our servers and others directly by your browser when you use a feature. Providers may receive technical information such as IP address, browser details, and request metadata along with the feature data described above. Leaflet, React-Leaflet, and Nodemailer are software libraries used by the app, not separate service providers receiving your data.

6. Essential Cookies and Storage

Supabase authentication uses session cookies or browser storage as configured. The app also uses browser storage for trip data on this device, preferences, and your cookie-notice choice.
Google Maps/Places, Cloudflare Turnstile, and OpenStreetMap map tiles may load when you use the related features. Other lookups are generally proxied through our server to the providers named above.
Accepting or declining the cookie notice currently records your choice in browser storage and dismisses the notice; it does not block optional third-party requests.
We use Vercel Web Analytics based on legitimate interest in service improvement (GDPR Article 6(1)(f)) to collect page views, device types, and performance data. This analytics collection is not consent-based and occurs on all pages via the @vercel/analytics package. We do not use advertising or advertising-related tracking cookies.

7. Data Retention

Account data: retained until you delete your account
Itineraries and notes: retained until deleted
Server logs: short retention per Vercel defaults
Support emails: stored in Zoho Mail until manually deleted
Captcha tokens: short-lived and not stored long-term

8. Your Rights

You may access, correct, download, or delete your account data, and you may object to or restrict processing where applicable.

Download a JSON export from your account profile. For other privacy requests, contact support@ghummi-ghummi.com. You may also lodge a complaint with a supervisory authority, including the LfDI Baden-Württemberg under Article 77 GDPR.

We aim to respond to privacy requests within 30 days.

9. Data Security

We use industry-standard security measures including HTTPS, Supabase RLS, captcha protection, and secure hosting.

10. Contact

support@ghummi-ghummi.com

11. Contact / Impressum

Impressum - Ghummi Ghummi Travel Planner

Operator: Rakesh Kumar

Location: Magstadt, Germany

Email: support@ghummi-ghummi.com

This project is non-commercial and operated by an individual developer.

The dedicated Impressum page is available from the footer and at /impressum.

12. Data Deletion & Export Workflow

Data Export

Download a machine-readable JSON export directly from the account profile. It includes account profile metadata, trips you own, trips shared with you, planner and invitation records, wishlists and saved places, support requests and attachments, and app data stored in the current browser.

The export does not include passwords, Supabase session tokens, or server secrets. Planner records may contain active invite-link tokens, so keep the downloaded file private.

Data Deletion

You may delete your account from within the app.
All associated data will be permanently removed from Supabase.
Support emails stored in Zoho Mail may remain until manually deleted.
For manual deletion requests, email support@ghummi-ghummi.com.

13. Processing Overview

Controller: Rakesh Kumar, Magstadt, Germany

Contact: support@ghummi-ghummi.com

Categories of Data Subjects: App users

Categories of Personal Data: account identifiers and authentication credentials, optional profile data, IP/device/request data, user-entered trip and support content, attachments, place searches and coordinates, planner emails and invitation records

Purpose of Processing: account creation, authentication, travel planning, routing, security, support and trip collaboration

Legal Basis: Art. 6(1)(b), Art. 6(1)(f)

Recipients: Supabase, Google, Cloudflare, Photon, OpenStreetMap, OpenRouteService, OpenTripMap, Wikimedia/Wikipedia, Open-Meteo, Vercel, and Zoho Mail, as applicable to the feature used

Retention: until account deletion; logs short-term; support emails retained until manually deleted

Security Measures: HTTPS, RLS, captcha, sanitization, secure hosting

This is a public summary. The detailed processing register is maintained separately for internal operational use.

14. International Data Transfers

The primary Vercel, Supabase, and Zoho regions are configured in the EU, based on the operator's current account settings. Some providers may nevertheless process data outside the European Union/European Economic Area, including through their affiliates or subprocessors. Selecting an EU primary region for hosting or database storage does not by itself mean that all processing, access, logs, or backups remain in the EU/EEA. The applicable location and transfer safeguards depend on the provider, service, account configuration, and contract. Where required, transfers must rely on an applicable legal transfer mechanism. See the current Supabase DPA and subprocessor list, Vercel DPA and Privacy Notice, Google Privacy Policy and Google Cloud Data Processing Addendum, Cloudflare Turnstile Privacy Policy, and Zoho Privacy Policy. Confirm the agreement and transfer mechanism applicable to your account and each service before relying on a specific safeguard.

15. Policy Updates

We may update this Privacy Policy from time to time. When we do, we will revise the Last Updated date on this page and keep the public version aligned with the services actually used by the App.