Privacy Policy

Paragraph.Earth is a travel planning and storytelling service individually operated from Niš, Serbia. This policy explains what personal data we receive, why we use it, who receives it, and how you can exercise your choices. For privacy questions and requests, contact [email protected].

1. Information we collect and use

• Account information: your name, email, username, optional profile picture and biography, account preferences, registration date and last sign-in date. We use these to operate your account, identify you to other users, provide support, and send account and collaboration messages. For password accounts, we store a password hash, not the original password.
• Optional mailing-list information: if you separately subscribe to early-access or newsletter emails, we use your email address to send the notices you requested. You can unsubscribe through an email's unsubscribe link or by contacting us.
• Your content: stories, photos, locations, visited countries, trip plans, itineraries, packing lists, booking details, comments and collaboration activity. We use this information to provide the features you choose.
• Technical information: our server and service providers receive information such as IP addresses, browser information and request details to deliver the service and protect it against abuse. Optional analytics is described in section 6.
• Browser storage: essential cookies maintain sign-in and language preferences. Browser drafts and their identifiers are stored locally so you can plan without an account. They are uploaded to your account only when you choose to save them.

2. Sign in with Google

Google sign-in is optional. When you choose it, we request the openid, email and profile permissions. Google provides a unique account identifier, your email and its verification status, and basic profile information such as your name. Google may also return a profile picture; we do not currently copy that picture into your Paragraph.Earth profile.

We use this information to verify your identity, create or sign you into your account, prevent duplicate accounts, and connect Google to an existing account after you confirm that account's password. We store your Google account identifier and email with your account, and your confirmed name if you create an account. Your chosen display name is part of your public profile. We do not publish your Google account identifier or email as public profile fields.

This integration does not request access to Gmail, Google Drive, Calendar or contacts, and does not retain Google access or refresh tokens. We never receive your Google password. Google-derived account information is used for the service and account communications, not advertising, sale to data brokers, credit decisions, or training general-purpose AI or machine-learning models. Our use and transfer of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can remove Paragraph.Earth's access through your Google Account's third-party connections settings. Removing access does not itself delete your Paragraph.Earth account or data; request deletion using section 8. Keep a working sign-in method if you intend to continue using your account.

Facebook sign-in

When enabled, Facebook sign-in is optional. We request public_profile and email permissions. Meta provides your app-scoped Facebook user identifier and name, and your email address if available and permitted. We request only id, name and email fields; we do not request your friends list, posts or permission to publish to Facebook. We use these details to authenticate you and help complete your account. We verify your email with a code before creating or linking an account for a Facebook identity not previously connected. Existing password accounts also require their password to connect Facebook. We store your Facebook identifier with your account; it is not public. We do not retain Facebook access tokens after login processing.

Meta receives authentication requests and connection information. Facebook-derived information is used for account operation, not sold or used for advertising or general-purpose AI training. Facebook login transactions expire after twenty minutes and email codes after ten minutes; the stored code hash and temporary profile information are removed on completion, account deletion or database expiry cleanup. Your linked Facebook identifier is retained while your account exists. Removing the app in Facebook stops the connection but does not by itself delete your Paragraph.Earth account; follow section 8 to delete your account and associated Facebook data, or contact [email protected].

3. Public content and collaboration

Your profile name, username, biography, profile image and published stories can be seen by other users and visitors. Private plans are available to their owner and authorized collaborators. Plans that you choose to publish can be accessed publicly, subject to the availability of publishing features. Collaborators receive the content and profile details needed for the shared plan. Avoid including private information about yourself or others in public content.

4. Service providers and other disclosures

We do not sell personal data. We disclose information needed to operate the features you use to these providers:

• Hetzner: hosts our application and primary database on our server in Nuremberg, Germany, storing and processing account and application data.
• Google: authenticates Google sign-in; receives optional analytics information only after your consent. Google Maps services, when used, receive map/search requests and connection information.
• Mailjet: receives recipient email addresses and message content to deliver account, security and collaboration emails. Email messages can include names and relevant activity details.
• Twilio SendGrid: receives email addresses and message details for the legacy early-access/newsletter subscription feature, when you use it.
• Cloudinary: stores and delivers uploaded images and receives image requests and connection information.
• OpenStreetMap/Nominatim and map services: receive location search terms or coordinates and connection information when you use those features. Browser GPS access requires your browser permission.

Providers may maintain their own operational records under their terms and privacy policies. We may also disclose information when required by law or necessary to address fraud, security threats or legal claims. Microsoft Clarity session recording is disabled in the current application.

5. Purposes and lawful bases

Where applicable data protection law requires a lawful basis, account operation, authentication, planning, collaboration and service communications are based on performing our service agreement with you; security and abuse prevention support our legitimate interests; optional analytics, mailing-list subscriptions and any use of your photos or text for promotional campaigns require your consent; and legally required processing is based on our legal obligations. You can use the service without accepting optional analytics or promotional use.

6. Cookies and optional analytics

Essential cookies and browser storage support sign-in, language selection, browser drafts and remembering your privacy choice. They remain available when you choose “Necessary only.” Your analytics choice is saved in this browser for up to 180 days; you can change it at any time using Privacy settings, available throughout the app and on this page.

Google Analytics is loaded only after you select “Allow analytics.” We measure general public-page categories and a limited set of interface actions to improve the service. We do not intentionally send names, emails, Google account identifiers, content, exact locations, or URL query strings and invitation tokens to analytics. Analytics is disabled on authentication and private pages, while you are signed in, and while the login popup is open. Advertising storage and personalization are denied. Analytics cookies are configured to expire within 180 days.

Choosing “Necessary only” stops future analytics collection from this app and removes its accessible first-party analytics cookies. It does not erase information already processed by Google; contact us about applicable access or deletion requests. Your browser's privacy controls can additionally restrict cookies and storage.

7. Security and retention

Production connections use HTTPS. Passwords are hashed with bcrypt. Google identity tokens are verified on the server, and access to private plans requires authorization. Sign-in cookies are HttpOnly; Google sign-in cookies use Secure on HTTPS and SameSite restrictions. No security measure eliminates all risks.

• Account information, including your Google identifier, is kept while your account exists and is needed to provide the service, unless you request deletion.
• Mailing-list information is kept to manage your requested subscription; contact us to unsubscribe and request deletion of the address held by our application.
• Content is kept while it remains in the service, until you remove it or request deletion of your account.
• Google sign-in transactions expire after ten minutes and are removed after successful completion or by database expiry cleanup. Session cookies normally expire after fourteen days. Account-deletion codes expire after fifteen minutes, and the browser deletion-status receipt expires after one day. Other verification, password-reset and invitation tokens expire after seven days; notifications expire after thirty days. Database expiry cleanup may occur shortly after the expiry time.
• Your privacy choice and configured analytics cookies last up to 180 days. Browser drafts remain on your device until you remove them or clear site storage.

We do not retain deleted account data or recovery backups of that data. Provider-controlled records, messages already delivered, and copies other people made are not the same as data held in our application.

8. Your rights and deletion requests

Contact [email protected] to request access, correction, deletion, or other rights available under applicable law, including objection, restriction and portability where applicable. Use the email associated with your account where possible. We may verify your identity before acting to protect your data.

Once your account-deletion request is verified and processed, we delete your account and associated personal data immediately rather than retain recovery copies. You can start account deletion from Account settings and confirm it using a code sent to your account email. You can also contact the operator for help. Access is disabled after confirmation. Database and owned Cloudinary image deletion is processed immediately; failures and provider rate limits are retried, and deletion is reported as complete only after cleanup succeeds. Pending cleanup retains only the data needed to finish it. Cloudinary CDN invalidation can take a few minutes. Plans you own and their contents are removed; other people’s plans remain, with your contributions and account references removed. Tell us if your request also concerns a specific service provider. Clear this site's browser storage separately to remove locally stored drafts and preferences; we cannot remotely erase your device or other people's copies.

You can withdraw optional analytics consent through Privacy settings and withdraw promotional-content consent by emailing us. Withdrawal does not invalidate processing that took place before it. You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, or your competent supervisory authority where applicable.

9. International processing

Our application and primary database are hosted in Nuremberg, Germany. External providers may process information in other countries; we do not claim that all provider processing remains within the European Union. Applicable transfer protections depend on the provider and service. Contact us for information about a specific provider or transfer.

10. Policy changes and contact

We will keep this policy current and notify users by email or in the app of material changes to how we use Google user data or other personal information. Privacy notices on this page describe processing; they are not a blanket request for consent. Contact: [email protected], Niš, Serbia.