Privacy policy
Last updated: 14 October 2026
This policy covers the website peregra.app and the Peregra app (iOS and Android). It sets out what data we process, why, on what legal basis and for how long.
1. Controller
Margau Trading OÜ, Männimäe/1, Pudisoo küla, Kuusalu vald, 74626 Harju maakond, Estonia
Email: hello@peregra.app
We have not appointed a data protection officer; we are not required to under Art. 37 GDPR.
2. This website
Hosting and server logs
The website is hosted by Cloudflare, Inc. (USA) and delivered through its global network. When you open a page, your browser sends technically necessary data to Cloudflare: IP address, time, requested address, status code, amount of data transferred, referrer and browser identifier. This is required to deliver the site and fend off attacks (Art. 6(1)(f) GDPR). Cloudflare processes this data as our processor; transfers to the USA rely on the EU-U.S. Data Privacy Framework and standard contractual clauses. We ourselves have switched off logging for the website and do not analyse visits. How long Cloudflare keeps data for operating its service is described in Cloudflare's privacy policy.
No cookies, no analytics
This website sets no cookies and measures no traffic. There is no
analytics tool, no ad network and no profiling. That is why there is no consent banner:
there is nothing to consent to. Your language and appearance choice (light/dark) is kept in
your browser's localStorage — it never leaves your device and we never read it.
There is one exception, and it concerns the contact page only. There the Turnstile spam protection stores strictly necessary information on your device (a cookie or local storage) in order to tell humans from machines. This is required to operate the form and therefore needs no consent; it is not used for advertising, analytics or profiling. If you do not use the form, none of it happens.
Fonts and styling
Typefaces (Inter, Sora) and the layout framework (Bootstrap) are stored with the rest of the website and delivered the same way as every page. Nothing is loaded from Google Fonts or any other third-party server, so apart from our host (see above) your IP address is not passed to anyone. There is exactly one exception, and it applies to the contact page only: there the Turnstile spam protection loads a script from Cloudflare — see the Contact form section.
Maps
Place pages link to Google Maps. It is an ordinary link, not an embedded map. The link is only followed when you click it; until then no connection to their servers is made.
Contact form
You can write to us on the Contact page. We process what you enter yourself — name, email address and your message — plus the time, the language and the country our host derives from the IP address. We do not store the IP address itself. The sole purpose is answering your enquiry (Art. 6(1)(b) and (f) GDPR).
The message is stored in Cloudflare Workers KV and deleted automatically after 90 days. Slack Technologies, LLC (Salesforce, USA) notifies us that it arrived; that notification contains what you entered so that we can reply without a detour. The transfer to the USA relies on the EU-US Data Privacy Framework and standard contractual clauses.
Against automated bulk submissions we use Cloudflare Turnstile. For this,
this page alone loads a script from challenges.cloudflare.com; Turnstile
sets no advertising cookies and builds no profile. The legal basis is our legitimate interest
in a usable inbox (Art. 6(1)(f) GDPR).
You do not have to use the form: an email to hello@peregra.app reaches us just as well.
3. The app
3.1 Account and sign-in
An email address is enough for an account. There is no password: you receive a sign-in link or a numeric code by email (magic link). We process your email address, display name, time of last sign-in and chosen language.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
3.2 Trips, stops and journal
What you enter — trip titles, dates, places, notes, packing lists — is stored so the app works. Trips are private by default. They only become visible if you invite fellow travellers or change the visibility yourself.
Legal basis: Art. 6(1)(b) GDPR.
3.3 Location data — recording your route
This is the most intrusive processing in this app, so we set it out in full.
- You decide. Recording only runs if you switch it on for a trip. You can stop it at any time.
- It runs in the background — with the screen locked, and also when you swipe the app away. That is the point: a route with gaps is not a route. On Android a foreground service with a permanent notification does this, so you can always see that recording is running.
- What is stored: latitude and longitude, time, accuracy, altitude and — where the device provides it — speed. From this the app works out stops, distance and an elevation profile.
- Where it goes: points are buffered on the device and then stored against your account in our database. They are visible to others only if you share the trip.
- What we do not do: we do not analyse movement profiles, do not build profiles about you, do not pass location data to third parties and do not use it for advertising.
Legal basis: Art. 6(1)(a) GDPR (consent, given by switching recording on); you also grant the permission in your operating system and can withdraw it there at any time.
3.4 Photos
Photos you add to a trip are kept in our file storage. If a photo carries location data (EXIF), the app reads it to file the picture with the right stop. On request the app suggests new stops from photos on your device — for this it reads the capture time and location; the picture itself does not leave your device.
Pictures may show people. If you upload photos in which others can be recognised, it is your responsibility that you are allowed to.
Legal basis: Art. 6(1)(b) GDPR.
3.5 Community posts
If you publish a place or a tip in the community, that post becomes public, together with your display name. Places are also shown on this website and can therefore be found through search engines; tips and comments are currently not shown on the website.
Choose a display name you are happy to appear under publicly. Posts can be deleted in the app; pages already indexed by search engines may remain in third-party caches for a while, over which we have no influence.
Legal basis: Art. 6(1)(a) GDPR.
3.6 AI packing lists and travel information
For packing list suggestions we send your description of the trip to Anthropic PBC (USA). For a country's travel information we send the country name and the language. We do not transmit account data, location data or photos. Anthropic processes these inputs as a processor and states that it does not use them to train models. Transfers to the USA are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
The official travel advice itself is fetched from the responsible authorities (e.g. the German Federal Foreign Office, GOV.UK). Their servers are contacted and your IP address is transmitted to them.
Legal basis: Art. 6(1)(b) GDPR.
3.7 Maps in the app
Maps, satellite imagery and the globe come from Mapbox. When a map is shown, your IP address and the requested map area are transmitted to Mapbox. The Mapbox SDK also collects telemetry; you can object to this via the "i" on every map. Without a Mapbox key the app draws its own map from bundled data and no connection is made.
Legal basis: Art. 6(1)(f) GDPR (a working map display).
3.8 Notifications
Reminders about photos, detected stops and finished videos are created by the app on your device. No data leaves the phone for this; no push service is currently used.
4. Recipients and processors
| Recipient | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, sign-in, file storage | EU (Frankfurt) |
| Resend | Sending sign-in emails | EU/USA, standard contractual clauses |
| Zoho Corporation B.V. | Mailbox for messages to hello@peregra.app | EU (Netherlands), data centres in the EU |
| Anthropic PBC | Packing lists, preparing travel information | USA, standard contractual clauses |
| Mapbox Inc. | Maps and satellite imagery | USA, standard contractual clauses |
| Cloudflare, Inc. | Website hosting and delivery; image storage (in preparation) · storage of contact messages and spam protection | USA, EU-U.S. Data Privacy Framework and standard contractual clauses (image storage: EU jurisdiction) |
| Slack Technologies, LLC (Salesforce) | Notification about new contact form messages | USA, EU-US Data Privacy Framework and standard contractual clauses |
Beyond that we pass on data only where we are legally obliged to. We do not sell data and run no personalised advertising.
5. Retention
- Account and trip data until the account is deleted.
- Location points for as long as the trip exists. Delete the trip and its points go with it.
- Photos until you delete them or the trip.
- Server logs are not kept by us; for delivery through Cloudflare see section 2.
- Contact form messages 90 days; after that they delete themselves.
Deleting your account: in the app under Profile › Account › Delete account. The account is deleted immediately, together with your own trips with their route and photos, your spots and templates, and your photos and tips in the community; trips you share with others pass to another member. Without the app, an email to hello@peregra.app is enough; we then delete within 30 days. Details: Delete your account. You can delete individual trips, photos and posts yourself at any time without giving up the account.
6. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future — for instance by switching recording off.
Please write to hello@peregra.app.
You may also lodge a complaint with a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, aki.ee); you may also contact the authority where you live.
7. Children
The app is not aimed at children under 16. We do not knowingly collect data from children under 16 without the consent of a parent or guardian.
8. Changes
When the app changes, this policy changes with it. The date at the top says which version applies. No cookie consent banner is needed at present because we set none; should that change, we will obtain your consent beforehand.