Privacy Policy
Last updated · July 2026
1. Data Controller
World Explorer · worldexplorerwebcontact@gmail.com
Registered in Spain. For the purposes of the General Data Protection Regulation (GDPR), World Explorer is the data controller of your personal data.
2. Data We Collect
- Account: username (your full name from Google, or email prefix), email, and profile picture (if you sign in with Google).
- Saved countries: countries you mark as wishlist, planned, visited, or backpack.
- Forum stories: title, content, and associated country.
- Likes: when you like a forum story, we store which story and your user ID.
- Notifications: type (like or country_update), title, body, and metadata (e.g. country, story ID).
- Preferences: accent color, display mode, language, temperature unit, currency display, auto-rotate, and tooltip detail level.
- Technical: IP address, browser type, operating system, and session data managed by Supabase.
We do not collect payment data. Booking links redirect to third-party platforms with their own privacy policies.
Providing your account data is necessary to use the platform. Without it, we cannot create or maintain your account. Technical data is collected automatically when you access the site.
3. Purpose and Legal Basis
| Purpose | Legal Basis |
|---|
| Manage your account and session | Contract performance · Art. 6.1.b GDPR |
| Save destinations and trips | Contract performance · Art. 6.1.b GDPR |
| Forum stories | Consent · Art. 6.1.a GDPR |
| App improvement (analytics) | Legitimate interest · Art. 6.1.f GDPR |
| Necessary cookies | Legitimate interest + contract · Art. 6.1.b and 6.1.f GDPR |
| Preference cookies | Consent · Art. 6.1.a GDPR |
You may withdraw your consent for forum stories or preference cookies at any time by contacting us or adjusting your browser settings.
4. Data Retention
- Account and trip data: for as long as your account is active.
- Forum stories: until you delete them or cancel your account. Deleted content may remain in backups for up to 30 days.
- Technical session data: 30 days.
- Backup retention: up to 30 days after deletion.
5. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our service providers operate:
- Supabase — servers in the US and EU (Frankfurt). Data stored in the US is covered by the EU-US Data Privacy Framework or Standard Contractual Clauses.
- Google — if you sign in with Google, authentication data is processed by Google in the US under Google's GDPR compliance framework.
- Vercel — hosting and CDN infrastructure may route traffic globally.
All transfers are safeguarded by appropriate safeguards (Standard Contractual Clauses approved by the European Commission).
6. Third Parties with Access
- Supabase — database, authentication, and file storage.
- Google — if you sign in with Google (name, email, avatar).
- Unsplash — image requests. No personal data is shared.
- Vercel — hosting and CDN (IP address, request metadata).
7. Your Rights (GDPR)
Under the GDPR, you have the following rights:
- Access — request a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data ("right to be forgotten").
- Restriction — limit how we process your data.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, write to worldexplorerwebcontact@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In Spain, the relevant authority is the Agencia Española de Protección de Datos (AEPD).
8. Security Measures
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS).
- Encrypted session tokens and passwords (Supabase).
- Regular security updates and dependency monitoring.
- Limited staff access to production data.
No method of transmission over the Internet is completely secure. We cannot guarantee absolute security.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the platform. Continued use after changes take effect constitutes acceptance of the updated policy.
For any questions, concerns, or data subject requests:
Email: worldexplorerwebcontact@gmail.com
Response time: within 30 days (GDPR requirement).