Privacy policy

1. Who we are

Big Walkabout Carouse! is operated by Dustin Pierce, the data controller for this service. Contact: dustinmehrapierce@gmail.com. This policy is written to reflect the app as built and to align with the GDPR, UK GDPR and US state privacy laws such as the CCPA/CPRA; we have not had it certified, and independent legal review is still advisable.

2. What we collect

Account

• Email address and a securely hashed password (or the identity returned by Google or Lovable sign-in).
• Display name, optional bio, privacy settings, and your confirmation that you are of legal drinking age.

Location (check-ins only)

• Only when you tap "I'm here", your browser asks permission and provides a single location reading with its accuracy and timestamp.
• Our server compares it with the venue's location from Google and then discards your coordinates. We store only the venue's Google place ID, the time, the rounded distance and the accuracy figure.
• We never track you in the background, never collect continuous location, and never show anyone your coordinates.
• We also keep a log of check-in attempts (success or reason for failure) for up to 90 days to prevent abuse.

Content you create

• Notes and photos attached to check-ins (private by default), reviews (1–5 stars and optional comment, shown publicly with your display name), reactions to others' reviews, saved area challenges and their settings, and reports you submit.
• Before photos are uploaded we re-encode them in your browser, which strips embedded metadata such as camera GPS tags.

Contact form

Your name, email, subject and message, plus a one-way hash of your IP address and email used only for spam rate-limiting.

Analytics (only with consent)

If you opt in, Google Analytics 4 receives anonymous usage events (for example "venue search performed", "check-in succeeded", a rating value or a category name), the page path with venue/user IDs removed, and standard device/browser information. We never send GPS data, emails, names, notes, comments or photos to analytics. Google signals and ad personalisation are disabled.

3. Why we process it (legal bases)

• Contract — to provide your account, journal, check-ins and reviews.
• Consent — for the one-time location reading at check-in (via your browser's permission prompt) and for analytics cookies. You can withdraw either at any time.
• Legitimate interests — security, fraud and spam prevention, moderation, and answering your messages.
• Legal obligation — responding to lawful requests.

4. Google Maps Platform

Place search, venue details, photos, maps and directions come from Google Maps Platform. When you search, your query text and the map area are sent to Google through our server. The interactive map loads directly from Google in your browser. Google's handling is governed by the Google Privacy Policy and Google Maps/Google Earth Additional Terms. We store Google place IDs (which Google permits) rather than copies of Google's listings, and fetch venue details live.

5. Who we share with

• Our hosting and database provider (Lovable Cloud) which stores account data, content and files on our behalf.
• Google, as described above, and Google Analytics only if you consent.
• An email delivery provider for account emails (confirmation, password reset) and, once enabled, for forwarding contact messages.
• Other users — only content you make public, plus reviews.

We do not sell or "share" personal information for cross-context behavioural advertising, as those terms are used in the CCPA.

6. International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses offered by those providers.

7. How long we keep it

• Account and content: until you delete them or your account.
• Check-in attempt logs: up to 90 days.
• Contact messages: up to 24 months, then deleted.
• Reports: up to 24 months for moderation records.
• Analytics data in Google Analytics: set to the shortest practical retention in our GA settings.

8. Your rights and choices

• Access/portability: download all your data from Settings → Export my data.
• Correction and deletion: edit or delete posts any time; delete your entire account from Settings, which removes your check-ins, notes, photos, reviews, reactions and saved areas.
• Withdraw consent: change analytics consent via "Cookie preferences" in the footer; revoke location permission in your browser.
• Object, restrict, or complain: email us. You can also complain to your data protection authority (e.g. the ICO in the UK or your EU supervisory authority). California residents may exercise CCPA rights to know, delete and correct; we will not discriminate for exercising them.

We respond within one month (GDPR) or 45 days (CCPA).

9. Security

Data is encrypted in transit; database access is restricted with row-level security so each person can only access their own private data; check-ins are validated server-side; photo storage is private by default. No system is perfectly secure, and web GPS cannot guarantee someone's physical presence.

10. Age

This service is intended only for adults of legal drinking age where they live and is not directed to children. If you believe a minor has an account, contact us and we will remove it.

11. Changes

We'll update the effective date and, for significant changes, notify signed-in users.