LEGAL

Privacy Policy

GDPRCCPA / CPRAAI disclosed
Worldly is a travel-themed game (app and website) that lets you explore destinations, collect stamps, complete challenges and build a passport. This policy explains what data we process, why, with whom we share it, and your rights under the GDPR and, where applicable, the CCPA/CPRA. The data controller is Worldly (operated by Anthony Robles until a registered entity exists); privacy contact: worldly.passport@gmail.com.

Quick index

1Controller and principles2Data we collect3Purposes and legal basis4Retention5Sharing and processors6International transfers7Security8Your rights9Children10Changes and contact11Artificial Intelligence
1

Controller and principles

The data controller is Worldly. The privacy contact email is worldly.passport@gmail.com. We apply data minimization: we collect only what we need to run the service, personalize the game, process purchases, keep the service safe, and answer you.

2

Data we collect

We collect the following categories:

You provide
  • ▸Email when you sign up (Supabase Auth) or join the waitlist; optionally your Google or Apple account if you sign in with them.
  • ▸Profile: traveler name, nickname, avatar (a generated illustration or a photo you upload), birthdate and interests.
  • ▸Content you upload: photos in your real-world albums and challenge photos, plus notes.
  • ▸Voice (optional): if you use the voice travel guide, audio is processed to transcribe it to text.
  • ▸Game selections: the countries and cities you choose to explore (not your GPS location).
Collected automatically
  • ▸Usage analytics (Firebase Analytics) and crash diagnostics (Firebase Crashlytics).
  • ▸Purchase status via RevenueCat — never your card number.
  • ▸Technical data: device type, OS and app version, IP and connection metadata.
We do NOT collect
  • ▸Sensitive data (health, ideology, religion, biometrics, sexual orientation, union membership).
  • ▸Card/payment data: purchases are processed by Apple/Google; we only receive the purchase status (via RevenueCat).
  • ▸Precise GPS location or your contacts. Camera, gallery and microphone are used only when you choose to take/upload a photo or use the voice guide.
3

Purposes and legal basis

PurposeLegal basis
Provide and personalize the game (progress, streaks, rewards, passport)Performance of the contract (Art. 6.1.b GDPR)
Store and display your photos and contentContract / consent
Moderate content and verify challenges (see AI section)Legitimate interest (community safety) / compliance
Process and restore purchases and premium accessPerformance of the contract
Local reminders on your deviceConsent (you can turn them off in Settings)
Improve the app and diagnose crashesLegitimate interest
Security, abuse prevention and legal complianceLegitimate interest / legal obligation
4

Retention

We keep your data while your account is active. Security logs are kept for short windows (30–180 days). Deleting your account removes your profile, progress, stamps and uploaded photos. Deletion requests are handled without undue delay (max 30 days), unless the law requires retention.

5

Sharing and processors

We do not sell your data. We share the minimum necessary with:

ProviderUseLocation / safeguards
SupabaseAuth, database and photo storageUS (us-east-1) / SCCs and DPA
Google FirebaseAnalytics and crash diagnosticsUS / SCCs
RevenueCatSubscription and purchase managementUS / SCCs — status only, no card data
Apple / GooglePayment processing and sign-inPer their policies
Google GeminiAI: content generation and photo verification/moderationUS / SCCs — receives place names and, for moderation, your uploaded photos
GroqAI that generates game textUS — place names only, no personal data
DiceBearGenerates avatar illustrations from a non-identifying seed—
Resend / VercelWebsite emails and hostingUS / global — website only
6

International transfers

Some providers process data outside the EEA (mainly the US). We rely on Standard Contractual Clauses (SCCs), data processing agreements and supplementary measures where needed.

7

Security

  • ▸Encryption in transit (TLS) and secure hosting configuration.
  • ▸Access restricted by least privilege; Supabase Row-Level Security.
  • ▸Separation of secrets and service credentials.
  • ▸Moderation of uploaded content and an incident-response procedure.
8

Your rights

Depending on your region (GDPR / CCPA-CPRA) you may access, rectify, erase, object, restrict, port your data and withdraw consent. Email worldly.passport@gmail.com with the subject "Rights request". You can also delete your account from the app's Settings, and lodge a complaint with your supervisory authority.

9

Children

Worldly is not directed to children under 16, nor to the minimum digital consent age of your country if higher. If a minor sends us data without the necessary legal basis, we will delete it once we become reasonably aware.

10

Changes and contact

We may update this policy for legal, technical or functional reasons. For material changes we will make it visible in the app or the legal documentation before applying it. Contact: worldly.passport@gmail.com.

11

Artificial Intelligence

Worldly uses AI providers. We disclose this transparently:

  • ▸Travel content generation (city facts, guide and challenge text) with Groq and Google Gemini: only the place name (city/country) is sent, not your personal data.
  • ▸Challenge-photo verification: the photo you use to complete a challenge is sent to Google Gemini (Vision) to automatically check it matches the task.
  • ▸Content moderation: photos you upload are analyzed with Google Gemini (Vision) to detect inappropriate content before we store or show them; an unsafe image is rejected and deleted.
  • ▸Voice transcription (optional): if you use the voice guide, your audio is processed into text.

No automated decisions with legal effect

AI-generated content may contain errors and is informational only. Moderation may reject an image, but we do not make automated decisions with significant legal effects on you; if you think there was an error, email worldly.passport@gmail.com.