Spadok

Privacy Policy

In short: the app asks for your location to confirm a visit to a heritage site — and stores your coordinates nowhere. An account is needed only for the community and subscriptions. Your posts carry your nickname, which you choose yourself; the rest of your profile is public only with your consent. There are no ads, advertising identifiers or tracking; only anonymous daily counters, described below. Terms of use are a separate page: Terms of Use. This is a translation for convenience; in case of discrepancy the Ukrainian version prevails.

Who is responsible for the app

Spadok is a historical and cultural tourism project. The controller of your data is the app's operator named on the “About the project” screen and in the Terms of Use; until a business entity is registered — the project's author as an individual. Questions about this policy and your data: info@spadok.net. We reply within 30 days. This page applies to the web version, the Android app and the iOS app.

We process data under the Law of Ukraine “On Personal Data Protection” and, for people in the European Union, the European Economic Area and the United Kingdom, also under the GDPR (UK GDPR). Legal bases: performance of our agreement with you (operation of the app and account), your consent (location, notifications, profile visibility — everything switched on by you), and our legitimate interest in community safety and abuse prevention (moderation, protection against faked visits).

Location

The app asks for access to your location to check whether you are really near a site. This is the core mechanic of the product: the right to rate and review opens only after a confirmed arrival.

Coordinates are stored nowhere. On the device the app measures the distance to the site and remembers only the result — “was at this site on this day”. If you are signed in, the coordinates are sent to the server once, at the moment of confirmation: the server measures the distance, records “confirmed” together with the GPS accuracy in metres — and discards the coordinates. They are not in the database, and there is no mechanism that could put them there.

The app keeps neither your route nor a history of movements. The only technical trace is the site and time of the last confirmed visit, needed to filter out faked visits (a person cannot be in Khotyn and Uzhhorod ten minutes apart). It is shown to no one, including you.

Location access is optional. If you refuse, the app works, but arrival must be confirmed manually, and the stamp is marked accordingly. A manual stamp does not give the right to write a review.

Camera

The camera is needed for one thing only: scanning another traveller's QR code to follow them. Frames are neither sent anywhere nor stored; the camera switches off as soon as you close the scanner. Without the camera the code can be typed in manually.

Account

Without an account the app works fully: the map, routes, stamps, awards and travel log live on your device. An account is needed for the community, following people, audio stories and supporting Spadok.

You can sign in with Google, with Apple or anonymously. Signing in with Google or Apple gives us your e-mail address (Apple allows a hidden relay address); it is processed by our authentication provider (see below) — we show it to no one and do not write to it except to answer your requests. An anonymous account has no e-mail and cannot be recovered after signing out.

What is stored on the server if you are signed in:

profile: the name you entered yourself (optional), the traveller's sign you chose, a short bio (optional), creation date;
profile look, if you added it: profile photo (avatar), banner, header colour and a showcase of up to three landmarks you chose yourself. Before upload the app re-encodes the photo and banner, removing their metadata, including the location tag. The files sit in public storage: anyone who can open your profile sees them;
visits: which site, when, GPS-confirmed or manual, GPS accuracy in metres. No coordinates;
your ratings of places, reviews and the photos you added to reviews yourself. Before sending, the app re-encodes the photo, which removes its metadata — including the geotag and the phone model;
topics, comments and votes in the community, and the photos you added yourself to a topic (up to four) or a comment (one). Before sending, the app re-encodes the photos, which removes their metadata — including the geotag and the phone model; reports you filed; users you blocked;
polls: the options and duration if you created the poll, and your vote in someone else’s — account, topic, chosen option and time. Nobody, not even the author, sees who voted for what: the app shows only the totals;
saved items: topics and comments you saved to come back to — once you sign in, the list is kept on the server so it opens on all your devices. Only you see it; up to 500 entries;
hidden posts and “less from this community”: topics you hid and communities you muted in “Home” — once you sign in, the list is kept on the server so it works on all your devices. Only you see it; up to 300 topics and 50 communities;
messages to a community’s moderators: subject, text and time of your messages and the moderators’ replies. Read by you and that community’s moderators (and the Spadok team); moderators reply on behalf of the community, without their names. A message is deleted with the account;
direct messages: who the chat is with, the text and time of messages, the request state (waiting, accepted, declined), when you last read the chat and whether you hid it. Only you and the other person read it. The Spadok team sees only a message that was reported — it goes to the report queue. A message notification contains no text. A deleted message is erased in the database (a “deleted” mark remains); a chat is deleted with either person’s account;
who can send you direct messages: everyone, only people you follow, or no one;
“Ask Me Anything”: if you were invited as a guest — the invitation and your consent or refusal; if you asked to be reminded of an event — that request and the time the reminder was sent;
topics you follow: so that new comments in them arrive as notifications. Only you see the list; up to 500 topics;
restricted and private communities: your request for access (with a short note, if you wrote one) and the moderators’ decision; only the community’s moderators see the list of approved members. Topics, comments and chat of a private community are seen only by approved members and moderators; you can leave at any time;
community chat: your messages, their time and the community. Everyone who can see the community sees them; they live 30 days and are then erased. A message hidden by a moderator disappears from the chat; a report goes to the team’s queue;
custom feeds: the name, the chosen communities and whether the feed is public. A public feed is visible to anyone with the link, with your name as its author; a private one only to you;
best answer: which reply in your question you marked as the one that helped. Everyone in the topic sees it; it gives no karma;
community bell: for each community you subscribe to — whether you want notifications about all new topics, only trending ones, or none. Only you see it;
reports by community rules: such a report (like any report on a community’s topic, comment or chat) is seen by that community’s moderators — without your name, only the rule and the number of people; the Spadok team sees all reports, as before, together with the moderator’s decision;
post collections: the title, the community and the list of topics. A collection is seen by everyone who sees the community, with your name as its author; a moderator of that community may change or remove it;
“My year in Spadok”: the numbers for a year (posts, comments, stamps, thanks, communities, active days) are computed on request from what is already stored and are not saved anywhere. Only you see them; sharing the card is your decision; memorial places are not in the card;
community ban: who banned you, when and why. You see the reason in that community; the list of banned people is seen by its moderators; the record is in the moderation log. The lead moderator lifts it; it is erased together with the account;
crowd control: to collapse a newcomer’s or non-subscriber’s comment, the server looks at the account’s age and the subscription to the community — only while showing the topic; nothing new is stored;
scheduled post: a topic with a publishing time is stored on the server from the moment you write it; until it goes out only you see it, not even moderators. Once out, it is an ordinary topic. You can delete it any time before;
authors of the month: once a month the server counts topics, votes and thanks of the previous month in a community and stores up to three names with their place (no scores). Everyone in the community sees the badge, and so does your profile if it is public; you get a notification;
pinned post: the id of one of your topics you put first in your profile. Visible to everyone who can see the profile; removed with one tap or together with deleting the topic;
stickers and GIFs in comments: a sticker is just a key from Spadok’s own set (no third-party services, no outside requests); a GIF from your gallery is stored as is, without re-encoding — so whatever it contained stays (GIFs normally carry neither location nor phone model). It lives in the same place and for as long as comment photos do;
weekly digest: on Sunday evening the server picks up to three of the hottest topics of the week in the communities you subscribe to and sends one notification (the “week in your communities” category, can be turned off); nothing new about you is stored except a “sent” mark;
profile links: up to three https addresses you add yourself under the bio; visible to those who can see the profile; .ru/.su/.рф are not accepted. Photo captions of a topic are stored with the topic and are as visible as the topic itself;
hide read posts: the “opened” mark lives only on your device (up to the last 300 topics) and is never sent anywhere; related topics under a post are picked by the server from topics already visible to you, without storing anything;
edit history: when you change the text of your topic, the previous version is kept on the server for 30 days (up to 20 versions) and is visible to everyone who can see the topic — like the “edited” mark. Deleting the topic erases the history too;
moderator notes: a community’s moderators may leave a short working note about you (for example, a warning). Only that community’s moderators see it; it is erased together with the account;
thanks (“Thanks”, “Helpful”, “Spot on”): whom you thanked and how. Everyone sees the thanks counts under a post; who thanked is seen only by the post’s author in their notification. Thanks are free and give no karma;
your flair in a community (user flair) that you chose or moderators gave you: it shows next to your nickname in that community;
topic views: how many times a topic was opened is seen only by its author. Who viewed it is not stored — only a fingerprint (hash) of the account or of a random device identifier, to count one person once a day; the fingerprint is erased after two days. For the author’s insights we also count the source of a view (home, community, search and so on) and shares — as numbers only, without who;
community subscriptions — so that “Home” is the same on all your devices. Only you see the list; others see only a community's member count, and only from five real accounts;
communities you created: name, description, rules, header colour and banner, their own post flairs, date; you are their creator and senior moderator. The banner sits in public storage, re-encoded without metadata;
reports about a site's condition (“closed”, “limited”);
follows: whom you follow and who follows you; your QR code;
bonfire: the fact “standing by the bonfire” — only the site identifier and the time the record expires (45 minutes). No coordinates;
bonfire flame: the relay trail — where you opened a bonfire, where you hold its flame now, who took the flame from you. This trail is public and is switched on only by your explicit action “stand by the bonfire”;
folk map: your suggested places (name, description, source and the coordinates of the place — not yours) and your “support” votes for others' suggestions with the vote weight at the time;
“was with” trace: pairs of people who stood by the same bonfire at the same time — two account identifiers, a site identifier and a day. No coordinates, and the trace is not public: only a member of the pair can read it, and only so the app can suggest companions in your travel log;
folk art: your posts (title, tag, text, photo or video link, the site if you named one), your applause for others' posts and comments under them;
edits to sites: what you suggested correcting, in which site, your text and the source you cited;
karma: a public trust number — the sum of votes for your words plus ten for each follower of your flame. It collects no separate data — it only counts what is already listed;
public authors: if you switched on “Others may read me”, your author identifier is served together with your art and topics and people can follow you without a QR code; the lists of whom you follow and who follows you are on the server; routes, stamps and places are not opened by this;
verified account: a “museum”, “veteran” or “historian” badge set only by the editors after verification outside the app (no documents are uploaded to the app for this badge); the badge is visible to others next to your name and gives your vote a weight of ×5;
shop: if you offered your work to the shop — the fact of agreement with the terms (terms version), the credit name you entered, and the withdrawal date if you withdrew;
the fact of supporting Spadok: until which date it is valid and via which payment provider it was paid. We hold no card data — payment happens on the provider's page.

What stays only on your device

travel log: date, route, kilometres, time on the road, stops;
map tiles you downloaded for offline use;
saved sites (bookmarks), and without signing in — saved topics too;
drafts of unfinished topics and comments — for up to 30 days;
a local copy of the profile, stamps and awards;
counters of your actions for awards — how many times you stood by a bonfire, met people in person, suggested places. Numbers only, without places, dates or names;
the “days with Spadok” streak and your answers to the question of the day — device only; the server receives only an anonymous counter “today's card opened / answered” (see “Technical records”).
the sites whose communities you follow, and the posts you hid from your feed.

These data are not sent to the server even if you are signed in.

What third-party services see

The app runs on other people's servers and shows other people's map — this should be said plainly rather than hidden behind “we transmit nothing”.

Supabase — hosting of our database and authentication. Everything in the “Account” section physically lives there. Supabase is a processor acting on our instructions; we do not allow it to use the data for anything else.
Google and Apple — when you sign in through them, they learn the fact of authentication in Spadok.
Map servers (OpenStreetMap) receive your IP address and requests for specific map tiles. From the tiles you view one can roughly tell which area you are interested in.
Routing services (OSRM: FOSSGIS servers at routing.openstreetmap.de and the OSRM project demo server) receive the exact coordinates of the start and end of a segment when the app builds a track — including walking or cycling. Without this a route cannot be built.
Push delivery services. In the web version — your browser’s service (Google, Mozilla, Apple or Microsoft): it receives the technical address and an encrypted message it cannot read. On Android — Firebase Cloud Messaging (Google), only if you switched notifications on: it receives the device token and the notification text (handle, topic title, excerpt) — this is how every Android app with server notifications works. Google acts here as a processor on our behalf.
Netlify — hosting of the web version; sees the IP address and the access log, like any web server.
Google Scene Viewer — only when you tap “In your room (AR)” on Android. The Google app loads the site model from our website and sees your IP address. From us it receives only the model address and the site name.
Payment provider (when Pro is enabled) — everything related to payment happens on its page under its policy. Only the fact “paid until date” comes back to us.
monobank “Base”, WayForPay and your bank (ways to contribute in the web version) — the payment happens with them, under their policies; the app passes them nothing. The recipient (the sole proprietor who runs the project) sees what the service shows: the amount, the date and, if you left them, a name or comment; for a bank transfer, the payer’s name and the payment reference. This is needed for the sole proprietor’s bookkeeping; a name appears in “Thanks” only with your consent.

These services have their own policies, which we do not control. What the app does not send them: your name, stamps, ratings, travel log — nothing from your passport.

Community and visibility

The app has a community: discussion topics in regions, comments, votes, reviews under sites. Everything you publish is visible to other people together with your nickname — like Reddit, including readers who are not signed in (from 3 October 2026). You choose the nickname yourself; a real name is not needed; without a nickname you are signed as “Traveller”. Your bio, profile photo, banner, showcase and progress are visible only if you made the profile public.

Only you can see your up and down votes. Others see only the total under a post — not who voted how.

All visibility except the nickname under your posts is by your consent only and is off by default. Separate switches in the passport (“Passport” → “Privacy”) control profile visibility, showing the number of visited sites, participation in the leaderboard and whether others may read you. They can be changed at any time.

Movement history, coordinates and visit times are never published to anyone; only the number of visited sites goes out — and only if you opened it.

Place communities. If your profile is public and you turned on “Others may read me”, your profile shows your topics and comments — without “was here” marks. A deleted post is erased from the database: “···” remains in its place, and other people's replies remain. A post that looks like a report of a strike, and a post about an occupied city, are first seen only by a moderator. The public moderation log shows no title of a rejected post, only the reason.

Like Reddit (from 3 October 2026): posts, comments, reviews, folk creativity and memories go live at once, and violations are removed after a report. A review can be written without a stamp; the server puts the “was here” mark next to it if GPS confirmed your visit to that landmark, and everyone reading the review sees it. Anyone with Google or Apple sign-in can create a community; the list shows the creator’s nickname.

Photos in topics and comments. Photos sit in private storage: the app opens them through a temporary link while the topic and the comment are visible. Anything hidden by a moderator or deleted by you is no longer shown to anyone, photos included; deleting the topic, the comment or the account erases the files.

Profile look. The banner, avatar and header colour are seen by those who can open your profile and by people you met by QR; the showcase only by people you met by QR. A private profile does not show them to the community. The showcase is only the names of landmarks you chose yourself, with no dates and no “was here” mark; memorial places never appear in it. A report on a profile hides its banner and avatar at once until the team decides. The app erases a replaced or removed photo from storage; deleting the account erases all profile files.

Posts in which the app detects the russian language are ranked lower in discussions and labelled. This is a technical community rule; it collects no additional data about you.

Veteran status and testimonies about occupied cities

Under the cards of cities under occupation only people with veteran status may write, and each such record is published after editorial review. To obtain the status you write a few words in the Journal at your own discretion (for example unit, city, period) and add a photo of your combatant certificate (UBD). You may cover the series and number on the photo: the editors only need the name, photo and stamp. Before sending, the app re-encodes the image, which removes its metadata — including the geotag and the phone model. The photo is kept in closed storage without a public address; only you and the project's editors see it, opening it via a temporary link. As soon as the editors decide — “yes” or “no” — the photo is deleted. If you delete your account earlier, the photo is deleted with it. Only the project team sees the text of the request. After the decision the request is marked resolved and stays in your account until you delete it together with the account. The status itself — the “veteran” badge — is visible to others only next to your testimonies.

Until approval, testimonies are visible only to you and the team. We ask you not to write positions, movements or other people's names in them — see Rule 3 of the Community Rules.

Following another traveller

You can follow a person only after meeting in person, in one of two ways: by scanning their QR code face to face — or with one tap by a shared bonfire, when both GPS signals confirm you are standing by the same site right now (and, from 7 September 2026, by the “Follow” button next to the name of an author who has switched on “Others may read me”). There is no search by name and no “people to add” list. The person you followed sees it in their list and can remove a follower at any time.

From 7 October 2026 a profile has two circles. People you met by QR (a QR code or a shared bonfire) see your whole profile: nickname, photo and banner, bio, links, karma, posts and series, showcase, the number of visited places, which places you visited and which routes you completed — and the day of each visit: the date only, with no time and no coordinates. The “Dates for people you met by QR” switch in Privacy turns the dates off; it is on by default and also covers earlier visits. When the dates are off, the server removes them, not the interface: the follower then does not see when you were at a place — the dates never reach their device at all.

The community (only if you switched on “Public profile”) sees a profile card: nickname, photo and banner, bio, karma, posts and series. It has no links, showcase, number of visited places or places. Those who follow you with the “Follow” button see only your art and topics.

Bonfire, flame, art and the folk map

These are community mechanics, and all of them are switched on only by your explicit actions.

Bonfire. “Stand by the bonfire” is an explicit action on a site card, available only when GPS confirms you are on site. It makes you visible at that site for 45 minutes — and only to those who are also standing by the same bonfire now: the list cannot be read from afar by other users or from your profile. The database stores only the site identifier and the expiry time — no coordinates. The counter “by the bonfire now: N” on the site card is a number without names.

Bonfire flame. Whoever stands by the bonfire takes its flame: the holder's name is shown on the site card until the next person takes the flame; the opener of the bonfire stays in it forever. This is a public trace — the app warns about it right above the button, and it does not arise without your tap. Raw visits do not become public because of it: the stamp and the bonfire are separate things.

Fire circle. Although each individual flame is public on its card, the combined map of all sites where your flame burns now is seen only by three: you, your followers (those you admitted personally) and your successors — those who took the flame from you. To others this overview is closed, and it is closed by the server, not the interface. Extinguished fires — where your flame once burned — are seen only by you.

“Was with”. When two people stand by the same bonfire at the same time, the server keeps a durable trace of the pair — so that a week later the app can suggest marking a companion in a completed trip. The trace is closed: you see only your own meetings, other people's pairs cannot be read by any query. The “was with” mark itself lives in your log on the device and is shown to no one. You cannot add a person “on your own” — the list contains only proven co-presence.

Folk art. Poems, photos, songs and memories live in the shared feed, distinguished by a tag — there is no separate section. From 3 October 2026 a post goes live at once; one that looks like a report of a strike is first seen only by a moderator — until the decision only you see it. A published post is public: its title, text, photo or link is seen by anyone who opens the feed or the site card. The signature is your nickname (without one — “Traveller”). Photos are stored in our storage and served only via a temporary signed link; we do not store video at all — it is a link to YouTube or Vimeo. Video plays right in the post card: from 9 October 2026 that service's embedded player (YouTube in cookie-free mode, Vimeo with tracking off) loads as soon as the post appears on screen, and plays only when you press ▶. From that moment YouTube or Vimeo sees your IP address and its rules apply, not ours. A rejected post remains visible only to you.

Link posts. In a community topic and in folk creativity (the “Link” tab) you can share a link — to a post on Instagram, TikTok, YouTube, Facebook or Telegram, to any website or, in a community, to a fundraiser page. We store only the link, not the platform's content. An Instagram post and a YouTube, Vimeo or TikTok video are shown in that platform's embedded window — from 9 October 2026 it loads as soon as the post appears on screen, without a tap. From that moment the platform sees your IP address and its rules and cookies apply, not ours. We do not embed Facebook or Telegram posts or any other link: the row shows only the platform's name and domain, we draw the thumbnail ourselves, and a tap opens it on the platform's site or app. Fundraisers go live only after an editorial check; until the decision only you and the moderators can see one. The money itself bypasses Spadok — we see neither amounts nor your card details.

Editing a site. An edit is not public: it is seen by you (in your list of edits) and the editors. Neither the text, the source nor your name is shown to other people or appears on the site card — only the corrected information itself enters the catalogue, entered by an editor by hand. The server accepts a factual edit only with a source; an accessibility note may be written without one.

Folk map. A suggested place is public by nature: its name, description and coordinates are seen by everyone. Your name next to the suggestion appears only if you switched on visibility in the privacy settings; otherwise the signature is “Traveller”. A “support” vote is shown as a number; the vote weight (single, double from karma 100, triple from 500, ×5 for verified accounts) is calculated by the server and recorded at the moment of support.

Moments at a landmark. A moment is one shot and a short caption you publish at a landmark. The photo and caption are public for exactly 24 hours: anyone opening that landmark's card or the region map sees them, including without signing in. The signature is your nickname (from 3 October 2026, as under all posts); without one — “traveller”. The shot is taken with the in-app camera or picked from the gallery, shrunk on the phone to 1280 px, and location and camera data (EXIF) are not carried over; a text moment is words on a coloured card, with no photo. The camera runs only on the “Add a moment” screen and stops as soon as you close it. Anyone signed in can add a moment, anywhere; a landmark is optional (without one the moment shows only in the feed and your Journal). If GPS confirmed your visit to that landmark within the last day, the server tags the moment “on site” — everyone sees the tag. A “support” vote is shown as a number and gives the author +1 karma; there are no votes at places of memory. A moment under an occupied city, or one that looks like a strike report, goes out after review — until then only you see it. After 24 hours the moment fades for everyone; the server deletes the row and the file 7 days later. You can remove your own moment at once.

Notifications

Push notifications are off until you switch them on yourself: the phone or browser asks for permission first. Once on, as on Reddit, all kinds are active and you switch off the ones you don’t want in “Notifications”: replies to your topics, comments and art; @handle mentions; upvotes on your posts (milestones only — 5, 10, 25, 50, 100 and on, without the names of those who voted); new followers; trending in your communities — at most once a day; popular on Spadok — once a week and only if you have not visited for three days; moderation decisions. The calendar, the card of the day and follows stay separate.

What the server stores: the technical subscription address from your browser with its encryption keys (web version) or a Firebase device token (Android), the notification language, the list of kinds you switched off, the “Quiet at night” switch and the phone’s time zone (for example, Europe/Kyiv) — only so that nothing arrives from 22:00 to 08:00 your time. The server also records that a notification has been sent, and a log of “trending” and “popular” sends (kind, topic, time) — so as not to repeat itself and not to send more than 12 notifications a day.

A notification’s text is addressed to you: it contains the handle of whoever replied or mentioned you, the topic title and an excerpt of the reply. If Android is set to hide sensitive content on the lock screen, only “Spadok: new notification” is shown there. An @handle mention works when the handle in the text matches someone’s handle; one text can mention at most five people. You can switch off with one tap — the address or token is then deleted; after a failed delivery it is deleted automatically.

Technical records

Anonymous counters. Each day the server counts how many times in the app the map was opened, a stamp was placed, something was shared, a route started, a topic created, notifications enabled, the card of the day opened, the question of the day answered, someone came back after a break, opened “Weekend nearby”, completed a seasonal challenge or made a landmark video. These are numbers per day only, with no names and no identifiers.
Active day. If you are signed in, the server records the fact “this account was active on this day” — without what you did. From this we count how many people come back after a day, a week and a month. Only the team reads this, in aggregate form.
Device. For an account we store the dates of the first and last sign-in — without phone model, advertising identifiers or browser fingerprints.
Crash reports. If you send a report yourself from the settings, we receive the error text, the app version and your note — without name, coordinates or link to the account.
Server logs. Supabase and Netlify keep standard access logs (IP address, time, request address) for security; we do not collect them separately or combine them with your profile.

How long we keep data

account data (profile, visits, posts, votes, follows) — as long as the account exists; after deletion — erased immediately, and from database backups within 30 days;
bonfire — 45 minutes; the last-visit trace for anti-fraud — overwritten by the next visit;
a moment at a landmark — public for 24 hours; the row and the photo are deleted 7 days after it fades (votes stay in karma);
notification subscription and Android token — until you switch them off or delivery fails; notification settings — together with the account; the “trending” and “popular” log — 35 days;
anonymous daily counters — indefinitely, because there are no people in them; active days — together with the account;
moderation log (what was hidden and why) — as long as the post exists; records of blocking for rule violations — as long as the violator's account exists, so that a block cannot be circumvented;
the fact of a payment (payment identifier at the provider, no amounts or cards) — 3 years, as required by accounting rules;
the photo of a UBD certificate for veteran status — until the editors decide: after “yes” or “no” it is deleted, and without a decision — with the account.

Your rights

At any time you can: view and correct your data (everything is in the “Travel Passport”); switch off any visibility, location or notifications (switches in the passport and system permissions); delete the account with everything on the server (one action in the app); obtain a copy of your data in machine-readable form, object to processing or restrict it — by e-mail to info@spadok.net, answered within 30 days. Consent can be withdrawn at any time — this does not affect the lawfulness of processing before withdrawal. If you are in the EU, EEA or the United Kingdom, you also have the right to lodge a complaint with your supervisory authority; in Ukraine — with the Ukrainian Parliament Commissioner for Human Rights.

Where data is stored

The database and photo storage are in Supabase, in a data centre in the European Union (Frankfurt region). The web version is served from the Netlify network. When transferring data outside your country we rely on the standard contractual clauses that Supabase and Netlify apply to their customers. Your data is not sold and is not passed to advertising networks or data brokers — to no one except the processors named here.

What there is not

analytics SDKs, advertising identifiers and device fingerprints; the only accounting is the anonymous counters and the active day described above;
advertising. Partner venues in the lists of amenities near sites are labelled “Partner · advertising” — an editorial placement that collects no data about you;
third-party tracking SDKs;
sale or transfer of your data to anyone;
notifications without your explicit opt-in.

How to delete everything

Data on the device: Travel Passport → Clear progress. The profile, stamps, ratings, travel log and awards disappear — without the possibility of recovery.

Account and everything on the server: Travel Passport → Settings → Delete account. One action inside the app — no letters or requests. Together with the account the profile, visits, reviews, photos, comments, votes, follows, the fact of supporting Spadok and the sign-in record itself — the email address from Google or Apple — disappear. This cannot be undone; the paid Pro period is not refunded. Deletion needs a network connection: if the server does not answer, the app says so and erases nothing — neither there nor on the device.

Completely: delete the app from the phone. In the web version — clear the site data in the browser settings.

If you no longer have the app: write to info@spadok.net from the address the account is registered to, with the word "delete". We will delete the account and everything linked to it within 30 days and reply when it is done. Partial deletion is possible too — only photos, or only reviews; say which.

Direct link to this section for app stores: spadok.net/privacy-en.html#delete.

Children

The app is not intended for children under 13 and knowingly collects no data about them. The map, routes and catalogue can be viewed without an account at any age; an account (community, posts, follows, payments) — only from 13 years of age, and for people in the EU, EEA and the United Kingdom under 16 — with the consent of a parent or guardian. By signing in you confirm this. If we learn that an account belongs to a child below the permitted age, we will delete it; you can notify us at info@spadok.net. The Community Rules prohibit insults and political disputes; reports are reviewed by the editors.

Changes

If the policy changes, the date of the current version below will be updated and the app will say so. The version of 1 September 2026 described the arrival of accounts and the server; the version of 4 September 2026 — community mechanics (bonfire, flame, fire circle, “was with”, folk map, folk art, editing sites) and the OpenStreetMap map. The version of 7 September 2026 added notifications, technical records and retention periods, public authors, verified accounts, the shop, your rights under Ukrainian law and the GDPR, the minimum age and the link to the Terms of Use. The version of 27 September 2026 adds the UBD certificate photo to the veteran status request: who sees it and when it is deleted. The version of 28 September 2026: review photos without metadata, nobody sees other people's votes, deleting the account also erases the sign-in record with the email, and fonts are no longer loaded from Google Fonts — they ship inside the app. The anonymous counters gained four new actions (coming back after a break, “Weekend nearby”, seasonal challenge, landmark video). The same day added place communities (posts in the profile by consent, deletion erases the text) and the AR button via the Google app. The version of 3 October 2026 adds the profile look: profile photo and banner on the server, header colour and a landmark showcase; the same day — Reddit-style publishing (at once, moderation after a report), the “was here” mark next to reviews and communities anyone can create; the same day — the nickname under posts visible to everyone, community subscriptions kept in the account, photos in topics and communities’ own flairs. The version of 4 October 2026 describes Reddit-style notifications: kinds and settings, quiet hours by the phone’s time zone, @handle mentions, vote milestones, the log of sends and Firebase Cloud Messaging for Android. The same day added polls in topics (nobody sees who voted for what), photos in comments, saved items kept with the account and drafts on the device. The same day (0.22.12) — messages to a community’s moderators, hidden posts and “less from this community” kept with the account, user flairs in communities and topic views seen only by the author (without who viewed). The same day (0.22.13) — direct messages (only the two people see them, the team sees only what was reported, notifications carry no text), the “who can message me” setting, people search by nickname (only the nickname and what the profile itself made public can be found; search history stays on the device) and “Ask Me Anything” with a reminder. The same day (0.22.14) — “Follow post”, thanks instead of awards and post insights for the author (view sources and shares — as numbers only). The version of 7 October 2026: people you met by QR see the whole profile and visit days (dates can be switched off in Privacy), the community sees a profile card without links, showcase or places. The version of 9 October 2026: an Instagram post and a YouTube, Vimeo or TikTok video load in the platform's embedded window right away, as soon as the post is on screen, not after a tap.