Baltic Traveler
Legal

Privacy Policy

Last updated: 11 May 2026 · Effective date: 11 May 2026

We respect your privacy. This Policy explains what personal data the Baltic Traveler mobile app (iOS & Android) and the website at www.baltic-traveler.com collect, why we collect it, how we use it, and what choices you have. It is written to comply with the EU General Data Protection Regulation (GDPR) and equivalent laws in Lithuania, Latvia, and Estonia.

1. Who we are

The data controller is the Baltic Traveler team. For any privacy-related question, write to hello@baltic-traveler.com.

2. What data we collect

2.1 In the mobile app

  • Anonymous device identifier — a random UUID generated on your device on first launch, used to sync your wishlist and visited locations between app sessions. It is not linked to your name, email, or phone number.
  • Location data — your device's GPS coordinates and compass heading, used in real time to show distances to nearby places and offer navigation. Location data stays on your device unless you explicitly share it (e.g. opening Google Maps for directions). We do not store your location history on our servers.
  • Wishlist & visited state — the list of locations you've saved or marked as visited. Synced with our server against your anonymous device ID.
  • Comments & ratings — when you submit a comment, we store its text, the author name you chose, the location it refers to, the star rating, the date/time, and the anonymous device ID that posted it.
  • Crash & diagnostic data — if the app crashes, Apple/Google may share standard diagnostic logs with us through their developer consoles (with your permission per their OS settings).

2.2 On the website

  • Standard server logs — IP address, browser type, request URL, and timestamp. Kept for up to 30 days for security and abuse-prevention purposes.
  • Google Analytics 4 — only after you click Accept on the cookie banner. GA4 stores a first-party cookie and reports aggregated metrics (page views, country, device class). IP addresses are anonymised.

3. How we use the data

  • To run the Service — show locations, photos, history, and facts.
  • To sync your wishlist and visited locations across sessions.
  • To display your comments to other users.
  • To prevent abuse and protect the Service and its users.
  • To improve content quality based on aggregate, non-identifying usage signals.

4. Legal basis (GDPR)

  • Performance of a contract (Art. 6(1)(b)) — to provide the Service you request when you install and open the app.
  • Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse, and improve content quality.
  • Consent (Art. 6(1)(a)) — for non-essential cookies (analytics) and for OS-level permissions you grant (location, camera).

5. Who we share it with

We do not sell your data. We share limited data with:

  • Hosting and backend providers who run our servers (under processor agreements, EU/EEA-based or under appropriate transfer safeguards).
  • Google Maps Platform / Places API — when the app fetches place photos or details on demand. Google receives your IP address and the place ID, per their Privacy Policy.
  • Apple & Google — as the app distribution platforms, they may receive standard install/usage telemetry per their own policies.
  • Authorities — only when legally compelled (e.g. court order).

6. Cookies (website)

The website uses:

  • Strictly necessary — none beyond the session needed to remember your cookie-banner choice.
  • Analytics (optional) — Google Analytics 4, loaded only after you click Accept. You can change your choice anytime via the “Privacy & Cookies” link in the footer.

The mobile app does not use cookies.

7. Data retention

  • Server logs: up to 30 days.
  • Wishlist / visited state: until you uninstall the app or ask us to delete it.
  • Comments: kept indefinitely so other users can see them, unless removed by you or by us for policy reasons.
  • Analytics data: aggregated and retained according to GA4 defaults (14 months).

8. Your rights (GDPR)

Under EU data-protection law you have the right to:

  • Access the personal data we hold about you;
  • Have inaccurate data corrected;
  • Have your data deleted (“right to be forgotten”);
  • Restrict or object to certain processing;
  • Receive your data in a portable, machine-readable format;
  • Withdraw consent at any time (without affecting prior lawful processing);
  • Lodge a complaint with your national supervisory authority — in Lithuania: State Data Protection Inspectorate (VDAI).

To exercise any of these rights, email hello@baltic-traveler.com with “Data request” in the subject line. Because the app does not collect your name or email, we may need you to provide your device's anonymous ID (visible in the app under Profile → About) so we can identify your records.

9. Children's privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with data, contact us and we will delete it.

10. International transfers

Our servers are hosted in the European Union. Some third-party providers (Apple, Google) may transfer data outside the EEA under their own Standard Contractual Clauses and adequacy decisions.

11. Security

We use industry-standard measures to protect your data: HTTPS everywhere, encrypted database backups, restricted access to production systems, and regular security updates. No system is 100% secure, however; we cannot guarantee absolute protection.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, show a notice in the app. Please review periodically.

13. Contact

For privacy questions, data requests, or complaints, write to hello@baltic-traveler.com.

This Policy is also available within the mobile app under Profile → Legal → Privacy Policy.