JURNIVAL — Privacy Policy

1. Data controller

The controller of the personal data processed through JURNIVAL is:

Davide Delfrate

Privacy contact: privacy@jurnival.com

JURNIVAL is currently a project run by the controller named above.

2. Who JURNIVAL is for

JURNIVAL is a digital application that adds a game element to the travel experience through Challenges, experiences and progression systems.

JURNIVAL is intended for people aged 18 or over.

3. What data we collect

Account data: email address, technical account identifier (UUID), credentials managed by the authentication system and data needed for the session.

Age confirmation: at sign-up, the user's confirmation that they are at least 18 years old is recorded, together with the date and time of that confirmation.

Profile data: display name, bio and profile photo. The profile photo is currently stored in public storage.

Travel DNA and preferences: travel preferences and adventure settings.

Trip data: title, dates, destinations, stops, preferences, number of travelers, pace, surprise level and other information entered voluntarily. Coordinates describe the destination, not the user's GPS position.

Game data: Challenges, completions, XP, badges, feedback, ratings and intention to repeat the experience.

Challenge photos: photos uploaded voluntarily. They are kept in private storage and images are re-encoded before upload; the original EXIF data is not kept.

Jurny photos: photos that a Jurny's creator uploads to present it. They are re-encoded before upload, without the original EXIF data, and kept in public storage: anyone with the Jurny's link, the creator's friends, and the friends of a player who shows an Adventure made from that Jurny can see them.

Free text: it can be used to personalize a Challenge. The user should not enter unnecessary personal data.

4. Data we do not collect

JURNIVAL does not use device geolocation and does not collect real-time GPS position. Nor does it collect biometric data, health data, financial data, address-book contacts or photos without a specific action by the user.

5. Purposes and legal bases

Account creation and management — performance of a contract.

Authentication and session management — performance of a contract.

Adventure and itinerary management — performance of a contract.

Personalization of the experience and of Challenges — performance of a contract.

Challenge generation through AI — performance of a contract.

Completions, XP, badges and progression — performance of a contract.

Photos uploaded by the user — performance of a contract and the user's request.

Security and abuse prevention — legitimate interest of the controller.

Explicit feedback and product improvement — legitimate interest of the controller.

Legal obligations — legal obligation.

JURNIVAL does not currently use personal data for behavioral marketing or personalized advertising.

6. Artificial intelligence

JURNIVAL uses Anthropic via API to generate some personalized Challenges.

The system may receive the trip title, dates, number of travelers, preferences, pace, surprise, names of destinations and stops, public information about the destinations and any notes entered by the user.

In the normal process, no email, user ID, display name, avatar, companions' names, Challenge photos, numerical Travel DNA scores or destination coordinates are sent to Anthropic.

Personal information voluntarily included in free text may be transmitted if it is part of the content used to generate the Challenge.

Anthropic states that inputs/outputs of its commercial products are not used to train its models unless specific conditions apply. The JURNIVAL configuration provides for 30 days of retention, with ZDR not active.

7. International transfers

Some providers may process data outside the European Economic Area. Where necessary, the mechanisms provided for by applicable law are used, including, where applicable, SCCs or other recognized mechanisms.

8. Recipients

The main providers are Supabase, Cloudflare, Anthropic, Brevo, OpenFreeMap, Photon/Komoot and Wikimedia/Wikipedia/Wikidata. Data may also be processed by authorized persons and by authorities when required by law.

Friends: your friends can see your profile page, with your display name, bio, profile photo, level and XP, number of completed Adventures, number of friends, badges, the Jurnys you have shared and the Adventures you have chosen to show them. For those Adventures they also see your own Challenge photos, through temporary links. Showing an Adventure is off by default, you can turn it off at any time, and photos of other participants are never shown.

9. Cookies and similar technologies

JURNIVAL does not use profiling or advertising cookies. Authentication and the selection of the last Adventure use localStorage. Fonts are hosted directly by JURNIVAL.

10. Retention periods

Account data, profile and Travel DNA are kept until the account is deleted, unless further obligations apply.

Adventures, itineraries, Challenges, completions, XP and badges are kept according to the life cycle of the service and until the account is deleted, unless further needs apply. Adventures that other users have joined remain available to them after the deletion of the creator's account (see §11); the deleted user's personal data is removed from them.

Avatar: until replaced or until the account is deleted.

Challenge photos: until removed, or until the Adventure or the account is deleted.

Jurny photos: until removed, or until the Jurny or the account is deleted.

Browser session: until logout or revocation.

Data sent to Anthropic: according to the configuration and the applicable policy; currently 30 days.

Provider logs: according to their respective policies.

Local knowledge cache: 30 days; it contains no personal data of the user.

11. Account deletion

You can request the deletion of your account from the app. Deletion removes your account data and the associated data, including your profile, Travel DNA, completions, XP, badges, friendships, analytics and Challenge photos. Adventures you created are deleted, except those that other users have joined: these remain available to their participants, with their title, itinerary and Challenges, and their management passes to the participant who joined first.

Technical residues may remain in logs, backups or provider systems according to their retention periods.

12. Security

JURNIVAL uses Supabase authentication, RLS, access controls, server-side credentials, an Anthropic API key that is not exposed to the browser, private storage for Challenge photos, temporary URLs and image re-encoding.

13. Your rights

In the cases provided for, you can request access, rectification, erasure, restriction, objection and portability, and lodge a complaint with the competent authority.

Requests: privacy@jurnival.com

14. Supervisory authority

For Italy: Garante per la protezione dei dati personali.

15. Changes

This Privacy Policy may be updated because of changes to the service, providers, legislation or processing methods. The updated version will show the date of the update.

16. Free text

Do not enter unnecessary personal data, special categories of personal data under Art. 9 GDPR, financial data, credentials, documents or confidential information about third parties. Free text used to personalize Challenges may be transmitted to the AI service when necessary.