1. Who is responsible

The data controller is Domenico Bencivenga, an individual developer based in Italy. Contact for any privacy question or request: domenico.bencivenga03@gmail.com.

2. What we collect

• Account: your email address (verified with a one-time code), the name you enter, your university, and optionally your program, year of study, interests, a profile photo and a password. A password is stored only as a salted scrypt hash, never as the password itself.
• Content you create: your connections and the messages you exchange with connected students.
• Reports you send about outdoor workout spots (“Nothing here”): which spot and when. They hide spots that are gone; other students never see who reported a spot.
• Your personal QR code: an opaque random token that contains no personal data.
• Technical basics: the cookies that keep you signed in and standard server logs (IP address, browser, time) kept by our hosting provider for security.
• Anonymous page counts: which pages are opened, the site you came from, your country and region, and your device and browser type. Addresses are trimmed before they are counted, so sign-in links, search text and conversation ids are never included, and visits are grouped by a hash that is thrown away after 24 hours.
• Location, only if you turn it on: your device’s coordinates are stored in a cookie on your device (rounded, for one day) and sent to our server as a search parameter. We do not save them on your profile and keep no location history.

3. Why we use it

• To run the Service: sign you in, show your profile to connected students, deliver messages and suggest reading for your field (contract).
• To find places and events near you or near your campus (consent for precise location; otherwise your campus is used).
• To keep the Service safe: rate-limit sign-in codes, prevent abuse, handle reports (legitimate interest).
• To email you sign-in codes. We do not send marketing emails.

4. What we do not do

• No advertising and no ad tracking.
• No sale of personal data and no sharing for marketing.
• No advertising cookies and no tracking across other sites: our page counts come from Vercel Web Analytics, which uses no cookies and cannot tell who you are.
• We do not read private messages, except to review a report of abuse. Messages are encrypted in transit and at rest but are not end-to-end encrypted.

5. Who processes your data

We use a small set of providers; each receives only what its job needs.

• Vercel (hosting and server logs) and Neon (database) store account data and messages.
• Vercel Blob stores the profile photo you upload.
• Vercel Web Analytics counts page views; it receives the trimmed page address, the site you came from, your country and region, and your device and browser type, never your name, email or IP address.
• Resend delivers sign-in emails; it receives your email address and the code.
• Google Places API answers place searches; it receives the search text and the coordinates used as the search centre (your campus, or your location if enabled), never your name or email.
• Open Library answers book searches (title or ISBN only).
• OpenStreetMap data for outdoor workout spots is looked up through a public Overpass API server (overpass.private.coffee); it receives an approximate search area (the search centre rounded to about 1 km), never your name or email.
• University calendars are fetched by our server on a schedule; nothing about you is sent to them.

Some providers process data in the United States. Where data leaves the European Economic Area we rely on the safeguards required by the GDPR, such as standard contractual clauses.

6. Cookies

• pe_session — keeps you signed in (up to one year, renewed while you keep using the app).
• pe_signup — remembers that your email was verified while you finish creating your profile (30 minutes).
• pe_loc — your approximate location, only if you enabled it (one day).

These cookies are strictly necessary for the features you use. We set no third-party cookies.

7. How long we keep data

• Your account, connections and messages: until you delete your account or ask us to.
• Reports on outdoor workout spots: until you delete your account (they are removed with it).
• Sign-in codes: stored only as hashes, valid for 10 minutes and removed within a day.
• Server logs: for the short retention period applied by our hosting provider.
• Page counts: kept as aggregated statistics; the hash that groups one visit is discarded after 24 hours.

8. Your rights

Under the GDPR you can ask to access, correct, export or delete your data, object to or restrict certain processing, and withdraw consent (for example, by turning location off in your browser). Email domenico.bencivenga03@gmail.com and we will answer within one month. You can also complain to your data-protection authority (in Italy, the Garante per la protezione dei dati personali).

9. Children

The Service is not intended for children under 13. If you believe a child has created an account, contact us and we will remove it.

10. Changes

We may update this policy as the Service evolves; the date at the top shows the latest version. Significant changes will be announced in the app.