Privacy Policy

1. Who We Are

Take the Scenic Route ("TTSR") is a travel journal and trip planning application developed and operated by:

Pomme Bleue is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

EU Representative

If you are located in the European Economic Area (EEA), you may contact our EU representative at: [Pomme Bleue EU Representative Address — to be confirmed].

Data Protection Officer (DPO)

We have appointed a Data Protection Officer who can be contacted at privacy@ttsr.net for all matters relating to data protection.

2. How This Policy Applies

This privacy policy explains how Pomme Bleue collects, uses, shares, and protects your personal data when you use:

• The TTSR mobile app (iOS and Android)
• The TTSR web application (Next.js)
• Any related services, features, or communications

It applies to all users of TTSR, whether you are based in the United Kingdom, the European Economic Area (EEA), or elsewhere.

3. What Personal Data We Collect and Why

We collect and process the following categories of personal data. For each category, we explain the lawful basis we rely on under Article 6 of the UK GDPR and EU GDPR.

3.1 Account and Profile Data

Note on Privacy Consent Audit Trail: When you sign up and accept this Privacy Policy, we record your IP address in a dedicated privacy_consents table. This creates a tamper-resistant audit trail of when and from which IP address you provided your consent, as required under Articles 7(1) and 5(2) of the UK GDPR and EU GDPR (accountability principle). No further IP address tracking occurs beyond this one-time capture at signup.

3.2 Trip and Journal Data

3.3 Location Data

3.4 Photos and Media

3.5 Communications and Feedback

3.6 Analytics and Error Monitoring

4. How We Collect Your Data

We collect personal data through the following methods:

• Direct input: Information you provide when creating an account, setting up your profile, planning trips, writing journal entries, or submitting feedback.
• Automatic collection: Device information, app version, and error data collected through PostHog analytics and our error capture system.
• Device permissions: With your consent, we access your device's GPS for location-based features and your photo library for uploading images. You can manage these permissions at any time through your device settings.
• We do not purchase personal data from third parties.

5. How We Share Your Data

We do not sell your personal data. We share your data only with trusted service providers (data processors) who help us deliver the TTSR service. All processors are contractually bound to process your data only on our instructions and to implement appropriate technical and organisational security measures.

Third-Party Data Processors

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom and the European Economic Area (EEA), including:

• United States (Supabase, PostHog, Resend, OpenWeatherMap, Geoapify, Open-Elevation, iTunes Search API)
• China (DeepSeek)
• Global (OpenRouter, OpenStreetMap)

When we transfer your data to countries that the UK Government and the European Commission have not deemed to provide an adequate level of data protection, we apply the following safeguard measures depending on the provider and the nature of the data:

• Standard Contractual Clauses (SCCs) adopted by the European Commission and the UK International Data Transfer Agreement (IDTA). Used for major providers (Supabase, PostHog, Resend) through their standard Data Processing Agreements.
• Data minimisation and transient processing for services where formal SCCs are not commercially available (free-tier APIs, open data services). Only the minimum data needed for the feature is sent, and it is not stored by the provider beyond the immediate request.
• Encryption in transit using TLS 1.2+ for all API communications.

You can request a copy of the relevant safeguards by contacting us at privacy@ttsr.net.

7. Cookies, Local Storage, and Similar Technologies

We use cookies and similar local storage technologies to provide and improve our service. Below is a summary of the technologies we use:

7.1 Essential Cookies and Storage

These are necessary for the service to function and cannot be disabled:

7.2 Analytics Storage

7.3 Cache Storage

7.4 Managing Cookies and Local Storage

You can control and manage cookies through your browser settings. On mobile, you can clear app data through your device settings. Note that disabling essential cookies/storage may prevent the service from functioning properly.

8. Data Retention

We retain your personal data only for as long as necessary to provide the service:

When you delete your account, all your personal data is permanently deleted through a cascading delete process. Cache entries and local SQLite data on your device will persist until cleared through the app or device settings.

9. Your Rights Under UK GDPR and EU GDPR

You have the following rights regarding your personal data. These rights are available to all users under the UK GDPR and EU GDPR, regardless of where you are based:

Right to Access (Art. 15)

You have the right to request a copy of the personal data we hold about you, along with information about how we process it.

Right to Rectification (Art. 16)

You have the right to correct any inaccurate or incomplete personal data. You can update most of your data directly through your profile and account settings.

Right to Erasure (Art. 17) — "Right to be Forgotten"

You have the right to request the deletion of your personal data. You can delete individual postcards, trips, or your entire account through the app. We will process your request without undue delay.

Right to Restrict Processing (Art. 18)

You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while a correction request is being verified).

Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON), and to transmit that data to another controller without hindrance.

Right to Object (Art. 21)

You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis. We will comply unless we have compelling legitimate grounds that override your interests.

Rights Related to Automated Decision-Making (Art. 22)

You have the right not to be subject to a decision based solely on automated processing. Our AI features (activity suggestions and haiku generation) are optional tools that require your active input and are not used for automated decision-making that produces legal effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@ttsr.net. We will respond to your request within one month (extendable by two months for complex or multiple requests). We may ask you to verify your identity before processing your request.

10. Security Measures

We implement appropriate technical and organisational security measures to protect your personal data, including:

• Row-Level Security (RLS) on all database tables — users can only access their own data
• JWT authentication with PKCE flow (mobile) and HTTP-only cookies (web)
• Password hashing managed by Supabase Auth (bcrypt-based)
• SQL injection prevention through column allowlists and parameterised queries
• Prompt injection sanitisation on all AI features to prevent misuse
• Admin multi-factor authentication (TOTP-based MFA for admin accounts)
• Rate limiting on admin routes (60 requests/minute per IP)
• HTTPS/TLS encryption for all data in transit
• Content Security Policy (CSP) headers on web routes

11. Children's Privacy

TTSR is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@ttsr.net and we will take steps to delete such information.

Note: The UK GDPR sets the digital age of consent at 13, while EU member states may set it between 13 and 16. We apply the highest standard (16) across all jurisdictions.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any material changes by:

• Displaying a notice within the app and/or website
• Sending an email notification (if we have your email address)
• Updating the "Last updated" date at the top of this policy

We encourage you to review this policy periodically. Material changes will take effect30 days after notification.

13. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact our Data Protection Officer:

14. Right to Complain

If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority:

In the United Kingdom

Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

In the European Union

You may lodge a complaint with the local data protection authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. Contact details for all EU data protection authorities are available at edpb.europa.eu.

We would appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us first at privacy@ttsr.net.

15. Legal Framework

This privacy policy is designed to comply with:

• The UK General Data Protection Regulation (UK GDPR) — as retained in UK law post-Brexit
• The EU General Data Protection Regulation (EU GDPR 2016/679)
• The Privacy and Electronic Communications Regulations (PECR) — UK
• The ePrivacy Directive (2002/58/EC) — EU

Disclaimer

This privacy policy is for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction, and you should consult with a qualified legal professional to ensure compliance with applicable data protection regulations.

This document was generated for Take the Scenic Route (TTSR) and reflects current UK and EU data protection requirements as of 4 July 2026.