Privacy Policy

Last updated: October 2026

This Privacy Policy explains what personal data Neo Seichi (“we”, “us”) collects when you use our mobile app and website, why we collect it, and what rights you have regarding your data under the GDPR (EU General Data Protection Regulation).

1. Who is responsible

The data controller responsible for processing your personal data is listed in our Impressum.

2. What data we collect

• Account data: display name, username, email address, password (stored as a salted hash, never in plain text), and optionally a profile picture and bio, if you register directly.
• Google Sign-In: if you sign in with Google, we receive your Google account ID, name, email address, and profile picture from Google to create or match your Neo Seichi account. We never receive your Google password.
• Location data:with your permission, we use your device's GPS location to show nearby pilgrimage spots and to verify check-ins (“stamps”) at a location — a check-in is only recorded if you are physically close enough to the spot. We store the distance measured at check-in time, not your continuous location history.
• Photos: photos you upload (spot photos, profile picture) are stored with our image hosting provider, Cloudinary.
• User content: reviews, ratings, check-ins, favorites, trip lists, and any community spot submissions you create.
• Technical data: standard server request logs (IP address, timestamps) for security and abuse prevention.
• Advertising and consent data: Google AdMob and Google's User Messaging Platform (UMP) may process your IP address, device and app information, ad interactions, and consent choices to manage consent and serve ads. We request non-personalized ads and do not send your account details, GPS location, or search terms to AdMob. Non-personalized ads can still use device storage and technical identifiers for purposes such as fraud prevention and frequency capping.
• Diagnostic data: if the app crashes or an error occurs, we collect crash reports and diagnostic data (device information, IP address, app logs, and a short session replay of your on-screen interaction leading up to the error) via our error-monitoring provider, Sentry, to help us find and fix bugs.

3. Why we process your data

• To create and manage your account and authenticate you (Art. 6(1)(b) GDPR).
• To show nearby spots on the map and verify geofenced check-ins (Art. 6(1)(b) GDPR).
• To display your reviews, photos, and contributions to other users (Art. 6(1)(b) GDPR).
• To maintain the security and integrity of the service (Art. 6(1)(f) GDPR).
• To diagnose and fix crashes and errors in the app (Art. 6(1)(f) GDPR, legitimate interest in a functioning, reliable service).
• To send you transactional emails, such as email verification and password reset (Art. 6(1)(b) GDPR).
• To fund the app through non-personalized advertising and manage your advertising consent. Where consent is required for device storage or related processing, we request it through Google UMP before requesting ads (Art. 6(1)(a) GDPR).

4. Third-party services

We use the following third-party services to operate the app:

• Google (Sign-In, Maps & Places): for authentication, map display, and location-based place data. See Google's Privacy Policy.
• Google AdMob and UMP:for mobile banner ads and regional consent forms. The app does not request Apple's tracking authorization. Where an ad privacy-settings entry point is required, you can reopen it on the Discover tab without an account and change your choices. See Google's advertising privacy information.
• Cloudinary: for hosting user-uploaded images. See Cloudinary's Privacy Policy.
• Railway: for hosting our backend server and database.
• Sentry: for crash reporting, error monitoring, and session replay to help us diagnose and fix bugs. See Sentry's Privacy Policy.
• Resend: for sending transactional emails (email verification, password reset). See Resend's Privacy Policy.

5. Data retention

We keep your account data for as long as your account is active. If you delete your account in the app (Profile → Delete Account), your account data, check-ins, reviews and other linked content are removed from the app database. Approved public spots may remain without a link to your account. Images still linked to your account are removed from Cloudinary. For previously replaced images or an alternative request method, see our account deletion page.

6. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (also available directly in the app).
• Request a copy of your data in a portable format.
• Withdraw consent (e.g. revoke location permission) at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us using the details in our Impressum.

7. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above.