Tales of Budapest Privacy Policy

Operator and data controller

Tales of Budapest is operated by an individual data controller based in Hungary. For privacy requests, email hi@talesof.app.

Location and walking routes

Location access is optional. When you allow it, the app uses your device location to show your position, estimate arrival at a stop, and support walking features. On mobile, background arrival alerts are enabled only after you separately allow background location and notifications.

When you ask for a personalised tour or walking route, the selected start point and tour-stop coordinates may be sent through the Tales of Budapest API to the routing service. A generated route may be saved with your private tour. We do not intentionally upload or build a continuous history of everywhere you go.

Data kept on your device

Language and playback preferences, tour progress, arrival events, downloaded walks, offline map files, completion records, and playback position are stored locally so the app can work and resume your walk.

A photo you choose for a postcard is resized and stored on your device or in your browser. Tales of Budapest does not upload that photo. A postcard leaves the app only when you explicitly save or share it; the destination app or service then applies its own privacy policy.

Pseudonymous service data

The web app uses a random, HTTP-only visitor cookie and the mobile app uses a signed random installation credential kept in protected device storage. These identifiers are not a name, email address, or advertising ID. They let the service return your private generated tours and limit abusive requests.

Tour preferences and a generated tour can be stored against that pseudonymous identifier. For request protection, the API hashes an incoming IP address before using it for rate limits. Hosting and network providers also process the ordinary technical information needed to deliver an internet request.

Optional product measurement

The current release does not send or queue completion, sharing, referral, or postcard-download analytics. Completion records used to show your walk history and create postcards remain on your device or in your browser.

The app does not include advertising trackers or behavioural-advertising analytics. Ordinary hosting requests still expose technical information, such as an IP address, to the providers that deliver the service.

Error reports

The current web and mobile releases do not send JavaScript error reports or crash diagnostics to Sentry or another diagnostics provider. Settings does not offer a “Share error reports” choice.

If you previously enabled optional reporting on an older mobile build, the current app turns that preference off and does not start the SDK.

Your choices

You may deny or revoke location, background location, notifications, camera, and photo-library permissions in your browser or system settings. Core browsing and manual playback remain available without location. Features that depend on a denied permission will not work.

You can remove downloaded walks and postcard photos inside the app. Clearing browser/app data or uninstalling removes most local records, subject to your operating system and backup settings.

Retention and security

The pseudonymous web cookie and native credential are designed to expire after about one year. Server-side generated tours, request-protection records, and aggregate product events are kept only while needed to run, protect, and understand the service. Access credentials are stored in an HTTP-only cookie or the mobile operating system’s protected store.

No internet service can promise perfect security. Tales of Budapest limits collection and does not ask for a name or email to reduce the impact of a security incident.

Your data-protection rights

Where the GDPR applies, you can request access to your personal data, correction, erasure, restriction of processing and, where applicable, portability. You can object to processing based on legitimate interests and withdraw consent without affecting the lawfulness of earlier processing.

Requests should normally receive a response within one month; any permitted extension must be explained. We may need proportionate information to verify that the records belong to you. Do not send passwords or access tokens. Removing the app or a browser cookie does not itself delete server-side records.

You may complain to a supervisory authority, including the authority where you live, work or consider an infringement occurred. In Hungary, this is the National Authority for Data Protection and Freedom of Information (NAIH).

• NAIH

Questions and privacy requests

For support or a privacy request, email hi@talesof.app. Describe your request and the affected feature; do not send passwords or access tokens. If needed, we will explain how to verify your connection to any pseudonymous server-side records.

• hi@talesof.app