Privacy Policy
HELD - Communist Sightseeing
This policy covers the HELD - Communist Sightseeing mobile app, which helps you discover sites of communist history and keep a record of the ones you have visited.
What we collect and why
Account data. When you create an account we store your email address and a password (handled by our infrastructure provider, Supabase; we never see or store the password itself). Your email is used to sign you in and to send you account emails such as password resets — nothing else. No marketing email, ever.
Language. The app remembers the language you choose, on your device. If you have an account, the language the app is shown in is also stored with your account, so that account emails such as password resets reach you in that language. It is updated whenever the app's language changes.
Profile data. Your username, and optionally a profile photo and a home country. Your username, photo and country are visible to other signed-in users so they can find and recognise you.
Your record. The sites you mark as visited (with the date you choose), your wishlist, the badges you earn, and sites or corrections you suggest. Visit records are visible only to comrades whose requests you have accepted — nothing about your record is public. Photos and site suggestions you submit are reviewed by us and, if approved, shown publicly with the site.
Friend connections. Requests you send and accept, and users you block or report. Reports are visible only to us.
Location. With your permission, the app uses your device's location to show sites near you and to offer a check-in when you are close to one. Your location is used on the device at that moment and is never stored on our servers — a check-in records only the site and the date, not where you were.
Address lookup. When you suggest a site, the address field searches for the place as you type it, and moving the map pin fills the address in from wherever you put it. To do that, the text you type and the pin's coordinates are sent to Photon, a place-search service run by komoot on OpenStreetMap data. Only what you enter on that form goes there — never your own location, and nothing identifying you or your account. If you never suggest a site, nothing is sent there at all.
Crash reports. If the app crashes, a report is sent automatically so we can find and fix the fault. It holds the technical detail of the failure — the error, where in the code it happened, your device model, and the operating system and app versions. It does not hold your name, email address, username, location or IP address, and it is not tied to your account. These reports are processed by Sentry on servers in the European Union.
What we do not do
- No advertising, no ad networks, no analytics or tracking SDKs. The only diagnostic data we receive is the crash reports described above, and they do not identify you.
- No selling of your data, and no sharing it for anyone else's purposes. The only third parties involved are those named under Where data lives, each one there because it provides a part of the app — storage, crash reports, address search, maps, updates — and for no other purpose.
- No reading of your contacts, messages, or anything else outside the app.
Where data lives
Data is stored with Supabase (our database, authentication and file-storage provider). Crash reports are handled separately by Sentry, also within the European Union. Address searches on the suggest-a-site form go to Photon, run by komoot; those requests carry only the text you typed and the pin's coordinates, and nothing is stored by us as a result.
Two more services your device contacts directly, which are part of how the app is built rather than places we keep anything. The maps are Google Maps: as you move around a map your device asks Google for the tiles to draw, and if you have granted location permission the map draws your position using Google's own location layer. We receive nothing from that. Updates to the app are delivered by Expo: each time the app starts it asks Expo whether a newer version exists, and that request carries the app version, the platform and a random identifier for the installation — not for you, and not linked to your account.
All traffic between the app and the server is encrypted in transit (TLS). Your sign-in session is stored on your device in the operating system's secure keystore.
Data retention and deletion
Your data is kept for as long as your account exists. You can delete your account at any time from Edit profile → Delete account inside the app — this permanently removes your account, profile, visits, wishlist, photos, friend connections and blocks. Approved site suggestions remain part of the public site catalogue (they are not personal data), but their association with your account is removed.
If you cannot access the app, you can request deletion without it — see the account deletion page.
Children
The app is not directed at children under 13, and we do not knowingly collect data from them.
Changes
If this policy changes, the date above changes with it, and material changes will be announced in the app.
Contact
Questions or requests: dialectical-development@proton.me