Privacy policy

Monuments · app.monuments · Last updated: 7 October 2026

This policy explains how Monuments handles personal data when you use the app, create an account, save your journey, or activate a subscription.

1. Data we process

We process only the data needed to provide Monuments features:

• Account: email address, password (stored only in encrypted form) and technical identifiers generated by the Supabase Auth authentication service when you create an account or sign in.
• Journey: visited monuments, visit dates, ratings, notes, and wishlist. This data stays on your device and, when you are signed in, is synced to your account on our server. Ratings are also used, in aggregate and without identifying anyone, to calculate each monument’s public average rating.
• Personal photos: images you choose to personalise a monument. They are stored on your device and, when you are signed in, uploaded to our server and linked to your account so you can restore them on another device. They are not public or shared with third parties, and are deleted from the server when you remove them or delete your account.
• Preferences: language, home country, countries to visit, and monument categories. They stay on your device and, when you are signed in, in your account profile.
• Subscriptions: a technical account identifier, Premium subscription status, and the information needed to validate purchases and restorations. Payments are processed by Apple (App Store) or Google (Google Play); we never receive your card details.
• Support: email, category, language, message, and your app preferences (plan, home country, countries, and categories) when you send us a message from the app.
• Location: approximate device location, only if you grant permission, to suggest your home country and sort nearby monuments. We do not store your location or send it to our server. To identify the country, your operating system may use Apple’s or Google’s geocoding service.

2. How we use data

We use data to create and protect your account, sync your journey and photos across devices, provide Premium features, answer support requests, keep the app stable, and meet legal obligations.

The legal basis is providing the service you request by using the app, your consent for location and photo access (which you can withdraw in your device settings), our legitimate interest in keeping the service secure, and compliance with legal obligations.

We do not sell personal data, show ads, share data with advertising networks, or track your activity in other apps or websites.

3. App Store and Google Play subscriptions

On iPhone, monthly and annual subscriptions are charged to your Apple account by the App Store. They renew automatically unless cancelled at least 24 hours before the end of the current period. You can manage or cancel renewal in your Apple account settings.

On Android, subscriptions are charged to your Google account by Google Play and renew automatically until cancelled. You can cancel at any time in the Google Play app under Payments & subscriptions > Subscriptions; Premium access remains until the end of the period already paid.

The price, duration, and applicable terms are shown before you confirm a purchase. You can use Restore purchase in the app. Apple, Google, and RevenueCat may retain transaction records under their own policies and legal obligations.

4. Service providers

We use providers that process data only to deliver the necessary services: Supabase (authentication, account management and database, European Union); Render (server hosting, European Union); RevenueCat (subscription management, USA); Apple and Google (app distribution and payments); and Resend (support email delivery, USA).

Some of these providers process data outside the European Economic Area. In those cases, transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

5. Retention and security

We keep account data, journey data, and personal photos while your account is active. We keep support messages for as long as needed to answer the request.

When you delete your account, we immediately remove your journey, personal photos, and support messages from our server and delete your Supabase sign-in account. Records of purchases and subscriptions are not deleted: Apple, Google, and RevenueCat keep them, linked to a technical account identifier, to meet legal and accounting obligations. Database backups may contain this data for a limited period until they are automatically replaced. Local data is removed from your device in the same step or when you uninstall the app.

Communication with the server is encrypted (HTTPS) and your session is kept in the device’s secure storage. No internet-connected service can guarantee absolute security.

6. Deleting your account

You can delete your account and all associated data in the app under Account > Delete account. Deletion is immediate and cannot be undone. Purchase records are kept, as described in section 5.

If you no longer have the app installed, email monuments.support@gmail.com from your account’s address with the subject “Delete account”. We delete the account within 30 days and confirm by email. Deleting your account does not cancel an active subscription: cancel it in the App Store or Google Play as well.

7. Your rights

You may request access, correction, deletion, restriction, objection, or portability of your data, and withdraw consent where processing is based on consent.

To exercise these rights or ask a question, contact us at the address below. You may also complain to the Portuguese data protection authority (CNPD) or the data protection authority in your country.

8. Children

Monuments is not directed to children and does not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can act.

9. Changes

We may update this policy to reflect changes to the app, providers, or law. We will publish the updated version on this page and show the latest revision date.