Privacy Policy

Last updated: 12 August 2026 · Applies to the hellolocals mobile application (Android and iOS)

hellolocals ("the app", "we", "us") is a digital companion for guests of partner accommodations. This policy explains what personal data the app processes, why, where it is stored, and the rights you have. We collect as little as we can: the app exists to show you information about your stay and your destination, not to profile you.

In short

• We are a small team in the Dolomites, not an advertising company.
• Everything we store is held in the European Union.
• We never sell your data and never share it with advertisers or data brokers.
• We use no Google analytics or advertising services, and no third-party tracking tools of any kind.
• We do not follow you across other apps or websites.
• We measure how the app is used, with our own system on our own servers, and we keep that measurement deliberately separate from who you are.
• We build no advertising or marketing profiles and make no automated decisions about you.
• You can switch usage measurement off at any time in the app's settings.
• Maps are loaded from an external map provider, which is explained in section 3.

1. What data we process, and why

a) Accommodation codes

To see information about the place you are staying, you enter a code provided by your accommodation, either by typing it or by scanning a QR code. These codes belong to the accommodation, not to you. A single code is normally issued for a house, hotel or apartment and is used by every guest who stays there, often over a year or more. It is not created for your stay, is not personal to you, and is not deleted when you leave.

Stored against each code are a label chosen by the accommodation, the property and, where the accommodation chooses, the apartment it applies to, the place it is in, its period of validity, whether it is currently active, and the dates it was first and last used. Because the same code is used by many different guests, entering it does not tell us who you are, and the code alone cannot be used to identify you. Purpose: giving you access to the right accommodation's content. Legal basis: performance of the service you request (GDPR Art. 6(1)(b)).

b) Optional account data

You can optionally create an account. If you do, we store your email address, the name you enter, your date of birth, your nationality, your saved favourites, and a record of the accommodation codes you have used together with the associated stay dates. Passwords are never stored in readable form. Unlike the usage measurement described below, this information does identify you, and we treat it accordingly. Purpose: running your account and showing you your own saved content. Legal basis: performance of the service (Art. 6(1)(b)).

c) Favourites and app preferences

When you mark activities, businesses or accommodations as favourites, or set preferences such as language and theme, we store these to provide the feature. Language and display preferences stay on your device. Favourites are stored in your account if you have one, and on your device if you do not.

d) Camera (QR scanning)

The app asks for camera permission solely to scan an accommodation QR code. The image is processed on your device to read the code and is not recorded, stored or transmitted. You can always type the code instead and refuse the permission.

e) Weather-based suggestions

To suggest activities that suit the weather, the app requests the current forecast for your accommodation's area — not your personal GPS position. No precise device location is collected for this feature.

f) Usage measurement

To understand which parts of the app are useful and which are not, we record how the app is used. This measurement is entirely our own: it runs on our own servers and uses no advertising services, no third-party analytics providers, and no tracking across other apps or websites.

When the app is first installed it generates a random identifier for that installation. This identifier is created by the app itself, is not read from your device or its hardware, and contains no information about you. It is deliberately kept apart from any account: we have no way to connect it to your name, your email address, your account or the code you entered, and we hold no record that would make such a connection possible. Reinstalling the app creates a new, unrelated identifier.

Alongside that identifier we record:

• which screens are opened, and which activities, businesses, accommodations and articles are viewed
• what is searched for within the app, and how many results the search returned
• taps on outbound links such as a telephone number, website, menu or directions
• changes of language, or of the place being browsed
• whether a sign-in or registration attempt succeeded or failed, never the details used
• technical errors, so that faults can be found and fixed

Each record also carries, as context: the app language, the operating system, the app version, the accommodation and place your code relates to, the place you are currently browsing, and whether you were signed in at the time — as a yes or no only, never which account.

Purpose: understanding how the app is used so we can improve it. Legal basis: our legitimate interest in maintaining and improving a service we offer free of charge (Art. 6(1)(f)), balanced against your interests by keeping the measurement unlinked to any identity, collecting no advertising identifiers, and giving you a straightforward way to switch it off. You can object at any time using the setting in the app.

g) Technical data

When the app communicates with our servers or loads map tiles, the receiving servers technically process your IP address and basic request data, as with any internet service. We do not use this to identify you. The app contains no advertising and no third-party advertising or analytics software.

2. Where your data is stored

App data — accommodation codes, accounts, favourites, content and usage measurement — is stored with our backend provider Supabase, on servers in the European Union (AWS eu-central-1, Frankfurt, Germany). Supabase processes it solely on our behalf and on our instructions.

3. Third-party services

When the app loads a map, your device contacts the map provider directly, which means that provider receives your IP address and the area you are viewing. This is technically unavoidable for any map that is not stored on the device. Map data is © OpenStreetMap contributors.

We do not sell personal data and do not share it with third parties for their own marketing.

4. How long we keep data

• Individual usage records are deleted automatically after twelve months. Statistics worked out from them — such as how many times an activity was opened on a given day, and a summary count for each installation — carry no identifier and are kept indefinitely.
• Accommodation codes are kept for as long as the accommodation works with us, and are deleted when that ends.
• Account data is kept until you delete your account. You can delete your account directly in the app (Settings → Profile), which removes your profile data from our systems.
• Local preferences (language, theme) stay on your device and are removed when you uninstall the app.

5. Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict or object to processing (Art. 18, 21),
• receive your data in a portable format (Art. 20),
• lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (gpdp.it).

To exercise any of these rights for your account, email hellolocals.app@gmail.com. We respond within one month.

One limitation is worth stating plainly. Usage records cannot be looked up or deleted individually. They are deliberately not linked to any account, so we cannot tell which records relate to which person, and we will not gather additional information in order to create that link (Art. 11). The setting in the app is therefore the meaningful control over this data: switching it off stops all collection immediately.

6. Children

The app is intended for travellers and their families and is not directed at children. Our Terms of Use set a minimum age of 16 for creating an account. The app contains no advertising. Children do not need their own account to use content shared through a family's accommodation code.

7. Security

Data is transmitted over encrypted connections (HTTPS/TLS). Access credentials on your device are stored using the operating system's secure storage. Access to production data is restricted to the operator.

8. Changes to this policy

If we change what data the app processes, we will update this page and the "last updated" date above, and tell you in the app where the change is significant.

9. Contact

Questions about privacy or this policy: hellolocals.app@gmail.com