Applies to the Croatia Atlas website and the CroVenture app, operated by Gearstack, obrt za računalno programiranje i usluge, vl. Kristijan Bezjak, Zagreb (see the legal notice). Plain-language version.
CroVenture is a gamified tourist map of Croatia. It is designed to collect as little data as possible.
What we process
- Precise location (GPS). Used on your device to reveal the map and detect when you are near a place. If the cloud backend is active, a discovery event (place id and coordinate) is sent for anti-cheat validation. Never used for advertising or cross-app tracking.
- Exploration progress. Discovered places, badges and quest progress. Stored locally, and when the cloud backend is active, synced under a randomly generated Firebase user ID. Guest progress is pseudonymous. If you choose to sign in, it is linked to your account so it can be restored on another device.
- Community place proposals. If you choose to suggest a place, we process its name, category, description, optional source link, your fresh GPS coordinate and up to three optional photos. These stay private to the moderation workflow and are never published automatically.
- Optional account data. If you use Apple, Google or email sign-in, Firebase Authentication processes your user ID and, where provided, your name and email address for sign-in and cloud sync. We may also use your account email for necessary account and security messages and for service messages about an explicitly announced treasure hunt in which you participate. Creating an account or participating in a treasure hunt never signs you up for marketing or a newsletter.
- Previous purchases. If you previously bought permanent ad removal, the entitlement and purchase date remain stored under your Firebase user ID so the app can keep honouring it. The purchase is no longer offered. Apple or Google handled the payment details.
- Optional news notifications. If enabled, Firebase Cloud Messaging processes an app-installation token and technical device data needed to deliver notifications.
- Service diagnostics and sign-in metadata. Firebase and Google Sign-In process limited technical diagnostics, identifiers, interaction data and other service metadata for app functionality and service analytics. Google Sign-In also declares possible coarse location, phone number and other account metadata. The app requests only basic profile and email scopes.
- Advertising data. Google Mobile Ads in the app and Google AdSense on the website may process IP address, device or advertising identifiers, approximate location, ad interactions, consent choices and technical diagnostics to select, deliver, measure and protect ads. Available identifiers and personalization depend on your consent, device settings and region.
- Language preference. Stored locally only.
- Newsletter email (website, optional). If you separately request the newsletter and confirm your address through the voluntary double opt-in, we store your email address and confirmation status to send it. This consent is separate from an app account and treasure-hunt participation. You can unsubscribe at any time; on request we delete your address.
The app does not upload your personal moment clips and does not collect contacts. It does not include Firebase Analytics. Advertising and consent SDKs process only the data described above, subject to your available privacy choices.
Advertising, affiliate links and cookies
Content pages may display responsive Google AdSense placements. Where required, a Google consent message asks for your choice before personalized advertising or related storage is used. You can change or withdraw consent through the displayed privacy options. Google may use cookies or similar technologies according to the choice you make.
With your consent, this website uses Google Analytics 4 to measure page views, traffic sources, interactions and Core Web Vitals. Google may process online identifiers, IP-derived approximate location, device and browser data, referrers, visited pages and interaction or performance events. In the EEA, the United Kingdom and Switzerland, Analytics storage is denied by default and follows the choice made in the Google consent message. You can change that choice through the privacy and cookie settings in the footer.
Some links on this website are affiliate links: tours and activities link to GetYourGuide. If you book after clicking such a link, we may earn a commission at no extra cost to you. Attribution works through parameters inside the links themselves: this website does not itself need an Atlas affiliate-tracking cookie. Google Analytics and AdSense may use cookies according to your consent. Partner sites set their own cookies under their own privacy policies once you click through.
Legal bases (GDPR)
Where the GDPR applies, we rely on: your consent (Art. 6(1)(a)) for precise location, granted through the system permission and revocable in your device settings at any time, and separately for the double-opt-in newsletter; performance of contract (Art. 6(1)(b)) for core app functionality, requested account services and service messages needed for a treasure hunt in which you participate; and legitimate interests (Art. 6(1)(f)) for account security, anti-cheat validation and short-lived hosting logs. Advertising personalization and advertising storage rely on consent where required by law. Analytics storage and consent-based website measurement also rely on your consent.
Third parties
- Google Firebase and Google Sign-In provide guest and optional account authentication, cloud progress, purchase entitlements, private proposal moderation, server validation, optional news notifications and limited service diagnostics.
- Apple MapKit (iOS) and the Google Maps SDK (Android) render the map and 3D views.
- Wikimedia Commons serves place photos (image requests only).
- Open-Meteo provides weather data in the app (coordinate-based requests, no account).
- Google Mobile Ads serves app advertising and Google AdSense serves website advertising, including consent and ad measurement services.
- Google Analytics 4 measures consented website traffic, interactions and Core Web Vitals.
- GetYourGuide powers the affiliate links on the website (see above).
- Cloudflare hosts this website and keeps short-lived technical server logs.
We do not sell personal data. Google may process advertising data as described above.
International transfers
Some providers (Google Firebase, Cloudflare) may process data on servers outside the EU, including in the USA. Such transfers rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
Data retention
Hosting logs are short-lived. Cloud progress, account data and purchase entitlements are kept until you delete the account in the app, except records we must retain by law. Incomplete proposal-image uploads are removed after 24 hours. Attached moderation photos are removed within 180 days after moderation ends. Account deletion removes open proposals and their photos; completed moderation records may remain without the reporter ID for editorial audit and abuse prevention. Unlinked SDK diagnostics and advertising data follow the relevant processor's service, consent and legal retention periods. Google Analytics event-level data is retained for 14 months. Newsletter addresses are kept until you unsubscribe or ask us to delete them.
Your choices
On-device data lives until you reset it or uninstall the app. You can revoke location and notification access in system settings. The app provides advertising privacy options in Settings when required, and the website presents consent choices where applicable. The privacy and cookie settings link in the footer lets you change or withdraw the website choice at any time. You can permanently delete your account and its associated cloud data directly in the app under Settings. You can also contact us for help.
Your rights (GDPR)
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and you can withdraw consent at any time with effect for the future (Art. 7(3)). You can also lodge a complaint with a data protection authority (Art. 77), for example the Croatian supervisory authority AZOP (azop.hr) or the authority where you live.
Children
A general-audience travel app, not directed at children, and we do not knowingly collect data from them.
Contact
Questions about privacy? Reach us via the contact page.