Privacy Policy of Tortoo

Tortoo is provided by STANIMEROS PANTELEIMON, a sole trader based in Thessaloniki, Greece (ΓΕΜΗ 183133106000, VAT EL165099427). We decide why and how your data is used (the "controller"). Contact: hello@stanimeros.com.

This is what Tortoo handles. Each item is explained in the sections below.

You can sign in with email and password, Google or Apple. If the provider shares them, we receive your name, email and profile photo, plus your account ID. We never see your Google or Apple password.

Trips, events, places, expenses, packing lists and assistant chats are stored in your account. If you share a trip, the people you invite can see it and their name and email are visible to the other members.

If you allow location, the app uses it only while it is open, to show where you are on the map and to center the map on you. Your position stays on your device. We do not send it to our servers or to the weather and place-search services.

The app opens your camera, photo library or files only when you pick something to attach to the trip assistant or to import into a trip, such as a booking confirmation. It is uploaded only when you send it, and is processed by Google Gemini (see AI features).

If you allow the microphone, the app records a voice message only when you use voice input for the trip assistant. The recording is sent through our servers on Google Cloud to the Google Gemini API to transcribe it and answer.

What you send to the trip assistant (text, voice, photos and documents) is processed by the Google Gemini API on a paid tier. Google does not use this data to train its models. Please do not enter sensitive information.

Trip places and destinations are used to show maps (Google Maps), search for places (Google Places), get weather forecasts (Visual Crossing) and find place photos (Wikipedia, Pexels). These services receive the place or destination and dates, not your account details.

Purchases and subscriptions go through the Apple App Store or Google Play and are managed with RevenueCat. We never see your card details. RevenueCat receives an anonymous app user ID and your purchase history so the app knows what you have unlocked.

Tortoo uses Firebase Analytics to see how the app is used. It records app interactions, device and app identifiers (on Android this can include the advertising ID), and your approximate country. We use it in aggregate to fix problems and improve the app, not for advertising.

Firebase Crashlytics sends us a report when the app crashes. It includes your device model, operating system version and the state of the app at the time.

Under the GDPR we rely on these legal bases:

• • Contract, Art. 6(1)(b): to provide the features you asked for and your account.
• • Consent, Art. 6(1)(a): for the device permissions you allow, such as notifications or location. You can withdraw consent at any time in your device settings.
• • Legitimate interests, Art. 6(1)(f): crash reports, aggregated usage analytics and security, so we can keep the service working and improve it.
• • Legal obligation, Art. 6(1)(c): records we must keep by law, such as accounting records.

We use these providers to run Tortoo. Some process data on our behalf. Others, such as the app stores, process it under their own policies.

Google Firebase and Google Cloud, for:

• • Firebase Authentication: sign-in and accounts
• • Cloud Firestore: database for app data
• • Google Cloud: our servers and server-side processing
• • Firebase Analytics: usage analytics
• • Firebase Crashlytics: crash reports
• • Firebase App Check: checks that requests come from the real app.

Google processes this data under its Privacy Policy.

Other providers:

• • Google Gemini API: processes the content you send to AI features (paid tier, not used to train models).
• • RevenueCat: subscriptions and purchase status. Receives an anonymous app user ID and your purchase history.
• • Apple App Store and Google Play: process payments under their own policies. We never see your card details.
• • Google Maps: map display.
• • Google Places API: place and address search. The text you type is sent to Google.
• • Visual Crossing: weather forecasts for your trip destination and dates.
• • Wikipedia: place photos, found by place name.
• • Pexels: place photos, found by place name.

We do not sell your personal information or use it for advertising.

Some of the providers above, such as Google, may process data in the USA. These transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

• • Account and app data: until you delete it or your account. We handle deletion requests within 30 days.
• • Crash reports: about 90 days.
• • Usage analytics: up to 14 months.
• • Data on your device: until you clear it or uninstall the app.
• • Purchase records are kept by the app store and RevenueCat under their own policies.
• • Records we must keep by law are kept for the required period.

Giving us data is not a legal requirement. Some features need it, and without it those features will not work.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

You can ask us to:

• • give you access to your data
• • correct it
• • delete it
• • restrict how we use it
• • stop using it for certain purposes (object)
• • give you a copy you can move elsewhere (portability)

You can withdraw your consent at any time. You can object at any time to processing based on legitimate interests, such as analytics and crash reports.

To use these rights, email hello@stanimeros.com or use the data deletion page. We reply within one month. You can also complain to the Hellenic Data Protection Authority at www.dpa.gr.

Data is encrypted in transit (HTTPS) and stored with Google Cloud/Firebase, which encrypts data at rest. We limit access to what is needed to run the service. No system is completely secure.

Tortoo is not intended for children under 15. We do not knowingly collect their data. If you think a child has given us data, contact hello@stanimeros.com and we will remove it.

If we change this policy, we update the date at the top of this page.

Questions about this policy or your data: hello@stanimeros.com.

Thessaloniki, Greece