Valicai Privacy Policy
Version 1.0, effective from 21 October 2026. Last updated: 21 October 2026.
This policy explains which personal data Valicai (the iPhone and Android app app.valicai.mobile and the website valicai.app) processes, why, for how long, and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003). If the Italian and English versions differ, the Italian version prevails.
1. Summary
- We use your location only while you use the app, or while a navigation you started is running. Never in the background without active navigation.
- The tracks you record are private. If you choose to, they contribute anonymously to an aggregated count of how many people walked a trail.
- Report photos are published without the file metadata (EXIF). We store the report location separately, because it tells others where the problem is.
- Conversations with the AI assistant are processed by Anthropic and deleted from our systems after 30 days.
- No ads, no marketing tracking, no sale of data.
- You can delete your account from the app at any time.
2. Who the controller is
Thomas Casali, private individual. The controller can be contacted at the email address below.
Email for any privacy matter: privacy@valicai.app.
We have not appointed a Data Protection Officer: at the current size of the service it is not required (Art. 37 GDPR).
3. What data we process and why
The table is a summary. Sections 3.1-3.12 give the details.
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and managing your account | email, name, Google or Apple identifier, password (email login only, stored as a one-way hash), language | performance of a contract, point (b) |
| Showing you on the map, suggesting nearby routes, giving you the route weather | precise device location, while you use the app | performance of a contract, point (b) |
| Navigation with junction and off-route alerts | precise location during navigation, also with the screen off | performance of a contract, point (b) |
| Recording and storing your tracks | GPS track with times and elevation, distance, ascent | performance of a contract, point (b) |
| Counting trail passages (optional) | tracks you chose to share, turned into anonymous counts | consent, point (a) |
| Publishing your trail condition reports | text, type of issue, photos, location and time of the observation, "still there?" confirmations | performance of a contract, point (b) |
| Moderating content, handling Report and Block | reports, flagged content, blocked users, reasons for decisions | legitimate interest in a safe service, point (f); legal obligations of hosting services, point (c) |
| Expected return | route, times, last position sent, name and email of your contact | performance of a contract for your data, point (b); legitimate interest for the contact's data, point (f) |
| AI assistant | messages you write, answers, token usage | performance of a contract, point (b) |
| Push notifications | device token, platform, preferences | performance of a contract, point (b) |
| Security, abuse prevention, technical operation | server logs (IP address, date, request, outcome) | legitimate interest, point (f) |
| App stability | crash reports, not linked to your identity | legitimate interest, point (f) |
| Computing trail status from public sources | public documents from authorities (orders, notices), which may contain names of third parties | legitimate interest, point (f) |
| Answering your requests and defending our rights | correspondence, request records | legitimate interest, point (f); legal obligation, point (c) |
Where the basis is legitimate interest, we have assessed that our interest does not override your rights. You can object at any time (section 8).
3.1 Account
You can sign in with Google, with Apple, or with email and password. With Google and Apple we receive the account identifier, the email address (with Apple it may be a relay address) and, if you allow it, your name. If you sign in with Apple, we keep an encrypted token that lets us revoke access when you delete your account.
The trail catalogue, route pages and map also work without an account. You need an account to save routes, record tracks, send reports, use expected return and the AI assistant.
3.2 Location
The app asks for location access "while using the app". It never asks for "always" access.
- With the app open, location is used to show you on the map, find nearby routes and request the weather. For these uses your location reaches our servers only to answer the request; we do not store it in your profile.
- During a navigation you start, the app keeps reading your location with the screen off. On Android it uses a foreground service that shows a persistent notification; on iPhone you see the blue location indicator. When you stop navigating, location reading stops.
- Location is not used to profile you or for advertising.
If you deny the permission you can still browse the catalogue, route pages and maps.
The camera is used for the AR view at junctions and to take report photos. AR view images are processed on the phone and are neither stored nor sent. The compass and motion sensors are also read only on the phone, to orient the map and the AR view.
3.3 Tracks and passages
When you record a hike, the app stores the track points on the phone and uploads them to your account at the end. The track is private: only you can see it. You can delete it at any time from the app.
If you turn on "Contribute to passages", the track is used to count how many people walked a route on a given day. We publish only daily counts per route, and only when the number reaches a minimum threshold of 5 people, so nobody can trace a count back to you. You can turn the option off whenever you want: later tracks will no longer be counted.
3.4 Reports and photos
A report contains the type of issue (for example landslide, fallen tree, missing waymarks), a description, one or more photos, and the location and time of the observation. Published reports are visible to other users and may contribute to the trail status. We do not show your name or email publicly.
We strip the file metadata (EXIF) from photos, including GPS coordinates and phone model. We store the location as a separate field of the report. Please do not photograph recognisable people or number plates.
Reports go through an automatic filter and may be reviewed by moderators, who may include volunteers we have authorised and bound to confidentiality.
3.5 Expected return
You can set the route, your expected return time and a person to notify. If you do not confirm your return by that time plus the margin you chose, we send a notification to you and then an email to your contact with your name, the route and the last position the app sent.
Expected return is not a rescue service and does not alert 112. In an emergency, call 112.
If you are a user's emergency contact. You received an email because a Valicai user entered your name and email as the person to notify. We process your name and email only to send you that alert; we store them encrypted and delete them 30 days after the hike is closed. The legal basis is the legitimate interest of the user, and yours, in being alerted if someone does not come back (Art. 6(1)(f) GDPR). You can stop receiving alerts from Valicai with the link in the email, and you can exercise the rights in section 8 by writing to the address in section 2.
The user confirms in the app that they informed you before entering your details.
3.6 AI assistant
The assistant answers questions about trails using Valicai's data. The messages you write and the answers are processed by Anthropic (section 5), which provides the language model. We send Anthropic the conversation text and the catalogue data needed for the answer. We do not send your name or email; to prevent abuse we may attach a random identifier that only we can link to your account.
Under its contract, Anthropic does not use customer content to train its models. Even so, please do not write health data or other sensitive information that the question does not need.
We keep conversations for 30 days, and usage counters (tokens and cost, no text) for 12 months to apply usage limits.
The assistant's answers are generated by an artificial intelligence system and are marked as such, also in the technical data, as required by Article 50 of Regulation (EU) 2024/1689 (AI Act).
3.7 Push notifications
If you allow notifications, the phone generates a technical identifier (token) that we send, with the platform and app version, to Google's Firebase Cloud Messaging service to deliver alerts: closure of a saved route, expected return, replies to your reports. The token is deleted when you turn notifications off, sign out or delete your account.
3.8 Server logs and crashes
Our servers record technical request data (IP address, date and time, requested address, outcome, duration) for security and to fix faults. We keep it for 14 days.
The app sends crash reports through Firebase Crashlytics: phone model and operating system, app version, the technical trace of the error and an installation identifier. They are not linked to your account.
3.9 Moderation and abuse
To keep the service safe we record flagged content, who flagged it, the decisions taken with their reasons, and blocked users. If we remove your content or restrict your account, we tell you why and how to challenge the decision (see the Terms of Use).
3.10 Service emails
We write to you only for service reasons: email verification, password recovery, security alerts, significant changes to the terms or to this policy. No newsletter without your explicit consent.
3.11 Third-party data from public sources
To compute trail status we collect documents published by public authorities and parks (orders, notices, official notice boards). These documents may contain people's names, for example the signatory of an order. We extract only the trail information and a short quote of the source (300 characters at most); we keep the document for 12 months. Extraction may go through Anthropic. If your name appears in one of these documents and you want to exercise your rights, write to us.
3.12 Website valicai.app
The website shows information pages, this policy and the account deletion page. It uses no profiling cookies and no analytics tools.
4. What we do not do
- No advertising and no advertising identifier in the app.
- No tracking across third-party apps or websites, no transfer to data brokers, no sale of data.
- No background location reading outside a navigation or recording you started.
- No use of your data to train artificial intelligence models, ours or the provider's.
- No decision based solely on automated processing that produces legal effects on you (Art. 22 GDPR). The traffic-light status is about trails, not people. The automatic report filter may hold content for a moderator, who makes the decision.
5. Who we entrust data to
These providers process data on our behalf as processors (Art. 28 GDPR), under a binding contract.
| Provider | What it does for us | Data | Where |
|---|---|---|---|
| Contabo GmbH, Munich (Germany) | servers and database | all account and service data | Contabo data centre in Germany (EU) |
| Anthropic Ireland, Limited (Ireland) | language model for the AI assistant and extraction from public sources | conversation text, public documents | processing also in the United States (section 6) |
| Google (Firebase Cloud Messaging, Firebase Crashlytics) | notification delivery, crash reports | device token, installation identifier, crash data | also in the United States (section 6) |
| Resend (Plus Five Five, Inc., United States) | sending service and expected-return emails | email address, email content | data processed in the EU region; transfer covered by standard contractual clauses and the Data Privacy Framework |
Other recipients, each as an independent controller:
- Apple and Google, when you choose to sign in with their account: their privacy policies apply.
- Apple and Google as store operators, for downloading the app and, during testing, for managing testers.
- Other users, for the reports you publish (without your name) and for the anonymous passage counts.
- Your emergency contact, only if an expected-return alert is triggered.
- Authorities, only where the law requires it.
We also use services that receive none of your personal data:
- Cloudflare, for the domain DNS only: app traffic does not go through Cloudflare.
- Open-Meteo (OpenMeteo GmbH, Switzerland) for weather forecasts: the request leaves our server with the route coordinates and nothing that identifies you.
6. Transfers outside the European Union
- Anthropic: the contract is with Anthropic Ireland, Limited and includes a data processing agreement with the European Commission's standard contractual clauses (Decision 2021/914, modules 2 and 3). Processing may take place in the United States.
- Google Firebase: Google participates in the EU-US Data Privacy Framework; its terms also include the standard contractual clauses.
- OpenMeteo GmbH is based in Switzerland, a country with an adequacy decision of the European Commission.
You can ask us for a copy of the safeguards used by writing to the address in section 2.
7. How long we keep data
| Data | Retention |
|---|---|
| Account (email, name, sign-in identifiers) | until the account is deleted. Accounts inactive for 36 months are deleted, with prior notice by email. |
| Sign-in sessions | until sign-out or expiry |
| Location sent for map, nearby routes and weather | not stored: used only to answer the request |
| Tracks | until you delete them or delete your account |
| Passage counts | anonymous data, no limit |
| Published reports and photos | 24 months from the observation date, then anonymised or deleted |
| Rejected or removed reports | 6 months, to handle disputes |
| Flagged content, moderation decisions | 12 months from the decision |
| Blocks between users | while the block is active |
| Expected return (route, times, last position, contact details) | 30 days after the hike is closed |
| AI assistant conversations | 30 days on our systems; at Anthropic up to 30 days, up to 2 years if a message is flagged by Anthropic's automated safety systems |
| Assistant usage counters | 12 months |
| Notification tokens | until notifications are turned off, you sign out or delete your account |
| Server logs | 14 days |
| Crash reports (Crashlytics) | 90 days |
| Public source documents | 12 months |
| Rights requests and correspondence | 24 months |
| Backup copies | deleted data stays in backups until they rotate, at most about 5 weeks with the current rotation of 7 daily and 4 weekly copies |
8. Your rights
You can ask us at any time to:
- access your data and get a copy;
- correct it;
- delete it;
- restrict its processing;
- receive it in a machine-readable format and transmit it to others (portability), for example your tracks as GPX (in the app or on request at privacy@valicai.app);
- object to processing based on legitimate interest;
- withdraw consent (for example to passage counting), without affecting processing already carried out.
Write to privacy@valicai.app. We answer within one month; for complex requests we may extend this by two more months and will tell you. We may ask you to confirm your identity, usually by writing from your account's email address.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the EU country where you live or work.
9. Children
You must be at least 18 years old to use Valicai. Under 18 it is not possible to create an account.
If we find that an account belongs to someone below the minimum age, we delete it. If you are a parent and think your child has given us data, write to us.
Only adult testers take part in the closed test.
10. Security
All traffic between the app and the servers is encrypted (HTTPS). Emergency contact details and the Apple token are also encrypted in the database. Email login passwords are stored only as hashes. Server access is restricted and key-protected; backups are checked with restore tests. On the phone, personal data sits in the app's private storage, is excluded from automatic system backups and is erased when you sign out.
If a data breach puts you at high risk, we will tell you without undue delay, as required by Art. 34 GDPR.
11. Deleting your account
From the app: Account, then "Delete account". We ask you to confirm your identity. We delete your account, tracks, saved routes, expected returns, assistant conversations, notification tokens and sessions; if you signed in with Apple, we also revoke the authorisation with Apple.
Reports you published stay visible with no link to you, because they describe the condition of a trail and help others. If you want them deleted too, ask before deleting your account or write to us. Anonymous passage counts stay, because they cannot be traced back to you.
Without the app: from the page https://valicai.app/account/delete or by writing to privacy@valicai.app from your account's email address.
12. Changes to this policy
If we change this policy in a significant way, for example for a new type of data or a new provider, we tell you in the app before the change applies. The date of the latest version is always at the top of the page.
13. Contact
Thomas Casali. Email: privacy@valicai.app.