Privacy policy

Information we use

For accounts we use your name, email, a password hash and the identifier of a linked Google, Facebook or Apple account. The sign-in provider may share your name and email; Apple may provide a private relay address. We do not receive your provider password. Provider access tokens are not stored permanently.

Listings and community

Submitted listing details, photos, price lists and translations are stored for moderation and publication. Reviews, reactions, questions and answers are linked to your account. Approved content and the author’s display name are public. Account emails are not public review data; business contact information submitted for a listing is intended for publication.

Location and cookies

We request location only when you choose “Near me” and grant browser permission. It is used as your search centre for up to one hour in your session and is not added to your account profile. You can clear it by choosing “Use Vršac centre”. Essential cookies support sessions, form security, language and optional remembered sign-in. Optional Google Analytics requires a separate visitor choice.

Purposes and legal grounds

We process account and content data to provide the service you request. Necessary technical information supports security and abuse prevention on the basis of legitimate interests. Location is optional and based on your permission. Legal obligations may require retention of certain records.

Service providers and external content

The site is hosted on Hetzner infrastructure. Loading maps may share your IP address and technical information with OpenFreeMap or the Esri fallback map provider; fonts may load from Google Fonts. Google, Meta and Apple participate when you select their sign-in options. External links are subject to the destination’s policies. These providers may process data outside Serbia under their policies and applicable international transfer mechanisms.

Retention, security and deletion

Account data is kept while the account is active or needed to provide the service, resolve disputes and meet legal duties. Restricted security logs and backups may include technical data. On request we verify identity and delete or anonymise information when there is no basis for further retention. Backup removal follows the backup replacement cycle. Published content that must be retained may be anonymised.

Your rights and contact

Subject to legal conditions, you may request access, correction, deletion, restriction or portability, object to processing, and revoke location permission in your browser. Include your account email and the type of request. You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs).

Suggested profile corrections

When you suggest a correction, we store the suggestion, its type and the profile it concerns. If you are signed in, we link it to your account. A contact email is optional and, together with the suggestion, is available to the editors for review; it is not displayed publicly. Submitting a suggestion does not itself change the profile.

Google Analytics and visitor choice

Google Analytics 4 measures public pages only after the visitor selects Allow analytics. You can choose Necessary only or change your choice in the footer. The browser stores the choice for up to 180 days. Admin, account, login and private form pages are not measured. We do not send email addresses, account identifiers, search text, URL query parameters or precise search locations. Ad personalization and Google signals are disabled. Analytics data is processed by Google according to its policies.

Profile statistics with consent

If you allow analytics, we record daily aggregate counts of profile views and clicks on phone, email, website, Instagram and directions. This table does not contain visitor IP addresses, email addresses or account identifiers. The existing session is used only for temporary duplicate-event suppression in the server cache. Change your choice through Analytics settings. Administrators can view aggregate results; a click is not a confirmed call, purchase or unique visitor.

Events and promotion enquiries

Event proposals are reviewed before publication. Titles, descriptions, locations, organisers, sources and photos are public; submitter email and account identifiers are private. Promotion enquiries retain business name, contact details, selected plan and message so an administrator can respond. Sending an enquiry does not activate a plan or take payment. Contact the operator to request correction or deletion.

News from other publishers

We show a headline, short introduction, source and approved image or generic illustration. Clicking opens the original publisher, whose privacy rules then apply. An approved externally hosted image sends a technical browser request to that server without a referrer address. Collection runs on our server and every item awaits administrator approval.

City exploration and visits

Check-ins are voluntary. We request location only when you press the check-in button; there is no background tracking. Coordinates and accuracy are used to check proximity and are not written to visit records. We store the place and date until you remove the visit from your account. Favourites and visit history are private. Public profiles and leaderboard participation are separate choices. Approved tips and photos are public with your chosen display name. Photos are re-encoded without EXIF metadata. Map styles and terrain load from OpenFreeMap and Mapterhorn; your browser sends these providers normal network data and tile requests for the viewed area.

Community and Android notifications

Approved posts and comments are public, together with the selected place and community display name. A public profile is optional; visit history remains private. Uploaded social photos are re-encoded without their original metadata. Notification history and preferences belong to the signed-in account. Android push uses Firebase Cloud Messaging only after it is configured and enabled; you can turn it off. Quiet hours delay push, but not the in-app inbox. Optional app analytics uses Firebase/Google Analytics after a separate choice; the app does not include email addresses, precise GPS positions or post text in analytics events. You can disable app analytics in the app. Public posts can be withdrawn and inappropriate content reported.

Friendships require acceptance by both people and can be removed or blocked. The private friend list does not disclose email addresses or visit history. Collections are private until you explicitly enable public sharing; their visibility is separate from your profile setting. Monthly challenges and XP use confirmed visits to distinct places and existing earned badges. Draft text is encrypted on the phone and selected photos remain in app-private storage until submitted. Sharing a graphic card with another app is your explicit action.

02.11.2026.