Privacy Policy

Sergio Galván (Passaport Faller) · email: hola@passaportfaller.es.

Passaport Faller is an independent project. We are not affiliated with the Junta Central Fallera, the City Council of València or any other official body. It has optional paid features (Patron) and partnerships with sponsoring brands, explained below.

Account. You sign in with Google or Apple. We receive your name, email address and, if there is one, your profile picture. Authentication happens on Google’s or Apple’s servers: we never have your password.

Profile. Your @username, your bio (optional), your falla, your date of birth (mandatory: it is used to check the minimum age and to show stamps with an 18+ restriction), whether your profile is public or private, and whether you want to appear in searches.

Activity. The stamps, sketches and badges you earn (with date and time, and whether they were validated by GPS or by code), who you follow and who follows you, reactions, and the people you attended an event with (companions).

Invitations. If you signed up through another person’s invitation link, we record who invited you and, when you make your first stamp, that person will get a notice with your name.

Photos (optional). Your profile picture and, if you wish, a photo on a stamp (it can only be added when you validate the stamp or while the event is taking place).

Safety and moderation. The people you have blocked, the reports you make (who reports and the reason are only seen by the moderation team) and the ones you receive.

Giveaways. Your entries in a giveaway are calculated from your stamps; if you win, we record which giveaway and when.

Notifications. In-app notices and, if you allow it, your device token for push notifications, and a log of the notices we send you (type, date and whether you opened it), kept for 90 days to see whether they work and avoid sending you too many. You can turn them off at any time in the app’s Settings or in your phone settings.

Payments. If you become a Patron or your falla buys a service, we keep what was paid, the amount, the edition and the payment identifier. We never see or store your card details: they are handled by Stripe (web) or Apple/Google with RevenueCat (app).

Contact. If you write to us through the form, we keep your message and your email to reply to you (and, if you ask to manage a falla, the contact phone number you give).

App waiting list. If you leave your email on the website so we can tell you when the app is available, we keep the email, the date you agreed and the page you did it from. We do this with your consent and only for that notice. We keep it until we send you the notice and, at most, 12 months more; you can withdraw your consent and have it deleted by writing to hola@passaportfaller.es.

Errors and usage. See section 5.

• Providing the service you asked for (account, stamps, profile, social features, payments).
• Your consent (location, camera and photos, push notifications), which you can withdraw at any time in your phone’s settings.
• Legitimate interest: security, preventing fraud and faked validations, content moderation, fixing errors and aggregated statistics.
• Legal obligation: keeping payment data as required by tax law.

Sponsoring brands only receive aggregated reports (visits per event, age brackets, falla of origin). They don’t receive your name, email or any data that identifies you. In a giveaway, only if you win and to deliver your prize, the minimum necessary data will be shared with the organiser, as set out in that giveaway’s legal terms.

We never sell or hand over your data to third parties for commercial purposes.

• PostHog (servers in the European Union) measures use of the app and the website and collects errors. It identifies a person only with an internal identifier (never with name or email), with an anonymised IP and without recording the screen. On the website it stores nothing in your browser.
• Vercel Analytics and Speed Insights measure visits and website speed without cookies and without identifying you.
• Our error log records what failed, the app version, the device type and the internal identifier of the person who experienced it. It is kept only as long as needed to fix the error.
• Partner statistics: we count, with anonymous counters (without recording who), how many times each partner business’s listing is shown and opened and how many times call, directions, book or its social links are tapped. Each business only sees the figures for its own listing.

• Supabase (database, files and authentication; servers in the EU, Ireland) and Vercel (web hosting).
• Google and Apple (sign-in, app stores and in-app purchases).
• Stripe (web payments) and RevenueCat (management of in-app purchases).
• PostHog (statistics and errors) and Resend (sending service emails).
• Expo (app tooling and push notifications).

Some of these providers are in the United States. Transfers are made with GDPR safeguards (standard contractual clauses or the EU-US data privacy framework).

As long as you have the account. When you ask to delete it (Profile → Delete account), it is scheduled for 72 hours later: during that time you don’t appear in searches and, if you sign in again, the deletion is cancelled. After that period, your account, stamps, photos, follows, notifications, blocks and contact messages are deleted. Payment data that the law requires us to keep may remain with Stripe, Apple or Google for as long as tax rules require.

You can access your data, rectify it (from your profile), delete it, object, request restriction and portability by writing to hola@passaportfaller.es. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Passaport Faller is for people aged 14 or over. The date of birth is mandatory to check this and to show stamps with an 18+ restriction only to adults. If we detect an account of someone under 14, we will delete it. Giveaways may require being an adult according to their terms.

We will use your email only for matters related to the service, replies to the contact form, a summary of your activity or the app waiting-list notice if you signed up. We don’t send third-party advertising. If we change this policy in a significant way, we will let you know in the app or on the website.