Privacy Policy

ExpandiaX OÜ, a company registered in Estonia, registry code 17332947, Akadeemia tee 3, Mustamäe, 12616 Tallinn, Harju county.

This company decides how and why your personal data is used (in data-protection terms, the “controller”). Questions or requests about your data: team@expandiax.com.

• Account details - your email, username, display name, avatar and bio, whether you sign up with a password, Apple or Google (from Apple or Google we receive only your name and email, depending on what you allow). Why: to create and run your account. Legal basis: it’s needed to provide the service you asked for (contract).
• What you add - the countries and events you log, photos, videos, notes, ratings, home country, songs you pick, and your comments, likes, follows and blocks. Why: that is the app. Legal basis: contract.
• Photo and video details. We remove location and camera information (GPS coordinates, device model, embedded timestamps) from photos and videos when you upload them. Before that, your browser may read when and where a photo was taken to suggest a trip’s dates and the towns you visited. That happens on your device, against a list of towns it downloads from us - the location itself is never sent or stored; only a town you keep is saved, as part of your trip. Town names come from GeoNames (CC BY 4.0).
• Technical data - IP address, browser and device type, and error reports, plus anonymous page-view statistics without cookies. Why: to keep the service secure, fix crashes and understand which pages get used. Legal basis: our legitimate interest in running a secure, working service.
• Approximate location - to show concerts and events happening near you in the feed, we use the rough city our hosting provider works out from your IP address (no location permission, and we don’t store it). Only a rough area of about 20-40 km is passed on to find events - never your exact position. If it isn’t available we use the home country on your profile. Legal basis: our legitimate interest in showing you relevant events.
• Notifications - if you use the app and allow notifications, a device token so we can send push notifications about likes, comments and new followers; and emails such as “X started following you” and an optional weekly digest (each digest has a one-click unsubscribe). Legal basis: contract, and your consent for push notifications, which you can withdraw in your device’s settings at any time.
• Reports and moderation - reports you send us (who sent it, what it’s about, what you wrote) and what we decide. Why: to keep ExpandiaX safe and meet our legal duties. Legal basis: legitimate interest and legal obligation.
• Agreement records - when you sign up with email, the date and the version of the Terms and Privacy Policy you agreed to. Legal basis: our legitimate interest in being able to show what was agreed.

We don’t use your content to train AI models, we don’t sell your data, and we never use your notification token for advertising or to track you across other apps or services.

We use these companies to run ExpandiaX. Each only gets what it needs for its job and acts on our instructions:

• Supabase - database, sign-in and file storage (data centre: Ireland (EU)).
• Vercel - hosting, and anonymous, cookieless page-view analytics.
• Sentry - error monitoring, so we can fix crashes.
• Firebase Cloud Messaging (Google) and Apple’s push service - to deliver push notifications to the app.
• Resend - to send our emails.
• Apple and Google - if you choose to sign in with them.
• DeepL (Germany) - when you tap Translate on a post, its text (title, subtitle and note) is sent to DeepL to be translated. We don’t keep the result.
• Spotify - song search goes through our server to Spotify. The Spotify player loads only when you tap play on a song; from then on Spotify may set cookies and handles data under its own privacy policy. Song previews come from Apple’s public music search, and only the song and artist name are sent.
• Ticketmaster, Fienta, Skiddle, SeatGeek, setlist.fm and Bandsintown - to find concerts and events: the name of an artist you log or have seen, and for events near you the town or rough area described above. Nothing that identifies you is sent. Ticket links open their websites, which have their own privacy policies.
• Unsplash - countries without photos of your own show a credited stock photo from Unsplash. It loads directly from Unsplash’s servers, which see your IP address the way any website you load an image from does. Nothing else about you is shared.
• Open-Meteo - if you change the place for events near you, or search for a place to add to a trip, what you type is looked up there to find it on the map. Nothing else is sent.
• Booking.com and GetYourGuide - if you tap Stays or Things to do, their website opens with the place’s name and our partner ID, so ExpandiaX may earn a small commission if you book. Nothing about you is sent; their own privacy policies apply on their sites.
• Travelpayouts and Aviasales - to show a flight price, we look up the two airport cities (the one nearest the rough area described above, and your destination’s). If you tap it, Aviasales opens with our partner ID. Nothing else about you is sent.
• OpenFreeMap - maps of your trips load from OpenFreeMap’s servers, which see your IP address and which part of the map you’re looking at, the way any website you load an image from does. Nothing else about you is shared.

We may also share information when the law requires it, or to protect someone’s safety. Otherwise we don’t share your data.

Some of these companies are based in the United States. Where your data goes outside the EU/EEA, we rely on a recognised safeguard - the EU–US Data Privacy Framework where the company is certified, or the European Commission’s Standard Contractual Clauses. Ask us at team@expandiax.com if you’d like details.

Entirely up to you. Your profile is private (people ask to follow you, and only followers you approve see your map and memories), friends only (only people you follow who follow you back), or public (anyone; public pages can also show up in search engines like Google). On top of that, any single country or event can be set to only me. Your name, username and profile photo are visible to other members (on your comments, for example); you can choose not to appear in search and suggestions. Places show who has been there only to people who can already see those trips, and a count of travellers that includes you as a number, never by name - unless the country is set to only me or you’ve left search and suggestions. Your dream places and dream events are yours alone. You can change all of this at any time, remove a follower, and block anyone to hide the two of you from each other.

How your photos are kept: your photos and videos are stored privately. When someone your settings allow opens a memory, ExpandiaX gives them a temporary link to each file that stops working after a few hours (the preview image when a public page is shared elsewhere lasts up to 30 days). While a link works, anyone who has it can open that file, so don’t pass those links on to people you wouldn’t show the photo to.

We only use what the app needs to work: a cookie that keeps you signed in, and a small setting on your device that remembers your light/dark theme. We don’t use advertising or tracking cookies, and our analytics don’t use cookies, so there’s no cookie banner. The exceptions are if you tap play on a Spotify song (see above), or open a partner’s site from a partner link - those are their own sites, with their own cookies.

• Your account and everything you added: as long as your account exists. When you delete it, your profile, content and uploaded files are removed straight away from our live systems, and copies in backups are overwritten within 30 days.
• Reports and moderation records: kept for up to 12 months after the case is closed, or longer if we need them for a legal claim.
• Error reports: a few months at most.

You can: see what we hold about you; correct it; have it deleted; get a copy in a portable format; ask us to restrict how we use it; object to uses based on our legitimate interests; and withdraw consent you’ve given. Most of this you can do yourself, right now, in Settings - edit your profile, export a full copy of your data, or permanently delete your account and everything in it. For anything else, write to team@expandiax.com and we’ll reply within one month.

If you think we’re handling your data unlawfully, you have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the data-protection authority in the country where you live. We’d appreciate the chance to fix it first.

We don’t make decisions about you by automated means that have legal or similarly significant effects.

Data travels over encrypted connections, access to the database is restricted by per-user rules, and only a small number of people can reach the systems that hold it. No service can promise perfect security; if a breach ever puts your rights at risk, we’ll tell you and the authorities as the law requires.

ExpandiaX isn’t intended for anyone under 16. If we learn that we hold an account belonging to someone younger, we’ll delete it.

If we change this policy in a way that matters, we’ll tell you at least 30 days before it takes effect, by email or in the app. The date at the top shows when it was last updated. Our Terms of Service explain the rest of how ExpandiaX works.

Questions, or want to use a data right directly? Reach out at team@expandiax.com.