Privacy policy

This is a draft. It describes what the website does today. It still has to be reviewed by a lawyer before launch.

1. Who is responsible

true, Raschdorf Strasse 16, Berlin, Germany. Contact for anything about your data: payamjamili@gmail.com.

2. What we collect, and why

Early-access list and “Email me this plan”. Your email address, and if you give them your first name and home country. We also save the city and kind of walk you chose, the price you picked in the pricing screen, the wording version of the consent box and the time you ticked it, the site you came from, campaign tags in the link (UTM) and a friend’s referral code if you used one. We send you one email to confirm your address. Until you confirm, we send nothing else. If you asked for your plan, that confirmation email is followed by one email with your plan (stops, times and map links).

Contact form. Your message, your email address and, if you give it, your name. We use them only to answer you.

Questions to Simorgh, votes and feedback. What you type to Simorgh, the cities you vote for, and your star rating, choices and optional note are saved without your email, name or IP address. Please don’t type personal details into these boxes.

Anonymous walk statistics. Only if you accept analytics: a random id for your browser, your city, time and interest choices, how far you got and your rating. These contain no personal data.

Product analytics (PostHog, EU). Only if you accept analytics: events such as “stop viewed” or “game completed”, with the stop, city and similar fixed labels. No email, no name and no typed text. No session recording. We ask PostHog not to store your IP address.

Your location. If you tap “Use my location” or “Show where I am”, your browser works out the nearest start or leg on your device. The position is used once, in your browser, and is never saved or sent to us.

Maps. The map is loaded from OpenFreeMap. Like any website that loads a map, their servers see your IP address when your browser asks for map tiles.

Security. To stop abuse, forms use a bot check (Cloudflare Turnstile) and a limit on how often a form can be sent. The limit uses a scrambled code made from your IP address, not the address itself.

3. Legal bases

Marketing and launch emails and analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Answering your message and sending the email you asked for: Art. 6(1)(b) and (f) GDPR. Keeping the website secure and free of abuse: our legitimate interest (Art. 6(1)(f) GDPR).

4. Who processes data for us

Vercel (hosting), Supabase (database, EU region Frankfurt), Resend (sending email), HubSpot (contact records, only for people who confirmed their email), PostHog (analytics, EU cloud, only after you accept), Cloudflare (bot check) and OpenFreeMap (map tiles). Some of these providers may process data outside the EU. Where they do, this should rest on EU standard contractual clauses or the EU–US Data Privacy Framework. To be confirmed in review.

5. How long we keep it

Signups that are never confirmed are deleted after 30 days. Confirmed signups are kept until you unsubscribe or ask us to delete them. Anonymous statistics and questions contain no personal data and are kept while we evaluate this test.

6. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, or to receive it in a portable form. You can object to processing based on legitimate interest, and withdraw consent at any time (Cookie settings, or the unsubscribe link in our emails). You can complain to your data-protection authority.

7. Contact

Write to payamjamili@gmail.com.