Privacy Policy

Tropi Guide is a self-guided audio tour app for Madeira. This policy explains what we collect and why. If anything here is unclear, email us and we will explain it.

Who is responsible

The data controller is Hélvio Viveiros Nóbrega, sole trader, Estrada Francisco Álvares Nóbrega, Água de Pena, 9200-209, Portugal.

Contact: hello@tropiguide.com

What we collect, and why

Sign in with Apple

We only see what Apple passes to us: an account identifier and an email address. If you use Apple's Hide My Email option, we receive a relay address and never learn your real one. We do not ask for a password because we never handle one.

Your location

• Your location is processed on your phone and is never sent to us. The app compares where you are against the tour's stops to know when to play a recording, and to show how far a beach or trail is from you. That comparison happens on the device.
• We do not store your location, we do not keep a history of where you have been, and we do not share it with anyone.
• You can refuse location access, or withdraw it later in your phone's settings. The app still works. You tap each stop yourself instead of the audio starting as you arrive.

Reporting a problem or an idea

When you send a report from Support, we receive your message along with the app version, your device platform and its operating system version. Those three are attached automatically because a report is much easier to act on with them.

You may also attach a photograph — a closed sign, a wrong turn. It is entirely your choice, and the app opens your photo library for no other reason. The picture is stored privately, used only to understand what you are reporting, and never published.

If you are signed in, the report is linked to your account so we can reply. If you are signed out, it is not linked to anyone. No location is attached, and nothing else about your device is.

When the app breaks, and how a tour went

Two things are recorded automatically, and both exist for the same reason: an audio tour can fail quietly. A recording that never plays at a viewpoint is not noticed by the one person who would have told us — the person it did not play to.

Crash and error reports. If the app crashes or something fails inside it, we receive the technical details of the failure, the app version, and the model and system version of the phone. We have turned off the option that would attach your IP address and account details. Reports are handled by Sentry, on servers in the European Union.

What happened during a tour, and in the app. We record when a tour is opened and finished, which audio points played and which failed, whether a download succeeded, which way you signed in, your phone's language — so we know which language is worth recording next — and its time zone setting, which tells us whether the app is used on the island or before the trip (a phone that sets its time automatically switches to Madeira's own time zone when it lands). We also record which parts of the app are opened (a tour's page, the tours list, a place in Explore), whether the buy button was tapped, and, on a tour's page, that a screenshot was taken and which part of the page was showing. For a screenshot we learn only that it happened: never the picture itself. Each event carries a random identifier for the app installation, and your account identifier if you are signed in.

These records contain no location. We record which audio point played, never where you were. The time zone is a setting of the phone, not a position: it is the same for the whole island. We do not build a route, a trail or a history of your movements, and could not do so from what we hold.

Because a tour is often taken where there is no signal, these notes are written on your phone first and sent when there is a connection again — sometimes hours later. They are deleted after ninety days, automatically.

What you save

The tours and places you bookmark, and the walks you mark To do or Done, are kept on your phone. If you are signed in, they are also kept with your account, so they come back on a new phone and you can see them on the website when you sign in there. Only you can see them, and they are deleted with your account.

What stays only on your phone

Downloaded audio, your distance-unit preference, and how far through a tour you are, are stored on your device and are not visible to us. Deleting the app removes them, and anything you saved while signed out.

What this app does not do

• No advertising, and no advertising identifiers
• No analytics or tracking software that follows you between apps or across the web. The record of how a tour went is ours, stays with us, and never leaves except to the crash-report provider described above
• No cookies or tracking pixels. Tropi Guide is an app, not a website
• No profiling, and no automated decisions that affect you
• No selling, renting or trading of personal data, in any circumstances
• No use of any of this to build a picture of you. We look at these records to see whether a tour is working, not to learn about the person who took it

Island updates (notifications)

If you turn on island updates, the app asks your phone for permission to show notifications and stores a notification address for this phone (a push token), the installation identifier and whether it is an iPhone or Android. We use it to send a note in the morning about the day's weather on the island, and word when something on Madeira matters to a visitor, such as a weather warning or a closed trail. Never advertising. Turn it off, or refuse the permission, and the token is removed. The notification is delivered through Expo and then Apple or Google, the only way a phone can receive one.

Emails from us

After your first purchase in the iPhone app, we send you one email to say thank you, with a discount code for another of our tours. We do this because you are already a customer and it is about tours like the one you bought, which the law allows without asking first. Every such email has an unsubscribe link; use it, or simply reply and ask, and we send you no more offers. Your account and your tours are not affected.

We keep a record that the email was sent, so it is never sent twice, and the addresses that unsubscribed, so they stay unsubscribed.

Buying without an account

You can buy a tour without signing in. The app then creates an anonymous account for this phone: an identifier only, with no name or email, so that the tour has somebody to belong to. If you later sign in, your tours move to your account and the anonymous one is no longer used.

Payments

Tours are bought through the store the app came from: Apple's In-App Purchase on an iPhone, Google Play Billing on Android. The store takes the payment. We never see your card details, billing address, or any part of your payment method. The store tells us only that a purchase succeeded, so that we can unlock the tour.

We use RevenueCat to receive that confirmation. It is given your account identifier and the product you bought, and nothing else.

The website (tropiguide.com)

You can read the website without an account and without being tracked. We count visits with Umami, which runs on our own server: it sets no cookies, keeps no IP address and builds no profile of anyone. We see numbers such as how many people read a page and which pages lead to the app.

If you sign in on the website, you use the same account as in the app, to see the tours you own. Your browser keeps you signed in until you sign out; that sign-in is stored only in your browser.

If you ask us for a rental car on the website, we receive what you put in the form: your dates and places, the car you want, the driver's age, your name, the email, WhatsApp number or Instagram username you want us to answer on, and any note. We use them only to find you a car and answer you, and we keep a record of the request, including whether you reached us from our Instagram, TikTok or the website. To stop the form being flooded, we also keep a scrambled code made from your internet address (never the address itself), used only to limit how many requests one connection can send in an hour. We pass your details to one of our partner rent-a-car companies only when you tell us to book, and only what they need to rent you the car; from then on they also handle them under their own privacy policy.

If your business asks to work with us on the website's Partners page, we receive what you put in the form: the kind and name of the business, your name, email, and, if you give them, a phone number, website or Instagram, where on the island you are and a message, what kind of partnership interests you and whether you want to talk on WhatsApp or by email. We use them only to answer you and talk about working together, and we keep a record of the request, with the same scrambled code made from your internet address to limit how many requests one connection can send.

A video on the website only loads from YouTube when you press play, and then from YouTube's privacy-enhanced address (youtube-nocookie.com).

Who else processes your data

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes.

Some of these providers operate outside the European Economic Area. Where data is transferred, it is protected by the safeguards required under the GDPR, such as the European Commission's Standard Contractual Clauses.

Reviews are public

If you leave a written review, the comment, the star rating and the first name you choose are shown publicly on the tour page. Your email address and account identifier are never shown. Please do not put anything in a review that you would not want a stranger to read.

Problem reports are not public. Nobody using the app can read them.

How long we keep things

• Your account and purchases: for as long as you have an account, so that what you paid for keeps working.
• Purchase records: deleted with your account. The store you bought from, Apple or Google, is the seller of record and keeps its own accounting record of the sale, as the law requires of it; that copy is the store's and is governed by its privacy policy, not ours.
• Problem reports, and any photograph attached to one: normally up to two years, and no longer linked to you once your account is deleted.
• Support emails: normally up to two years.
• Rental car requests: normally up to two years, so we can answer questions about a booking afterwards.
• Records of how a tour went: ninety days, then deleted automatically. Three months is long enough to see whether a tour is working; longer answers nothing better.
• Crash and error reports: kept by Sentry, for no longer than ninety days.

Deleting your account

You can delete your account from inside the app, at any time, without asking us: Support → Account Settings → Delete My Account.

Exactly what happens, in order:

• Your ratings and reviews are deleted, and each tour's average is recalculated without them.
• Our record of what you own is deleted.
• Your account itself is deleted, including your email address.
• Any problem reports you sent, and the records of how your tours went, stop being linked to you at that moment. What is left cannot be traced back to a person.
• On the phone in your hand: downloaded audio, bookmarks, and how far through each tour you were.

Your purchases remain with Apple or Google, whichever took the payment. If you sign up again, Restore Purchases gives your tours back.

Your rights

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider. You may also object to processing based on legitimate interests, and withdraw any consent you have given.

Write to hello@tropiguide.com and we will reply within one month. You do not need to give a reason, and it costs nothing.

If you think we have handled your data badly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live.

Children

Tropi Guide is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to us and we will delete it.

Keeping data safe

However you sign in, there is no password of yours for us to lose — we never receive one. Data is encrypted in transit, access to our database is restricted per user, and tour audio is served through short-lived links that only work for people who own the tour.

No system is perfect. If a breach affects your rights, we will tell you and the CNPD as the law requires.

Changes to this policy

If we change how we use your data in a way that matters, we will update the date at the top and tell you in the app before the change takes effect.

Contact

Questions, requests or complaints: hello@tropiguide.com