This Privacy Policy explains what personal data StreetAudit collects, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and comparable laws.

1. Data we collect

• Account data: email, display name, password hash (managed by our authentication provider).
• Report data: the photos or videos you capture, the AI summary, GPS coordinates, reverse-geocoded address, timestamp, media type, and points awarded.
• Usage analytics (only with your consent): anonymous page views, capture and save events, an anonymous session ID, and your browser user-agent string.
• Technical data: minimal server logs (IP, timestamps) needed to operate and secure the service.

2. Legal basis (GDPR Art. 6)

• Contract — for creating your account, saving your reports, and awarding points.
• Consent — for optional product analytics cookies (see our cookie banner). You can withdraw consent at any time by clearing browser storage.
• Legitimate interest — for security logs, abuse prevention, and service reliability.

3. How we use your data

• To provide the capture, AI-analysis, save, and gamification features.
• To display your points and badges and to enable social sharing (only when you tap Share).
• To improve the app when you have granted analytics consent.
• To protect the service against abuse.

4. AI processing

Photos and videos you analyse are sent to third-party AI providers (Google Gemini via the Lovable AI Gateway) to generate the audit summary. Providers process the media only to return the result and do not train on your data.

5. Sharing & third parties

• Lovable Cloud (Supabase) — hosting, database, authentication, storage.
• Lovable AI Gateway — routing AI vision requests.
• OpenStreetMap Nominatim — reverse geocoding (address lookup from GPS).
• Google Maps — when you tap the "Open in Google Maps" link.

We do not sell your personal data.

6. Data retention

Account and report data is stored until you delete your account or delete the individual report. Analytics events are retained for up to 24 months and then aggregated or deleted.

7. Your rights (GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any right, contact the app owner (see below).

8. International transfers

Our providers may process data outside your country. Where required, transfers rely on Standard Contractual Clauses and equivalent safeguards.

9. Children

StreetAudit is not directed to children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Contact

Data controller: the operator of this StreetAudit deployment. Please contact them through the channel provided at the point where you signed up. If no contact was provided, reach out via the app store listing or hosting URL.