Privacy policy
Updated 8 de setembre de 2026 · Trial version: these texts may change.
Who is responsible
Carles Riera Avila, tax ID 40357547E, Plaça Mercat, 22-30, 17800 Olot. Email for any privacy matter: carlesrieraavila@gmail.com.
What data we process
Anonymous identifier: when you open OnSou an anonymous account (a random identifier) is created so your device can be part of a group. We do not ask for email, phone or real name.
The name you choose: the name you type when creating or joining a group. It can be a nickname.
Position: latitude, longitude, accuracy, altitude, heading and approximate speed of your device, and battery level if the browser allows it. Only while you have the group open and ghost mode is off.
Activity in the group: points you add to the map and statuses you send ("I'm OK", "Arrived", "I need help").
Technical data: IP address and browser type, needed to serve the site and the maps.
Why and on what basis
Single purpose: showing the people in your group where you are and what status you sent, and showing you where they are. No profiling, no advertising, and we never sell or share data with third parties for their own purposes.
Legal basis: your consent (art. 6.1.a GDPR), given when you accept the browser's location permission and join a group. You can withdraw it at any time by turning on ghost mode, leaving the group or revoking the location permission in your browser.
How long we keep it
We keep only the latest position of each member (no history). When the group expires, positions are deleted automatically within 10 minutes. The whole group (name, members, points, statuses) is deleted 7 days after expiry.
The anonymous account stays in your browser until you clear the site data. Anonymous accounts with no active groups are removed periodically.
Who has access
The people in your group: they see your name, your position (unless in ghost mode), your points and statuses. Anyone with the group link or code can join: share it only with people you want.
Providers processing data on our behalf: Supabase (database and authentication; servers in Frankfurt, EU) and Vercel (web hosting; US company under EU standard contractual clauses).
Map providers: when the map loads, your browser requests map images directly from OpenTopoMap, OpenFreeMap and OpenSnowMap, which receive your IP address and the map area you view, as with any map website. They do not receive your name or exact position.
Minors
OnSou is intended for people aged 14 or over. If you are under 14 you need permission from a parent or legal guardian. If we detect use by under-14s without such permission we will delete the data.
Your rights
You can access, rectify, delete, restrict or object to the processing of your data, and port it, by writing to carlesrieraavila@gmail.com. Since we hold neither your email nor your real name, to identify you we will need the group code and the name you used in it.
You can also complain to the Spanish Data Protection Agency (aepd.es) or the Catalan Data Protection Authority (apdcat.gencat.cat).
Security
Data travels encrypted (HTTPS). Database access is restricted by security rules: only group members can read a group's data, and each person can only write their own.