Privacy Policy
Last updated
In short
Aloravia helps people who want to get to know a city and people who want to move countries. To do that we keep the minimum that makes the product work, and this page says exactly what that is.
We do not sell your data to anyone. We do not use your data for third-party targeted advertising. There are no behavioural profiles built up over weeks — our usage measurement dies when you close the tab.
What we collect
It depends on what you do on the platform. Browsing does not require an account.
| When | What gets stored |
|---|---|
| When you create an account | Name, email and an encrypted password. Optionally a photo and a bio. |
| When you take the quiz | Your answers and the plan they produce, so you can come back months later and pick up where you left off. |
| When you register a business | Name, address, contacts, opening hours, photos and the page content. This data is public by nature — it is a business page. |
| When you comment or rate | The text, the rating and any photo you attach. They are tied to your account name, publicly. |
| When you search by radius | Your location is read on your device, with your permission, and used on the spot to sort results. We do not store it. |
| When you visit | Aggregate page, session and performance counts, **if you accept measurement**. No name, no email, no following a person between visits. |
Who we share it with
Only with those who make the product work, and only what is necessary. None of them receive your data to sell or to advertise.
| Service | What for, and what it sees |
|---|---|
| PostHog (European region) | Usage measurement, **only after you accept**. Sees pages visited and performance. The identifier it uses lives only in the open tab and disappears when you close it. |
| Sentry | Error detection — that always. **If you accepted measurement**, it also records the screen for the seconds before a failure, with all text and images masked. |
| Cloudflare | Serves the site and protects it from attacks. Sees the IP address of every request, as any server does. |
| Cloudflare R2 | Stores the photos you upload. |
| Resend | Sends the platform's emails. Sees your email address and the message content. |
| MapTiler and CARTO | Draw the maps. They receive your device's IP address when the map tiles load. |
| bigdatacloud and ipapi | Work out the country from the IP address, so the city explorer opens in the right place. They receive the IP address; the answer stays in the tab's memory and is not stored on your device. |
| Google Gemini and OpenRouter | Generate and moderate editorial content and triage submissions. They do not receive your account data. |
Cookies and storage on your device
We use a session cookie when you sign in. Without it we cannot keep you signed in, which makes it strictly necessary.
Usage measurement (PostHog) and screen recording when something breaks (Sentry) only start after you accept the notice shown on your first visit. If you decline, they store nothing on your device and send nothing — they never even load. Your choice is kept in the browser for six months, and you can change it at any time from the “Cookies” link in the footer or the button below.
When you accept, PostHog keeps an identifier in sessionStorage, which the browser clears when you close the tab — it measures the path of one visit, it does not build a profile of a person. Sentry's recording masks all text and images: it shows where you clicked, not what you typed.
Whatever you choose, Sentry receives the errors the site produces — no recording, no IP address, nothing stored on your device. It is how we learn that something broke; we treat it as a legitimate interest, like any server log.
If your browser sends the Global Privacy Control signal, we treat it as a refusal and ask nothing. A choice you make here, in the notice, overrides that signal — it is more specific than a preference set for every site at once.
Your rights
If you are in the European Union, the GDPR gives you the right to access your data, correct it, delete it, restrict its processing, object to it, and take it with you.
You can delete your own comments on the platform. To delete your whole account, or to exercise any of the other rights, write to the address below and we will reply within thirty days.
A comment you delete disappears; if other people have replied underneath it, the row stays as an anchor with no text and no photo, so their replies do not disappear with yours.
How long we keep it
Account data and what you created stay for as long as the account exists. When you delete the account, we delete the personal data attached to it.
Usage measurement and error logs follow the retention of the services that store them, and are kept only as long as we need them to understand problems.
Children
The platform is not intended for anyone under sixteen and we do not knowingly collect data from anyone younger. If you know of a case, tell us and we will delete it.
Changes
When we change this policy, the date at the top changes with it. Changes that materially affect what we do with your data will be emailed to everyone with an account.
Contact
For any privacy question or to exercise your rights: [email protected]