Privacy Policy
Last updated: 12 February 2026
Nearva ("we", "us", "our") is a camper trip planning application operated from Belgium. This policy explains what data we collect, why, and how we protect it. We aim to be transparent and collect only what is necessary to provide the service.
1. Data We Collect
1.1 Account Information
When you create an account, we collect:
- Email address and display name
- Password (stored as a bcrypt hash - we never store your password in plain text)
If you sign in with Google or Facebook, we receive your name, email, and a provider-specific identifier. We do not receive or store your social media password.
1.2 Profile Information
You may optionally add a profile photo (avatar URL) and a short bio. This information is visible to other users.
1.3 Location Data
If you grant permission, the app accesses your device location to show nearby places on the map. Your coordinates are sent to our server to fetch nearby locations, weather data, and fuel prices. We do not build a history of your movements or track you in the background.
1.4 Content You Create
- Reviews - rating, text, camper-specific fields (surface, quiet at night, fits large camper, etc.), and optional photos
- Trips - title, description, stops, dates, and visibility setting (private, unlisted, or public)
- Favorites & visited places - which locations you saved or marked as visited, with optional notes
1.5 Preferences
We store your language preference and preferred navigation app to personalise your experience.
1.6 Technical & Log Data
When you use the app, our server automatically logs:
- IP address, HTTP method, URL path, response status code, and response time
- User-agent string (browser/device type)
These logs are used for security monitoring, debugging, and performance analysis.
2. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide the service (map, search, reviews, trips) | Account info, location, content | Contract performance |
| Show nearby places, weather, and fuel prices | Device location (with permission) | Consent |
| Process payments (Premium subscription) | Email, name (passed to Stripe) | Contract performance |
| Send transactional emails (password reset, subscription confirmations) | Email address | Contract performance |
| Display ads (free tier) | Device identifiers (via Google AdMob) | Legitimate interest / Consent |
| Monitor errors and performance | Error traces, device info (via Sentry) | Legitimate interest |
| Security and abuse prevention | IP address, request logs | Legitimate interest |
3. Anonymous Usage Analytics
We run a small first-party analytics system to understand which features people use, so we can prioritise the right things. It is built to be unable to identify you:
- No identifiers. We never store your account ID, email, or device ID alongside an analytics event. There is no field in the database that links an event to a person.
- No IP retention. Your IP address is converted to a country code (e.g. BE) at the moment a request arrives, then immediately discarded. Only the country is stored.
- No raw location. When the app records a coarse location to understand regional interest, it is rounded to a hex roughly 70 km wide before leaving your device. Exact coordinates are never used for analytics.
- Daily-rotating cohort tag. A non-reversible 6-character tag is computed daily from a salt that rotates server-side. The same device produces a different tag each calendar day, so retention can only be analysed on a sliding 30-day window.
- What we do collect. The screen you opened (e.g. home, plan_day), the action you took (e.g. favorite_added), and the cohort attributes used to slice the data: app version, platform (Android / iOS / web), language, country, and whether you have a premium plan.
- Self-hosted. All analytics data stays on our servers. We do not use Google Analytics, Plausible, PostHog, or any other third-party analytics service.
- Short retention. Raw analytics events are deleted after 35 days. Only daily aggregate counts (e.g. "1,402 favourites added on 2026-04-12") are kept longer.
- Easy to turn off. Settings → Help improve Nearva. When off, the queue is drained and no events are sent.
4. Third-Party Services
We share limited data with the following services to provide app functionality:
| Service | What We Share | Purpose |
|---|---|---|
| Stripe | Email, name | Payment processing for Premium subscriptions. Stripe is PCI-DSS compliant. We never see or store your card details. |
| Google AdMob | Device identifiers, ad interaction data | Displaying ads to free-tier users. Premium subscribers see no ads. |
| Sentry | Error data, device type, OS version | Crash reporting and performance monitoring. Sampled at 20% of sessions. |
| OpenWeatherMap | Approximate location (rounded to ~10 km grid) | Weather forecasts. Your exact location is never shared - we round coordinates before sending. |
| Google Places | Location name, coordinates | Enriching location details (photos, opening hours). Results are cached for 30 days per Google's terms. |
| OpenRouteService | Route waypoints (coordinates) | Driving directions and travel time calculations for trip planning. |
| GasAware / TankerKoenig | Approximate location, fuel type | Live fuel station prices. |
| Waymarked Trails | Map bounding box coordinates | Hiking trail information. |
| Nominatim (OpenStreetMap) | Coordinates | Reverse geocoding (coordinates to place names). |
| Amazon SES | Email address | Sending transactional emails (password resets, subscription notifications). |
| Google / Facebook OAuth | Authentication tokens | Social sign-in. We only receive your name, email, and provider ID. |
5. Data Stored on Your Device
- Authentication token - stored in encrypted secure storage (Android Encrypted SharedPreferences / iOS Keychain)
- Offline map tiles and cached location data - stored in a local SQLite database for offline use
- Preferences - language and navigation app stored locally
6. Data Retention
- Account data is retained as long as your account exists.
- Reviews, trips, and favorites are retained as long as your account exists.
- Server logs (IP, user-agent, request data) are retained for security and debugging purposes.
- Password reset tokens expire automatically and are single-use.
- Email logs are retained for troubleshooting delivery issues.
7. Account Deletion
You can delete your account from the app settings. When you delete your account:
- Your profile, reviews, trips, favorites, visited places, and follow relationships are removed.
- Your account is soft-deleted (marked as deleted) to prevent re-use of the email address for abuse prevention.
- If you have an active Stripe subscription, it will be cancelled.
To request complete erasure of all data, contact us at [email protected].
8. Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access - request a copy of the personal data we hold about you
- Rectification - correct inaccurate data
- Erasure - request deletion of your data
- Restriction - request we limit processing of your data
- Portability - receive your data in a structured, machine-readable format
- Object - object to processing based on legitimate interest
- Withdraw consent - for location access and ad personalisation, at any time via your device settings
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
9. Children's Privacy
Nearva is not intended for children under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
10. Security
We protect your data with:
- HTTPS encryption for all data in transit
- Bcrypt password hashing
- JWT tokens with expiration
- Encrypted secure storage for tokens on your device
No system is 100% secure. If you discover a security issue, please report it to [email protected].
11. Cookies
The Nearva website uses no tracking cookies. The web app stores an authentication token in your browser's local storage to keep you signed in. Google AdMob may use advertising identifiers on the mobile app - you can opt out via your device's ad settings.
12. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of Nearva after changes constitutes acceptance of the revised policy.
13. Contact
For any privacy questions or requests:
Email: [email protected]
Nearva - Belgium