Privacy Policy

Voxway (“we”, “us”, “our”) is a city-guide application that lets you explore cities, view points of interest (“pins”), and — after purchase — access detailed pin content and audio. This policy explains what personal data we process, why, how we use it, who we share it with, and the choices and rights you have.

1. Who is responsible

Voxway, registered in the Netherlands, is the data controller for personal data processed through the Voxway app and its backend.

Contact: privacy@voxway.eu.

2. Data we collect and how we use it

We collect only the data needed to provide and improve the app. We do not sell your personal data, and we do not use it to track you across other apps or websites.

Data	Examples	How we use it
Account identity	Email address	To create and secure your account, let you sign in, and show your username.
Credentials	Password (stored only as a salted BCrypt hash — never in plain text)	To authenticate email/password sign-in.
Platform identity	Identity provider and provider subject identifier from Google or Apple sign-in	To let you sign in with your Google or Apple account.
Virtual currency	Your Dirham balance	To credit you and enable purchases of pin access.
Preferences	Selected language	To show content in your chosen language.
Purchase records	Transaction history, store token, amounts	To deliver purchases, verify receipts, and meet accounting obligations.
Access records	Purchased pins and access periods	To grant and time-limit access to content you purchased.
Feedback	Your description and (optional) name/email	To process bug reports and support requests.
Location	Foreground device location on the map	To show your position (“nearby cities”). We do not store your location; it is used on-device and by the map provider only while the map layer is active.
Voice	Speech audio for voice search	To recognize a spoken city name. We do not store your voice audio.
Technical metadata	IP address, timestamps, server logs	For security, stability, and operations.

Where the GDPR applies, our legal bases for processing are: performance of a contract (account, purchases, access), compliance with legal obligations (accounting), legitimate interests (security, operations, feedback), and consent where applicable (location and voice features, which you can disable at any time).

3. How we obtain your data

• Directly from you: account registration, feedback forms, and language selection.
• From platform providers: when you sign in with Google or Apple, we receive an identity token (containing your email and a provider subject identifier) and verify it with the provider.
• Automatically: technical metadata (IP address, timestamps) when you use the app; device location only when you enable it for the map.

4. Whether we share data with third parties

We share personal data only with service providers that help us operate the app, and only as necessary. We do not sell personal data, and we do not collect or store your payment card details — payments are handled by the app stores.

Provider	Purpose	Data involved
Google (Maps SDK)	Map display and your current location on the map	Device location (when enabled), IP address
Google Sign-In	Sign in with Google	Identity token, email
Apple Sign-In	Sign in with Apple	Identity token, email
Google Play Billing / Apple StoreKit	In-app purchases	Purchase token (no card data)
Apple / Google Play verification	Receipt and purchase validation	Store token
Cloudflare R2	Hosting static pin images	IP address (request metadata)
Platform speech recognition (Google/Apple)	Voice search	Voice audio (depending on your OS settings)
Hosting provider	Backend and database hosting	All server-side data

5. Data retention

• Account data (email, password hash, provider subject, balance, language, purchase and access records): retained until you delete your account.
• Feedback reports: retained only as long as necessary to resolve your request and improve the app, and then deleted.
• Server logs: retained for a limited period for security and operations, then deleted.
• Device location: not retained by us; processed by the map SDK only while the location layer is enabled.
• Voice audio: not retained by us.

6. International data transfers

Our services are hosted in the European Union (EU). Some providers (such as Google and Apple) may process data outside the EU/EEA. Where that happens, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) to protect your data.

7. Your rights

Depending on your jurisdiction (including the GDPR for EU/EEA/UK users), you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Erase your data (see Deleting your data);
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time (where processing is based on consent).

To exercise a right, contact privacy@voxway.eu. We may ask you to verify your identity before acting on a request.

8. Deleting your data and account

You can delete your account and its data at any time:

• In the app: go to Settings → Delete account and confirm.

Deleting your account removes your email address, password hash, provider identity, Dirham balance (which is forfeited and not refunded), purchased pins, transaction history, and feedback reports. Deletion is irreversible.

You can also request deletion by contacting privacy@voxway.eu.

Please note that Apple and Google retain their own sign-in and purchase records; those are controlled by the platforms, not by Voxway. To manage or delete that data, contact Apple or Google directly.

9. Children

Voxway is a general-audience city-guide app and is not directed at children. We do not knowingly collect personal data from children. The app’s age rating is set in the App Store and Google Play listings.

10. Security

We protect your data with: BCrypt password hashing; a strong-password policy; token-based (JWT) authentication; server-side verification of sign-in tokens; and store-side payment processing (we never handle card numbers).

11. Changes to this policy

We may update this policy from time to time. We will post the revised policy here and update the “Last updated” date above.

12. How to contact us

If you have questions or concerns about this policy or how your data is handled, contact us at:

If you are in the EU/EEA, you also have the right to lodge a complaint with your local data-protection supervisory authority.