HomeRO

Privacy Policy

Last Updated: October 24, 2026

Service: Herculane mobile application and supporting API
API: https://api.herculane.app
Operator: Cosmin Albulescu, an individual in Romania
Contact: admin@aham.ro

Draft: Before publication, verify the production hosting and media storage providers, retention periods, and diagnostic SDK configuration listed in the Herculane legal readiness checklist.

1. Introduction

This Privacy Policy describes how Cosmin Albulescu ("we," "us," or "our") processes personal data when you use the Herculane mobile application and its supporting API. Herculane provides information about Băile Herculane and its surroundings, and lets signed-in users create and publish stories.

The identity service used for sign-in is operated at id.aham.ro. This policy covers Herculane's processing; the identity provider may have its own additional processing and notices. See the identity service's Privacy Policy for information about its processing.

2. Personal Data We Process

2.1 Account and sign-in data

When you sign in, the identity provider supplies Herculane with an account identifier and may provide your name, email address, profile picture, and authorization information. Herculane uses this information to recognize your account and apply access permissions. Sign-in is handled using OpenID Connect. Authentication tokens are stored on your device using the platform's secure storage and are sent to the API when needed to authenticate requests.

2.2 Profile information

If you use profile features, Herculane may process your display name, profile type, biography, phone number, profile picture, local-resident preference, game score, and earned badges. Some fields are optional and can be edited in the app.

2.3 Stories, photos, and reports

If you create a story, we process its title, text, selected places, photos, publication status, and your choice about allowing its pictures to be shared in galleries. Drafts are associated with your account. Published stories can be seen by other users. Pictures are eligible for gallery sharing only when you enable that option.

Photos selected for a draft may first be stored in the app's private device storage. When you upload them, the media and related story information are sent to Herculane's API and configured media storage. If you submit a report, we process the report reason and any note you provide.

2.4 Location

The app can request the device's current location when you explicitly use the location control in the place-management feature. The location is used to populate coordinates for a place record; the reviewed app code does not show background or continuous location collection. You can deny location access and enter coordinates manually where the feature permits.

2.5 Device and service information

When the app communicates with the API, technical information may be processed to deliver, secure, and troubleshoot the service. This may include request timing, network or device information made available to the service, and error or security logs. The exact production log fields and retention periods are still being verified.

2.6 Information stored on your device

The app stores authentication tokens using platform secure storage and may store preferences and draft photos locally. This device storage is separate from browser cookies. Removing the app may remove locally stored information, but does not by itself delete information already sent to the service.

3. How We Use Data and Legal Bases

We use personal data to:

  • authenticate you and provide account-based app features;
  • create, save, publish, display, and manage stories and photos;
  • process reports and maintain community safety;
  • provide location-enabled place-management features when you request them;
  • operate, secure, and troubleshoot the API and app; and
  • respond to privacy requests and comply with legal obligations.

Depending on the feature, the legal basis may be taking steps at your request or performing our agreement with you, our legitimate interests in operating and securing the service, your consent where required, or compliance with a legal obligation. You can withdraw a device permission through your device settings; this does not affect processing already carried out.

4. Analytics and Diagnostics

The reviewed app source does not show an active analytics route observer or explicit analytics event calls. Firebase Core is initialized on Android, and analytics and crash-reporting packages are included in the project. We are verifying production SDK configuration and collection behavior; this policy must be updated if those services collect personal data.

5. How We Share Data

We may share data with:

  • Identity provider: id.aham.ro, to authenticate accounts and provide account claims.
  • Hosting and infrastructure providers: to operate the API, database, and supporting services. The production providers, processing locations, and retention terms must be confirmed before publication.
  • Media storage provider: uploaded photos and other media may be stored using the service's configured object storage. The production provider, region, and public-access settings must be confirmed before publication.
  • Open-Meteo: the server requests weather information for fixed Băile Herculane coordinates. This request does not use your device's location.
  • Other users: published stories are available to other users. If you enable gallery sharing, the story's pictures may also be included in galleries.
  • Authorities or other parties: when required by law, or when reasonably necessary to protect people, rights, or the service.

We do not sell personal data. We do not use the app to serve advertising.

6. International Transfers

Service providers may process data in countries other than Romania or the European Economic Area. The production provider locations and any applicable transfer safeguards are being verified. We will update this policy with relevant provider and transfer information before publication.

7. Data Retention and Deletion

We keep data for as long as needed for the purposes described in this policy, to provide the service, and to meet applicable legal requirements. Drafts and published stories can be deleted using the available story controls. Exact retention periods for accounts, reports, server logs, media, and backups have not yet been verified.

The currently reviewed API does not provide an account-deletion endpoint. To request account or personal-data deletion, email admin@aham.ro from the address associated with your account, if available. We will review the request and explain any information we must retain under applicable law. Deleting the app does not delete server-side information.

8. Your Rights

Depending on applicable law, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to receive portable data, and to withdraw consent where processing is based on consent. To make a request, contact us at admin@aham.ro.

You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at dataprotection.ro, or with your local data protection authority.

9. Children's Privacy

Herculane account features are intended for people aged 16 or older. We do not knowingly seek to collect personal data from children under 16. If you believe a child has provided personal data, contact us at admin@aham.ro.

10. Security

We use technical and organizational measures intended to protect data. Authentication tokens are stored using platform secure storage, and production app-to-service connections use HTTPS. No method of transmission or storage is completely secure, and we do not claim that all server data is encrypted at rest.

11. Changes to This Policy

We may update this policy when our practices or legal requirements change. The "Last Updated" date above identifies the latest document revision. Significant changes will be communicated where required by law.

12. Contact and Data Controller

The data controller for Herculane is Cosmin Albulescu, an individual in Romania. For privacy questions or requests, contact:

  • Email: admin@aham.ro
  • Service: Herculane mobile application and API