[{"data":1,"prerenderedAt":7},["ShallowReactive",2],{"legal:privacy:en-US":3},{"document":4,"locale":5,"markdown":6},"privacy","en-US","# Privacy Policy\n\n**Last Updated:** October 24, 2026\n\n**Service:** Herculane mobile application and supporting API  \n**API:** https:\u002F\u002Fapi.herculane.app  \n**Operator:** Cosmin Albulescu, an individual in Romania  \n**Contact:** [admin@aham.ro](mailto:%61%64%6d%69%6e%40%61%68%61%6d%2e%72%6f)\n\n> **Draft:** Before publication, verify the production hosting and media\n> storage providers, retention periods, and diagnostic SDK configuration\n> listed in the Herculane legal readiness checklist.\n\n---\n\n## 1. Introduction\n\nThis Privacy Policy describes how Cosmin Albulescu (\"we,\" \"us,\" or \"our\")\nprocesses personal data when you use the Herculane mobile application and its\nsupporting API. Herculane provides information about Băile Herculane and its\nsurroundings, and lets signed-in users create and publish stories.\n\nThe identity service used for sign-in is operated at id.aham.ro. This policy\ncovers Herculane's processing; the identity provider may have its own\nadditional processing and notices. See the identity service's\n[Privacy Policy](https:\u002F\u002Faham.ro\u002Fprivacy) for information about its\nprocessing.\n\n## 2. Personal Data We Process\n\n### 2.1 Account and sign-in data\n\nWhen you sign in, the identity provider supplies Herculane with an account\nidentifier and may provide your name, email address, profile picture, and\nauthorization information. Herculane uses this information to recognize your\naccount and apply access permissions. Sign-in is handled using OpenID Connect.\nAuthentication tokens are stored on your device using the platform's secure\nstorage and are sent to the API when needed to authenticate requests.\n\n### 2.2 Profile information\n\nIf you use profile features, Herculane may process your display name, profile\ntype, biography, phone number, profile picture, local-resident preference,\ngame score, and earned badges. Some fields are optional and can be edited in\nthe app.\n\n### 2.3 Stories, photos, and reports\n\nIf you create a story, we process its title, text, selected places, photos,\npublication status, and your choice about allowing its pictures to be shared\nin galleries. Drafts are associated with your account. Published stories can\nbe seen by other users. Pictures are eligible for gallery sharing only when\nyou enable that option.\n\nPhotos selected for a draft may first be stored in the app's private device\nstorage. When you upload them, the media and related story information are\nsent to Herculane's API and configured media storage. If you submit a report,\nwe process the report reason and any note you provide.\n\n### 2.4 Location\n\nThe app can request the device's current location when you explicitly use the\nlocation control in the place-management feature. The location is used to\npopulate coordinates for a place record; the reviewed app code does not show\nbackground or continuous location collection. You can deny location access\nand enter coordinates manually where the feature permits.\n\n### 2.5 Device and service information\n\nWhen the app communicates with the API, technical information may be\nprocessed to deliver, secure, and troubleshoot the service. This may include\nrequest timing, network or device information made available to the service,\nand error or security logs. The exact production log fields and retention\nperiods are still being verified.\n\n### 2.6 Information stored on your device\n\nThe app stores authentication tokens using platform secure storage and may\nstore preferences and draft photos locally. This device storage is separate\nfrom browser cookies. Removing the app may remove locally stored information,\nbut does not by itself delete information already sent to the service.\n\n## 3. How We Use Data and Legal Bases\n\nWe use personal data to:\n\n- authenticate you and provide account-based app features;\n- create, save, publish, display, and manage stories and photos;\n- process reports and maintain community safety;\n- provide location-enabled place-management features when you request them;\n- operate, secure, and troubleshoot the API and app; and\n- respond to privacy requests and comply with legal obligations.\n\nDepending on the feature, the legal basis may be taking steps at your request\nor performing our agreement with you, our legitimate interests in operating\nand securing the service, your consent where required, or compliance with a\nlegal obligation. You can withdraw a device permission through your device\nsettings; this does not affect processing already carried out.\n\n## 4. Analytics and Diagnostics\n\nThe reviewed app source does not show an active analytics route observer or\nexplicit analytics event calls. Firebase Core is initialized on Android, and\nanalytics and crash-reporting packages are included in the project. We are\nverifying production SDK configuration and collection behavior; this policy\nmust be updated if those services collect personal data.\n\n## 5. How We Share Data\n\nWe may share data with:\n\n- **Identity provider:** id.aham.ro, to authenticate accounts and provide\n  account claims.\n- **Hosting and infrastructure providers:** to operate the API, database, and\n  supporting services. The production providers, processing locations, and\n  retention terms must be confirmed before publication.\n- **Media storage provider:** uploaded photos and other media may be stored\n  using the service's configured object storage. The production provider,\n  region, and public-access settings must be confirmed before publication.\n- **Open-Meteo:** the server requests weather information for fixed Băile\n  Herculane coordinates. This request does not use your device's location.\n- **Other users:** published stories are available to other users. If you\n  enable gallery sharing, the story's pictures may also be included in\n  galleries.\n- **Authorities or other parties:** when required by law, or when reasonably\n  necessary to protect people, rights, or the service.\n\nWe do not sell personal data. We do not use the app to serve advertising.\n\n## 6. International Transfers\n\nService providers may process data in countries other than Romania or the\nEuropean Economic Area. The production provider locations and any applicable\ntransfer safeguards are being verified. We will update this policy with\nrelevant provider and transfer information before publication.\n\n## 7. Data Retention and Deletion\n\nWe keep data for as long as needed for the purposes described in this policy,\nto provide the service, and to meet applicable legal requirements. Drafts and\npublished stories can be deleted using the available story controls. Exact\nretention periods for accounts, reports, server logs, media, and backups have\nnot yet been verified.\n\nThe currently reviewed API does not provide an account-deletion endpoint. To\nrequest account or personal-data deletion, email [admin@aham.ro](mailto:%61%64%6d%69%6e%40%61%68%61%6d%2e%72%6f)\nfrom the address associated with your account, if available. We will review\nthe request and explain any information we must retain under applicable law.\nDeleting the app does not delete server-side information.\n\n## 8. Your Rights\n\nDepending on applicable law, you may have the right to access, correct,\ndelete, restrict, or object to processing of your personal data, to receive\nportable data, and to withdraw consent where processing is based on consent.\nTo make a request, contact us at [admin@aham.ro](mailto:%61%64%6d%69%6e%40%61%68%61%6d%2e%72%6f).\n\nYou may also lodge a complaint with the Romanian National Supervisory\nAuthority for Personal Data Processing (ANSPDCP) at\n[dataprotection.ro](https:\u002F\u002Fwww.dataprotection.ro\u002F), or with your local data\nprotection authority.\n\n## 9. Children's Privacy\n\nHerculane account features are intended for people aged 16 or older. We do\nnot knowingly seek to collect personal data from children under 16. If you\nbelieve a child has provided personal data, contact us at\n[admin@aham.ro](mailto:%61%64%6d%69%6e%40%61%68%61%6d%2e%72%6f).\n\n## 10. Security\n\nWe use technical and organizational measures intended to protect data.\nAuthentication tokens are stored using platform secure storage, and\nproduction app-to-service connections use HTTPS. No method of transmission or\nstorage is completely secure, and we do not claim that all server data is\nencrypted at rest.\n\n## 11. Changes to This Policy\n\nWe may update this policy when our practices or legal requirements change.\nThe \"Last Updated\" date above identifies the latest document revision.\nSignificant changes will be communicated where required by law.\n\n## 12. Contact and Data Controller\n\nThe data controller for Herculane is **Cosmin Albulescu**, an individual in\nRomania. For privacy questions or requests, contact:\n\n- **Email:** [admin@aham.ro](mailto:%61%64%6d%69%6e%40%61%68%61%6d%2e%72%6f)\n- **Service:** Herculane mobile application and API\n",1792866595958]