BudaPast
Themes
Collection

Privacy Policy

Last updated and in force from: 9 October 2026

In short

    •
    You can use BudaPast without an account, a name or an email address.
    •
    If you allow it, your location is used on your device while a map or a discovery is open, and sent to us only when you ask us to check that you have arrived. We never record your route and never track you in the background.
    •
    No advertising, no analytics, no tracking cookies. We never sell or rent personal data.
    •
    You can delete your account and everything linked to it at any time: Settings → Delete account and data.

1. Who is responsible for your data

The data controller is the operator of BudaPast (budapast.app). Contact for every privacy question or request: contact.budapast@gmail.com.
This policy covers the budapast.app website and web app and the BudaPast mobile apps. We have not appointed a data protection officer, because the law does not require one for a service of this size.

2. What we process, why, and for how long

We process personal data under the EU General Data Protection Regulation (GDPR) and Hungarian law. You are never obliged to give us data; where something is optional we say so.

Guest account

What: A random account identifier, created the first time you open the app. It contains no name, email or device identifier.
Why: To keep your progress and to let our server confirm your arrivals.
Legal basis: Performance of the service you asked for (GDPR Art. 6(1)(b)).
Kept: Until you delete it. We may delete accounts that have not been used for 24 months.

Registered account (optional)

What: Your email address and, if you give it, a display name. Your password is handled by Google's Firebase Authentication and stored only in hashed form; we can never see it. If you sign in with Google, we receive your name, email address and profile photo address from Google.
Why: To let you keep your progress across devices and recover your account.
Legal basis: Performance of the service you asked for (GDPR Art. 6(1)(b)).
Kept: Until you delete the account.

Acceptance of the terms

What: Which version of the Terms of Use and this Privacy Policy you accepted, and when. Stored with your guest or registered account.
Why: To show which terms you agreed to, and to ask again when they change.
Legal basis: Performance of the service you asked for (GDPR Art. 6(1)(b)).
Kept: Until you delete the account.

Progress

What: Which locations you reached and when, whether the arrival used the standard check or the observation fallback, a coarse GPS quality and distance band (for example “good”, “within 30 m”), which questions you answered, how many attempts you made, and which stories you unlocked. No coordinates are stored with your progress.
Why: To show your collection and open the stories you earned.
Legal basis: Performance of the service you asked for (GDPR Art. 6(1)(b)).
Kept: Until you delete the account.

Location

What: Only after you allow location in your browser or device, and only when you tap “Redeem location” or “Use observation fallback”: one position (latitude, longitude, accuracy and time of the fix) is sent to our server and compared with the location. If the arrival is confirmed, the position is not stored. If it is not confirmed, the last position you sent stays in your open discovery session, so that impossible jumps between attempts can be detected. The distance shown on screen and “My location” on the map are calculated on your device and are not sent to us.
Why: To confirm that you are at the location before its story opens.
Legal basis: Your consent, given through the location permission (GDPR Art. 6(1)(a)). You can withdraw it at any time in your browser or device settings; you can still browse, but new locations cannot be confirmed.
Kept: The session is deleted the moment your arrival is confirmed. An unfinished session expires after 90 minutes and is erased automatically, usually within a day. We never collect location in the background and never record a route.

Problem reports

What: The category and text you send, the story it concerns, the app version, your account identifier and the time. Please do not include personal information in the text.
Why: To fix safety, access and content problems.
Legal basis: Our legitimate interest in a safe and accurate service (GDPR Art. 6(1)(f)).
Kept: 24 months, then deleted automatically. If you delete your account earlier, your reports are kept but no longer linked to you.

Security and abuse prevention

What: Counters of how many requests an account and an IP address made (the IP address only in hashed form). Technical server logs at our hosting provider: IP address, browser type, time and the request made. Sign-in records kept by Firebase Authentication, including the IP address. To tell the real app from automated scripts we may use Firebase App Check with Google reCAPTCHA Enterprise, which evaluates browser and device signals.
Why: To keep the service available, prevent abuse and investigate faults.
Legal basis: Our legitimate interest in a secure, working service (GDPR Art. 6(1)(f)).
Kept: Request counters: about two days. Server logs: 30 days. Sign-in IP records: a few weeks. Web-hosting logs kept by Google: a few months.

Messages you send us

What: Your email address and whatever you write, if you contact us.
Why: To answer you and handle your request.
Legal basis: Our legitimate interest in handling enquiries, or a legal obligation when you exercise your data protection rights (GDPR Art. 6(1)(f) and (c)).
Kept: Up to 24 months after the matter is closed.

3. What is stored on your device

The app keeps a few things in your browser's or phone's storage: your language and theme, your acceptance of these terms and whether you allowed location, a copy of your progress, your sign-in session, and a cache of the app's own files so it loads quickly and works on a weak connection. All of this is strictly necessary for the app to work, so no consent banner is needed. We set no advertising or tracking cookies.
“Delete progress on this device” in Settings clears the local copy. Clearing your browser's site data removes everything.

4. What we do not do

    •
    No advertising and no advertising identifiers.
    •
    No analytics or usage-tracking tools, and no tracking across other apps or websites.
    •
    No sale, rental or trading of personal data.
    •
    No background location and no movement history.
    •
    No access to your contacts, photos, camera or microphone.
    •
    No profiling, and no automated decisions that have legal or similarly significant effects on you. Arrival checks are automatic, but they only decide whether a story opens; if a check seems wrong, use “Report a problem”.

5. Who else handles your data

We share personal data only with the service providers needed to run BudaPast, and only as far as each one needs it.
    •
    Google (Google Ireland Limited and Google Cloud EMEA Limited, Dublin, Ireland; parent company Google LLC, USA). Its Firebase and Google Cloud services provide our sign-in, database, server functions and web hosting. Google acts as our processor under a data processing agreement and may use the data only on our instructions.
    •
    OpenFreeMap (Hyperknot Software Kft., Hungary) supplies the map. When a map is on screen, your browser loads map tiles directly from OpenFreeMap, which therefore receives your IP address and the area you are viewing, but not your account or your position. According to its own privacy policy it sets no cookies and deletes its server logs after 7 days, and it may use Cloudflare to deliver the tiles.
    •
    Google sign-in, only if you choose it. Google then processes your sign-in under its own privacy policy.
    •
    Google Maps, only if you tap “Get directions”. This opens Google Maps with the destination; what happens there is governed by Google's privacy policy.
    •
    Authorities or courts, where a law obliges us to disclose data.
Each processor is bound by a contract that gives your data protection at least equal to this policy. Stories also link to their sources on other websites; those sites have their own privacy policies.

6. Where your data is processed

Our database and server functions run in the European Union (Google's europe-west1 region in Belgium). Some Google services work globally: Firebase Authentication runs in data centres in the United States, so your account email address, hashed password and sign-in IP address are processed there, and web-hosting logs may be processed outside the EU.
These transfers are protected by the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Google LLC is certified, and by the standard contractual clauses in Google's data processing terms. You can ask us for more information about these safeguards.

7. Deleting your data

You can delete your account yourself at any time, in the app or on the website: open Settings (the menu button at the top right) and choose “Delete account and data”. This works for guest and registered accounts alike, and you do not need to contact us.
Deletion is immediate and permanent. It removes your account, your sign-in details, your progress and any open discovery session, on all devices. Problem reports you sent are kept for the remainder of their 24 months, but are no longer linked to you.
Our hosting provider may keep deleted data in its backup systems for up to 180 days before it is finally erased, and the technical logs described above expire on their own schedule. If you cannot use the app, send us a deletion request and we will act on it within one month.
Step-by-step deletion guide

8. Your rights

Under the GDPR you have the right to:
    •
    know whether we process your data and receive a copy of it (access);
    •
    have inaccurate data corrected;
    •
    have your data erased;
    •
    have processing restricted;
    •
    receive the data you gave us in a portable format;
    •
    object to processing that is based on our legitimate interest;
    •
    withdraw a consent at any time, without affecting what was done before.
To use any of these rights, contact us at contact.budapast@gmail.com. It is free. We answer within one month; in complex cases the law allows two further months, and we will tell you if we need them. Because most accounts carry no name, we may ask you to send the request from the signed-in app or from your account's email address, so that we know the data is yours.
If you believe we have handled your data unlawfully, you may complain to the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11; postal address 1363 Budapest, Pf. 9; ugyfelszolgalat@naih.hu; www.naih.hu. You may also complain to the authority of the EU country where you live, or go to court.

9. Children

BudaPast is a general-audience service and is not directed at children. If you are under 16, please use it only with the agreement of a parent or guardian. We do not knowingly collect personal data from children under 16 without that agreement; if you believe a child has given us data, contact us and we will delete it.

10. How we protect your data

    •
    All traffic between your device and our services is encrypted (HTTPS/TLS), and the stored data is encrypted at rest by our hosting provider.
    •
    The database refuses every request by default; each person can read only their own records, and only our server can write progress.
    •
    Passwords are handled by Firebase Authentication and never reach us in readable form.
    •
    We collect as little as possible: no route, no coordinates in your progress, and IP addresses only in hashed form in our own records.
No online service can be perfectly secure. If a breach were likely to put your rights at risk, we would inform the authority and the people affected as the law requires.

11. Changes to this policy

We will update this policy when the app or the law changes, and show the date of the latest version at the top. If a change is significant, for example a new kind of data or a new purpose, we will tell you in the app before it takes effect and, where the law requires it, ask for your consent.
Terms of Use