Privacy Policy
Last updated: 20 September 2026
This policy explains what personal data Ultreya collects, why we collect it, and the rights you have over it. We keep what we collect to a minimum.
Who we are
Ultreya is an early-stage project still in development, run by a small private team based in Italy. It is not yet an incorporated company; we are testing the idea, and if it goes ahead we intend to form a company and update this policy accordingly.
For now, the Ultreya team is the “data controller” for the personal data described here. For anything concerning your data, write to us at info@ultreyacamino.com.
What this policy covers
Ultreya has two parts: a public website, with the waiting-list sign-up, and an app you reach with an account, where you can explore caminos, register a trip, follow its stages, prepare your backpack, and write in the group chat with the other pilgrims in your cohort.
This policy covers the data collected in both. There are no payments: we never handle card or bank details. And we do not track your movements: Ultreya does not access your device's GPS.
What we collect, why, and our legal basis
When you join the waiting list, when you create an account, and while you use Ultreya, we process the following:
- Email address: when you submit the waiting-list form and when you create an account. It identifies you, lets you sign in, confirms your address, resets your password, and lets us tell you what is new. Legal basis: your consent for the waiting list (GDPR Art. 6(1)(a)); performance of the service contract for the account (GDPR Art. 6(1)(b)).
- Password: if you sign up with an email and a password, it is stored by our provider Supabase in hashed form. We cannot read it. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
- Signing in with Google: if you choose “Sign in with Google”, Google gives us your email address, name, and profile picture to create the account. We never receive your Google password. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
- Profile data: username, display name, a short bio, and a profile photo, if you add them. This is the data we show to others (see “What other people can see”). Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
- Date of birth: asked once, when you complete your profile, to check you are at least 16 — the minimum age to use Ultreya. It is kept private: unlike the rest of your profile, no other pilgrim can see it, and we store it only if you meet the minimum age. Legal basis: compliance with our legal obligations on the age of consent (GDPR Art. 6(1)(c)), read with Art. 8.
- Trip data: the camino you chose, your start and end dates, the stages you selected, the stages you mark as walked and the date you walked them, and your backpack list. They let you plan and follow your camino and assign you to a cohort. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
- Chat messages: the text you write in your cohort's chat, with its author and timestamp. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
- Language preference: the language you use Ultreya in (Italian, English, Spanish, or Portuguese), so we write to you in your language. Legal basis: legitimate interest in communicating clearly (GDPR Art. 6(1)(f)).
- IP address: processed automatically when you submit the waiting-list form, to limit abuse (rate limiting) and run an anti-bot check. We do not store it in our database; it is held only briefly by our security and hosting providers. Legal basis: legitimate interest in protecting the site (GDPR Art. 6(1)(f)).
- Email delivery logs: a short technical record that an email (welcome, sign-up confirmation, or password reset) was sent, failed, or was rejected, so we do not write to you twice and can troubleshoot delivery. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
- Usage statistics: we use Vercel Web Analytics, which is privacy-friendly and cookie-free: it counts page visits in aggregate without profiling you or tracking you across other sites. Legal basis: legitimate interest in understanding our traffic (GDPR Art. 6(1)(f)).
- Account deletion request: the day you asked us to delete your account and the day it is erased. We keep it only until the erasure happens, so we can hold the account for you in the meantime and then remove it. Legal basis: compliance with our legal obligations (GDPR Art. 6(1)(c)), read with Art. 17.
What other people can see
Not everything you save in Ultreya is private. Specifically:
- Public, visible to anyone who knows your profile page address, even without an Ultreya account: your username, display name, profile photo, and bio.
- Visible to the other members of your cohort: your display name, username, profile photo, and the messages you write in the chat.
- Private, visible only to you: your email address, your trip dates, the stages you selected and walked, your backpack list, and your language preference.
- A message you delete is hidden from every member of the cohort and cannot be recovered from the app; the text does, however, remain stored in our database until you delete your account, which removes it for good.
Cookies
We use no advertising or tracking cookies, and we show no cookie banner because the only cookies we set are strictly necessary or functional:
- ultreya_locale: remembers the language you chose.
- Supabase session cookies: set by our backend to keep you signed in. If you have an account and are signed in they hold a token that identifies you; if you are only browsing or joining the waiting list they hold nothing identifying. Signing out clears them.
Who we share data with
We do not sell your data and we do not share it for advertising. We rely on a few trusted providers that process data on our behalf under contract (“processors”):
- Supabase: database, authentication, and file storage (EU region). Holds accounts, profiles, trips, backpacks, chat messages, and profile photos.
- Upstash: Redis store used for rate limiting (EU region). Holds brief IP-based counters.
- Vercel: site hosting and cookie-free analytics (US company).
- Cloudflare: Turnstile anti-bot protection on the waiting-list form (US company).
- Resend: email provider used for account emails, such as sign-up confirmation and password reset (US company).
- register.it: email provider used to send the waiting-list welcome email (Italy, EU).
- Google: only if you choose to sign in with Google, which handles the authentication under its own privacy policy (US company).
International data transfers
Accounts, profiles, trips, chat messages, profile photos, waiting-list data, and rate-limiting data are stored in the EU. Some providers (Vercel, Cloudflare, Resend, Google) are US companies. When personal data is transferred outside the EU/EEA, it is protected by the safeguards the GDPR requires: Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
How long we keep your data
- Account data (email, profile, trips, backpack, chat messages, profile photo): kept for as long as your account exists. When you ask us to delete it, the account is frozen at once — hidden from other pilgrims and no longer usable — and everything in it is erased 30 days later, chat messages included. Those 30 days are there only so you can change your mind: signing in during that time cancels the deletion. Your email address stays registered until the erasure, so no new account can be opened with it. If you want the erasure carried out sooner, write to us.
- Deleted messages: hidden from every member of the cohort straight away, but the text stays in our database until you delete your account.
- Waiting-list email and language: until launch and after we have told you, or until you ask us to remove you, whichever comes first. If we abandon the project, we delete the waiting list.
- Email delivery logs: kept only as long as we need them to manage delivery, then deleted.
- IP-based security data: held by the providers only briefly (a few hours to about a day), then expiring automatically.
- Backups: technical copies of our databases may still contain your data for a short period after deletion, before they are overwritten.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to rectify it, to have it erased, to restrict or object to its processing, and to receive it in a portable format. You can correct your profile data yourself and ask for your account to be deleted at any time from “Profile → Edit profile”: the account is frozen from that moment and erased 30 days later, a window that exists only so you can cancel — write to us if you want it erased sooner. Because the waiting list rests on your consent, you can withdraw it whenever you like: just ask us to remove you.
To exercise any of these rights, write to info@ultreyacamino.com; we will answer within a month. You also have the right to lodge a complaint with a supervisory authority: in Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority in your own country.
Children
Ultreya is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us their data, contact us and we will delete it.
When you create an account we ask for your date of birth and refuse the registration if you are under 16.
How we protect your data
We take measures appropriate to an early-stage project: encrypted connections (HTTPS), passwords stored only as hashes, row-level security in our database (each user reads only their own data and their own cohort's chat), signed and verified internal webhooks, rate limiting, and anti-bot checks. No system is perfectly secure, which is why we deliberately collect as little as possible to keep the risk small.
Changes to this policy
As Ultreya grows — as new features arrive, or when we incorporate a company — we will update this policy and change the “last updated” date above. We will tell registered users and waiting-list subscribers about significant changes that affect them.
Contact
Questions about this policy or your personal data: info@ultreyacamino.com.