Ventura records your drives and turns each one into a *memory*: a route, the photos you attach, and statistics. Recording happens on your phone; the statistics are computed on our servers from the raw GPS trace your phone uploads. There is no "publish" step — a recorded drive becomes a memory automatically. Who can see it is set out in §4.

Because of what the app is, Ventura necessarily knows where you drive. This policy exists to tell you exactly what happens to that knowledge.

Location. A GPS trace while you are recording a drive, including while the app is in the background or your screen is locked, if you grant that permission. This is the core of the product; without it there is no memory to build.

Your vehicles. What you enter about the cars in your garage — make, model, year, engine, fuel, colour, a nickname and photos — and which car each drive was made in, which you choose. Ventura does not read your car's Bluetooth or any other identifier from the vehicle.

Photos. Images you attach to a drive or a vehicle. We remove embedded location data (EXIF GPS) from photos before storing them.

Account information from your sign-in provider. Ventura signs you in with Google or Apple only — we never see or store a password. From the provider we receive your email address, and your name and profile picture where the provider supplies them. Apple may give you a private relay email address instead of your real one; that works fine with Ventura.

Date of birth. Collected once at sign-up.

Device push token, if you enable notifications.

What you do with other people. The people you follow and who follow you, follow requests, comments and likes, drives you confirm you made together with someone, the people you block, and anything you report — who sent the report, what it concerns and the reason given.

Subscription records, if you buy Plus or Pro in the app. On iPhone, Apple sends us a signed record of the purchase; on Android, our server asks Google Play for the state of the purchase using the purchase token the app receives. Either way we learn which plan, the subscription's identifiers, its dates and whether it will renew. We keep the plan, where it was bought and the subscription's identifier, so the plan stays attached to your account through renewals. Neither Apple nor Google gives us your card or other payment details, and we never see them.

What the app asks your phone for. Location (while using the app, or always, if you allow it, so a drive keeps recording with the screen locked), access to the photos you choose to attach, and permission to send notifications. Ventura does not access your camera, microphone, contacts or Bluetooth. You can withdraw any permission in your phone's settings.

What stays on your phone. A drive is recorded on the phone first and kept there until it has uploaded. After upload the phone keeps its own copy of the trace only until the drive has been processed, and for no more than seven days. Photos that are over your plan's limit are kept on the phone and not uploaded. Deleting the app removes all of this from the phone.

How you use the app. The phone app records which screens you open, which controls you press, how far you scroll through a memory, and whether the permissions recording needs are still granted — along with your plan, your platform, your app version and your language. These events are processed for us by PostHog (§5), on servers in Frankfurt.

This is not tied to your account. PostHog gives your installation a random identifier of its own, and we never send it your Ventura user id, your name, your email or your handle. The events say "someone on Plus opened the drive menu", not who did. Deleting and reinstalling the app starts a new identifier.

What we never send to PostHog: coordinates, routes, place names, the titles and stories of your drives, your photos, and the details of your vehicles. Distances and durations go as broad ranges only, never as exact figures, because an exact "47.3 km at 08:12 every weekday" describes the road to your home even with no coordinates attached to it.

This applies to the phone app. The Ventura website measures nothing and stores nothing on your device for it, which is why §10 still has no cookie banner to show you.

We do not use advertising services, we do not build advertising profiles and we do not sell data. There is no advertising SDK in Ventura. We do not write coordinates to our application logs. You can object to the measurement described here — see §8.

We do look at overall numbers of our own. From the drives already recorded in Ventura we work out how far and how often people drive, what kinds of places they stop at, and how reliably recording performs, so we can see how the app is used and what to improve next. This stays with us: no other company is involved, nothing extra is collected from your phone for it, and the figures describe patterns across many people rather than you. You can object to this — see §8.

You can withdraw consent for notifications at any time by turning them off; it does not affect anything else.

The route is shortened before it is ever saved — including for you. Ventura removes a stretch from the beginning and the end of every drive at the moment it is processed, and only the shortened route is stored. There is no fuller copy kept anywhere, so no request, mistake or breach can produce one. This is why your own drives are drawn shorter than the distance shown beside them: the distance is measured from the complete recording, the line is not.

You choose how much is removed — at least 100 m, 200 m, 500 m or 1 km at each end, in your profile settings. "At least" is exact wording: a little more is removed than you pick, randomised per drive, because a fixed distance can be measured across several drives and used to work backwards to the exact point. Changing the setting applies to drives you record afterwards; drives you already have keep the setting they were saved with, so lowering it can never uncover your history. For the same reason a single drive can carry a different distance from the one shown in your settings today: each drive records the distance it was actually saved with. One case creates that difference deliberately — a drive too short to remove your chosen distance from both ends. There we ask you first, and either remove less (with your agreement, and the drive keeps that smaller distance) or show the drive with no route at all. We never quietly remove less than you asked for.

The complete recording — the raw GPS trace the route is calculated from — is kept privately for 30 days and then deleted. It is never shown to anyone, and it is included in your data export while it exists.

We want to be precise about how far this protects you: it makes your start and end points *harder to determine*, and it is on by default for everyone. It is not anonymity, and we do not claim it is. Someone who can see many of your drives may still be able to narrow down an area. Trim your circle of followers accordingly — that remains the strongest control you have.

Who sees a drive, exactly:

• You — always, at once.
• Followers you have approved. If you set a delay before followers see a new drive (on a paid plan), they see it only when that delay has passed. When a drive becomes visible to them, they may get a notification with your name and its distance — never where it went.
• A drive you made together with someone. If you both confirm that you were in the same car, it appears for the other person too, and each of your approved followers can see it.
• Anyone with a share link. If you create a link to a drive or a journey, whoever has the link can open it without an account. The route behind a link is the same shortened one. You can turn a link off at any time, and it then stops working for everyone. Treat the link like the drive itself.

Nobody else sees your drives. A public profile only means follow requests are accepted automatically; it does not make your drives visible to the open internet. Blocking someone removes them from your followers and from your shared drives. A share link works for whoever holds it, including someone you later block — turn the link off if that matters.

Stops and photos inside a trimmed stretch are not shown to other people, and photos taken there are shown without any map or location.

Place names stay at city level — "Kraków → Praha", never a street address.

We do not sell your data and we do not share it with advertisers. These are the only third parties involved in running Ventura:

The requests to OpenStreetMap are made by our servers, not by your phone, so your device's IP address is never revealed to them. Map tiles are the exception: those your device fetches directly, which is why OpenFreeMap sees your IP address and the area of the map you are looking at.

These providers process data on our instructions under data-processing agreements.

Paid plans are currently sold only inside the app — through the App Store on iPhone and Google Play on Android. We will add a payment provider (Stripe) to this list if we start selling on our website; until then, Apple and Google are the only payment companies involved.

Ventura's database, authentication and file storage run in Supabase's eu-west-3 region (Paris, France) — inside the European Economic Area. Your account, your drives, your routes, your raw GPS traces and your photos are stored there.

Three things do leave the EEA:

• Supabase Inc. is a United States company. Although your data is stored in France, its staff may access it for support and operational reasons. Supabase offers Standard Contractual Clauses for this, and we rely on them.
• PostHog, which measures how the app is used (§2), stores those events in Frankfurt, Germany — inside the EEA. PostHog Inc. is a United States company and its staff may access them for support and operational reasons; we rely on Standard Contractual Clauses. It never receives your coordinates, your routes or your photos, and what it does receive is not tied to your account.
• Expo, which delivers push notifications, operates from the United States. It receives your device's push token and the text of the notification — nothing about where you drive. We rely on Standard Contractual Clauses here too. Expo hands the notification to Apple's or Google's push service, which shows it on your phone.

Nominatim is run by the OpenStreetMap Foundation on servers in Europe. OpenFreeMap serves tiles from a network with nodes in several countries; a tile request carries your IP address and nothing else about you.

Your drives, photos and account data are kept for as long as your account exists. Ventura does not delete your memories on its own — not on downgrade, not after inactivity.

If you delete your account:

1. It is frozen immediately — your profile, garage and drives disappear from everyone else's view at once. 2. You have 30 days to change your mind, and can cancel the deletion in that window. 3. After 30 days we permanently delete your stored files and then your account record. This is not reversible and we keep no copy.

One honest caveat: deleted data can persist in our encrypted database backups for a limited period, until those backups are rotated in the ordinary course of business. It is not accessible in the product and is not used for anything.

If you have paid for a subscription, we keep the minimum billing records that tax and accounting law requires us to keep, even after account deletion.

Under GDPR you may ask us to:

• give you a copy of your data (Art. 15) — download it yourself from account settings on the website, at any time and free of charge, or write to vasialeleka@ukr.net;
• correct anything inaccurate (Art. 16) — most fields you can edit yourself in your profile;
• delete your data (Art. 17) — available directly in account settings, see §7;
• receive your data in a portable format (Art. 20) — the same export gives you machine-readable JSON with your drives, routes and files;
• object to or restrict certain processing (Arts. 18, 21).

You also have the right to complain to a data protection authority. In Poland that is the *Prezes Urzędu Ochrony Danych Osobowych* (uodo.gov.pl); you may also complain to the authority where you live.

Ventura is for people aged 16 and over. We ask for your date of birth when you create an account, and accounts are not available to anyone younger.

We chose a single age for everyone rather than the lowest each country allows. Sixteen is the digital-consent age in Poland, where Ventura is established, and it is the highest any EU country sets, so one rule covers everybody — and it means we never have to collect or verify a parent's consent, which would mean collecting *more* personal data about *more* people, including the parent.

If we find that an account belongs to someone under 16, we delete it and the data with it. If you believe a child has created an account, write to vasialeleka@ukr.net and we will look into it.

Ventura is a record of drives, and in most of the countries we operate in you cannot hold a car licence before 17 or 18 in any case.

The Ventura website uses a single essential cookie to keep you signed in. We use no advertising or analytics cookies, which is why you are not shown a cookie consent banner. The measurement described in §2 runs in the phone app only: the website stores nothing on your device for it.

Data is encrypted in transit and at rest. Raw GPS traces and photos live in private storage reachable only through short-lived signed links. Access rules are enforced in the database itself, so one user's data cannot be read by another. Only our processing backend holds elevated credentials; the phone and web apps never do.

When this policy changes we update the date at the top, and we tell you in the app if the change is material.

Ventura is operated by Vasyl Leleka, Jednoosobowa działalność gospodarcza, registered at ul. Raciborska 4/3, 30-384 Kraków, Polska, NIP 6762659137, REGON 527272851.

For anything concerning this policy or your personal data, write to vasialeleka@ukr.net. We answer data-protection requests within one month, as GDPR requires.