Trecurio Privacy Policy

The data controller is Headcoder Studio (operator of the Trecurio app). Contact for all data matters: contact@trecurio.com.

• Account: e-mail address and password (stored as a hash); chosen language. The beta does not offer Google or Apple sign-in, so we process no identifiers from those services.
• Photos: pictures of places you take in the app — stored in your private archive and sent for AI analysis.
• Precise location: GPS coordinates and compass heading at the moment of the photo — used to recognise the place and build your travel map.
• Voice recordings: when you ask a question by voice, the recording is sent for transcription; we store the conversation and audio replies.
• Conversations: chat questions and answers about places and notes you save.
• Notifications: if you enable them, a notification token tied to your device. A notification about a finished recognition contains the name of the place, so that name reaches the delivery service and your phone maker's notification system. We delete the token on sign-out and on account deletion; consent is optional and you can withdraw it in your phone settings.
• Technical data: crash and performance reports (Sentry, with no intentional collection of personal data), AI call logs (model, timings, token counts) and daily usage counters.

• providing the service — place recognition, narrations, chat, map and journal (art. 6(1)(b) GDPR);
• security, crash diagnostics and abuse-protection limits (art. 6(1)(f) GDPR — legitimate interest);
• account e-mails, e.g. the password reset code (art. 6(1)(b) GDPR);
• contacting beta programme participants about the testing under way — requests for impressions and short surveys; taking part is voluntary and you can opt out (art. 6(1)(f) GDPR — legitimate interest in improving the app).

We use external providers who process data on our behalf to deliver the service. Below we list their categories together with the purpose of processing and the scope of data they receive. We share only what is necessary.

• Artificial intelligence model providers (Google, Perplexity, ElevenLabs) — recognising places in photos, preparing descriptions and conversation replies, and powering voice features. They receive the photo, coordinates, conversation content, narration text and voice recordings.
• Place data providers (Geoapify) — determining the locality and nearby objects. They receive coordinates.
• Hosting and infrastructure provider (Supabase) — storing your account, entries, photos and recordings (region: Frankfurt, EU).
• Crash monitoring provider (Sentry) — diagnosing application errors (EU servers).
• Notification delivery provider (Expo, plus your phone maker's notification system, e.g. Apple Push Notification service) — delivering the notification that a recognition is ready. They receive the device token and the notification content, including the name of the place.
• Transactional e-mail provider (SMTP2GO) — sending account-related messages. It receives your e-mail address.
• Form protection provider (Google reCAPTCHA) — on the trecurio.com website only, for the waitlist sign-up form. It starts once you begin filling the form in; it receives your IP address and information about how you interact with the page, and uses them to judge whether a human is filling the form.

Some providers process data outside the EEA, including in the USA. Transfers rely on an adequacy decision (EU-U.S. Data Privacy Framework) or, where that does not apply, on Standard Contractual Clauses approved by the European Commission.

Place descriptions, narrations and chat replies are generated by artificial intelligence. They may contain errors or inaccuracies — treat them as a guide's story, not an encyclopedic source. Report mistakes to contact@trecurio.com.

We store one cookie (trecurio_consent, valid for 182 days), purely to remember your answer in the consent dialog; without it we would ask again on every visit. That cookie is necessary for the consent mechanism itself and is not used to recognise you for any other purpose.

If you join the waitlist we process your e-mail address, the language of the page and a technical hash of your IP address (used only to cap the number of sign-ups from one place; we do not store the address itself). The legal basis is your consent, given by submitting the form. We use the address solely to send you an invitation to the test programme, we do not pass it on, and we delete it once the tests end or earlier at your request.

The form is protected by Google reCAPTCHA, which judges whether a human is filling it in. Google then receives your IP address and information about your interaction with the page. Without your consent we do not load Google's script at all — we ask for it in a dialog on your first visit, and you can change your answer at any time via the "Privacy settings" link in the footer. Once you consent, Google sets its own cookie (_GRECAPTCHA), used solely to judge whether you are a bot. If you would rather not consent, write to the address below and we will add you to the list manually.

• account data, entries, photos, recordings and conversations — until you delete your account;
• AI call logs (service quality and costs) — detached from your identity after account deletion (they become anonymous);
• crash reports — per Sentry retention (up to 90 days);
• database backups — up to 30 days after data deletion.

You have the right to access, rectify, erase, restrict processing, port your data and object. You can delete your account in the app (Settings → Account → Delete account) — instructions: trecurio.com/en/account-deletion. You can also write to contact@trecurio.com. You may lodge a complaint with your supervisory authority (in Poland: the President of UODO).

During the beta this policy may change — we will announce material changes in the app or by e-mail. The last-updated date is always shown at the top.