Privacy Policy
This policy explains what personal data Relicly processes, why, for how long and what rights you have. It is based on Regulation (EU) 2016/679 (GDPR), Portuguese Law no. 58/2019 (which implements it in Portugal) and Law no. 41/2004 (privacy in electronic communications). The Portuguese version is the authoritative one if there is any difference.
1. Who is responsible for your data
The data controller is Sensatiligeiro, tax ID (NIF) 518125882, address Rua da Quinta, N.º 3, Bloco 1, 5º Dto., 4490-053 Póvoa de Varzim ("we").
Contact for any privacy matter and to exercise your rights: suporte@nexoriontech.pt. We have not appointed a Data Protection Officer because we are not required to; this address serves that purpose.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: e-mail, username, full name, date of birth, sign-in method (e-mail or Google), language | Create and manage your account; confirm your e-mail; check the minimum age of 13; choose the language of messages | Performance of a contract (1(b)); legal minimum-age compliance (1(c)) |
| Profile: photo, bio, public or private profile, level | Show your profile to other users, according to the visibility you choose | Performance of a contract |
| Activity: monuments visited, date and type of visit (check-in or manual), points, badges, quests, GPS position at the time of check-in | Run the game, calculate points and routes, and prevent cheating (for example, fake positions) | Performance of a contract; legitimate interest in keeping the game fair (1(f)) |
| Location: your phone's position | Show the map and validate check-ins within 100 m of a monument. Only requested while the app is in use: no background tracking | Consent, given through your phone's permission (1(a)); you can withdraw it in system settings |
| Social: who you follow and who follows you, requests, blocked users, conversations and messages | Follow people and chat with them inside the app | Performance of a contract |
| Security: sign-in attempts per account, IP address (stored only as a derived code, a "hash", never in clear), temporary lockouts, automatic-moderation records | Protect accounts against password guessing and the app against abuse; e-mail you if your account is locked | Legitimate interest in security (1(f); GDPR art. 32) |
| Notifications: a device identifier (token) for push notifications | Tell you about level-ups, badges, follow requests and messages | Performance of a contract; consent (system permission on Android 13+) |
| Reports and contacts: what you write when reporting a user or message, or contacting support | Handle the report or request and protect the community | Legitimate interest and legal duties of online platforms (Regulation (EU) 2022/2065, Digital Services Act) |
We do not use advertising and, in this version, the app contains no third-party analytics tools (such as Google Analytics). We do not process special categories of data (such as health or religion) and we never ask for identity documents.
Providing your e-mail, username and date of birth is necessary to create an account; without them we cannot provide the service. Location, photo, bio and notifications are optional.
3. Who else sees your data
Other users
Your username, name, photo, bio and level are visible to other users. If your profile is public, they also see your points, visits, badges and quests. If it is private, only the followers you approve see them (others see only your level). We never show your e-mail, date of birth or the GPS coordinates of your check-ins.
Service providers (processors)
To run the app we use providers that process data on our behalf and under our instructions:
- Google (Firebase and Google Cloud): authentication, database, photo storage, server functions, push notifications, and automatic checking of profile photos (Cloud Vision).
- Google Maps and Google Sign-In: the app's map and signing in with your Google account, if you choose it.
- Brevo (Sendinblue): sending security e-mails (for example, the account-lockout notice).
Monument photos (Wikimedia Commons): the photos are loaded directly from the servers of the Wikimedia Foundation, which receive the IP address and technical details of your device in the image requests, under Wikimedia's own privacy policy. We send them no data from your account.
We may also disclose data to public authorities when the law requires it. We do not sell or rent personal data and we do not share it with advertising networks.
4. Transfers outside the European Union
Our database and our server functions are located in London (United Kingdom), a country that the European Commission recognises as providing an adequate level of protection. In addition, some providers, notably Google, may process data outside the European Economic Area, including the United States. The same may apply to the Wikimedia Foundation, which may serve the photos from servers outside the European Union. This only happens with appropriate safeguards, such as the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.
5. How long we keep your data
- While your account exists: we keep your account, profile and activity data.
- When you delete your account (Settings › Delete Account): we delete your profile, private data, statistics, visits (with positions), conversations and messages, who you follow and who follows you, blocks, moderation records and profile photo.
- Reports involving you: we keep them for up to 12 months after they are resolved, to protect other people and defend rights in case of a dispute, and then delete them.
- Security data: per-IP counters are deleted after 2 days; sign-in attempts after 30 days without activity (and never while the account is locked); the IP is never stored in clear.
- Backups: we make a daily backup of the database, kept for 30 days, so we can recover from a failure. Because of this, deleted data or data from a deleted account may still exist in those backups for up to 30 days, after which they are destroyed. Our other providers may keep technical copies for a limited period set by each of them, until they are overwritten.
- Legal obligations: we keep what the law requires us to keep, for as long as it requires.
6. Your rights
Under the GDPR (articles 15 to 22) you have the right to:
- access: know what data we hold about you and get a copy;
- rectification: correct wrong data (name, bio, e-mail and username, in Edit Profile);
- erasure: delete your account and data (Settings › Delete Account, or this page);
- restriction of processing and objection to processing based on our legitimate interest;
- portability: receive the data you gave us in a commonly used format;
- withdraw consent at any time (for example, by turning off location or notifications on your phone), without affecting what was done before;
- not be subject to solely automated decisions with significant effects. We use automatic filters to stop offensive photos and texts; if something is blocked by mistake, write to us and a person will review it.
To exercise any right, write to suporte@nexoriontech.pt. We may ask you to confirm your identity. We reply within one month at most, extendable by two more months for complex cases (GDPR art. 12). Exercising your rights is free.
Complaints: if you think we handled your data wrongly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal. We would appreciate it if you contacted us first so we can try to resolve it.
7. Children
Relicly is for people aged 13 or over, the minimum age for consenting to data processing in information-society services in Portugal (article 16 of Law no. 58/2019). We do not allow accounts for under-13s and, if we learn that one exists, we delete the account and data. We advise younger users to keep their profile private and to talk to an adult about chatting with other people.
8. How we protect your data
Communication with our servers uses encrypted connections (HTTPS). Only the server awards points, badges and quests; database access rules stop one person from reading another's private data; your e-mail and date of birth are kept separate from your public profile; we use limits on sign-in attempts and checks that the app is the official one. If a data breach puts your rights at risk, we notify the CNPD within 72 hours and, where necessary, the people affected (GDPR articles 33 and 34).
9. Storage on your phone and cookies
The app stores on your phone only what it needs to work: your session, the chosen language and a temporary copy of data and images for offline viewing. This does not require consent (Law no. 41/2004, art. 5). This website uses no cookies or tracking tools.
10. Changes to this policy
If we change this policy in a material way, we will tell you in the app and/or by e-mail with reasonable notice and state the new effective date. The current version is always on this page.
11. Contact
suporte@nexoriontech.pt · Sensatiligeiro, Rua da Quinta, N.º 3, Bloco 1, 5º Dto., 4490-053 Póvoa de Varzim