PigafettaGO Privacy Policy

Last updated: 15 November 2026

§1. What the app is and does

PigafettaGO is an app for recording walks, discovering new places, saving the routes travelled and following one's progress in getting to know cities and their surroundings.

Walk history is primarily stored locally, in the memory of the user's device.

The app also allows the user to create an account voluntarily and to send an encrypted copy of selected route data to the cloud.

Using the app's basic features does not require an account. Without an account, journeys are only on the phone and their number is limited; an account gives a higher limit and encrypted copies on the server. The limits are shown in the app.

§2. Data processed

Depending on the features used, the app may process the following data:

1. Location data

• the device's current location;
• GPS coordinates recorded during walks;
• the course, length and history of routes;
• information about areas visited;
• data used to calculate progress in discovering a city.

2. User account data

If the user decides to create an account, the data needed to create it, authenticate the user and run the account is processed.

This covers: the email address, the account identifier, information about the devices signed in to the account, and the type and period of the account's plan.

3. Data stored in the cloud

If the user decides to send a route to the cloud, the app processes an encrypted copy of the route data and the technical information needed to save it, identify it and, if needed, restore it.

4. Technical data

While the app is used, technical data needed for it to work and stay secure is processed: the IP address and information about connections to the server. The app's third-party libraries pass on the data described in §6. The app contains no advertising and no analytics tools.

§3. Location data and recording routes

PigafettaGO uses the device's location services to determine the user's position and to record their walking activity.

Recording a route requires granting the app the relevant Android permissions.

The user may refuse the location permission or withdraw it in the device settings. This may limit or prevent the use of features that need GPS.

While a route is being recorded, the app also uses location in the background, when the screen is off or another app is open. A persistent notification shows that recording is in progress. Outside recording, the app does not use location in the background.

§4. Route copies in the cloud

Sending a copy of a route to the cloud is optional and happens only when the user chooses it.

Route copies are encrypted on the user's device before they reach the server. The key to decrypt them is only on the user's devices, so neither the administrator nor the server provider can read the routes. Losing the key (e.g. losing the phone without keeping the recovery code) makes the copies impossible to read. Basic information about a route stays unencrypted: the date, distance and duration.

The encrypted copy is kept to back up the routes and to move them to another of the user's devices.

§5. Purposes and legal bases of processing

The administrator processes data for the following purposes:

Providing the app's services

Recording routes, saving progress, running user accounts and handling selected cloud features.

Legal basis: Article 6(1)(b) GDPR – performance of a contract.

Technical security

Detecting abuse and protecting the infrastructure, e.g. limiting the number of sign-in attempts.

Legal basis: Article 6(1)(f) GDPR – the administrator's legitimate interest.

Meeting legal obligations

Keeping data required by law, where such an obligation applies to the administrator.

Legal basis: Article 6(1)(c) GDPR.

Processing that requires separate consent

Where a particular processing operation requires consent, it is obtained before that operation begins.

Legal basis: Article 6(1)(a) GDPR.

§6. Data recipients and third-party services

The data recipients are:

• the server provider: storing account data, encrypted route copies and logs;
• Cloudflare (including outside the European Economic Area): serving the map files, running the domain and storing backups; it receives the device's IP address;
• Google: distributing the app through Google Play, and the QR code scanning library, which sends diagnostic data.

The map in the app is made from OpenStreetMap project data. The map files are downloaded from Cloudflare's servers.

Data is transferred to Cloudflare outside the European Economic Area on the basis of Cloudflare's participation in the EU–US Data Privacy Framework and, should it lapse, on the basis of standard contractual clauses approved by the European Commission.

§7. How long data is kept

Data saved locally stays on the device until it is deleted in the app or the app is uninstalled.

• account data and encrypted route copies: until the user deletes the account or the copies;
• logs and technical data: up to 30 days;
• backups: up to 7 days.

§8. Deleting data and the account

The user may request:

• deletion of selected route copies stored on the server, without deleting the account;
• deletion of the account together with all data stored on the server.

Requests can be sent to support@allblackcat.com.

Instructions for deleting the account are available:

• in the app: Settings → Delete account, confirmed with a code sent by email;
• on the website: pigafettago.allblackcat.com/en/delete-account.

The administrator deletes the data covered by a valid request, unless the law requires it to be kept longer.

Uninstalling the app from the device does not delete data stored in the cloud.

An account deleted in the app is gone immediately. A request sent by email is handled without undue delay, within one month at the latest. Deleted data disappears from backups after 7 days at the latest.

Data processed by Google (Google Play) is subject to Google's rules and is not covered by deleting the account in the app.

§9. Data security

The administrator applies technical and organisational measures appropriate to the risk of processing personal data.

Connections between the app and the server are encrypted. Signing in uses a one-time code sent by email. Only the administrator has access to the servers.

§10. User rights

Under the GDPR, the user has the right to:

• access their personal data;
• have it rectified;
• have it erased;
• restrict processing;
• data portability;
• object to certain kinds of processing;
• withdraw consent, where consent is the basis for processing.

The user also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Poland).

To exercise these rights, contact the administrator at the email address given.

§11. Children's data

PigafettaGO is an app for adults and is not directed at children.

If the administrator decides to extend the target audience to children, before making the change it will adapt its data processing rules, the app's features and the technologies used to the relevant laws and to the requirements of the Google Play Families Policy.

§12. Changes to this Privacy Policy

This Privacy Policy may be updated when the app's features, the ways data is processed or the applicable laws change.

The current version of the document will be available in the app and at a public web address.

§13. Contact

Data administrator: Szymon Dziędziel

Email: support@allblackcat.com

This Privacy Policy sets out the rules for processing data in the PigafettaGO app on Android devices, in line with Regulation (EU) 2016/679 (GDPR) and other applicable data protection laws.