Politika privatnosti

This privacy policy applies to the iOS app SmoGo, the website smogo.app and the related interface api.smogo.app (together “SmoGo”). It explains which personal data we process, for what purpose, on which legal basis, for how long, and what rights you have.

1. Controller

TANO TRADING LTD OOD
ul. “Hadhizi Dimitar” 3, 4701 Smolyan, Bulgaria
Commercial Register (EIK): 204784209
Represented by the managing director Veska Nikolova Boyadzhieva
Email: [email protected] · Phone: +359 88 9971608

For any privacy question and to exercise your rights, contact us at [email protected].

2. Principles

• You can use SmoGo without an account. You only need an account (SmoGo ID) to submit places, write reviews, send messages, use Premium or the business area.
• We do not sell personal data.
• Statistics and advertising only happen as you choose in the consent dialog. You can change your choice at any time: on the website via “Privacy settings” at the bottom of every page, in the app under Account → Settings.
• We run our servers ourselves in Smolyan (Bulgaria, EU). We do not use external hosting providers. For network protection and request checks we use Cloudflare (see 3 and 14).

3. Visiting the website and app (server logs)

With every request our servers process technically necessary data: IP address, date and time, requested address, amount of data transferred, browser or app version, operating system and device type. This is necessary to deliver SmoGo, to ensure security and to find errors (Art. 6(1)(f) GDPR). We delete server logs after 7 days at the latest.

Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) routes connections through its network. Cloudflare processes the connection data above on our behalf (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition.

Error reports and performance data: If the app crashes, freezes or a request to our interface fails, we send an error report to our own error service (GlitchTip on our servers in Smolyan). It contains the device model, operating system, app version, type of error, the technical error message and the place in the program (file, line, function). On the website, the address path without search parameters is added. No names, e-mail addresses, credentials, location data or your inputs. We remove e-mail addresses and long number sequences from reports; the error service does not store IP addresses. The legal basis is our legitimate interest in finding errors and keeping operations secure (Art. 6(1)(f) GDPR). We delete reports after 90 days.

We count response times of our interface per hour and route, without any link to users or devices. In addition, about every twentieth request is sent as a performance report to the error service, again without any link to users or devices.

4. Protection against abuse and debug requests

To ensure that only the genuine SmoGo app and the genuine website use our interface, we check requests (Art. 6(1)(f) GDPR):

• App: Apple App Attest confirms that the request comes from an unmodified SmoGo app on a real device. We only receive a device-related attestation key, no information about you.
• Website: Cloudflare Turnstile checks in the background whether a human is using the page. Connection and browser data are transferred to Cloudflare for this. Turnstile may set technically necessary storage on your device.
• Requests per minute: We briefly count requests per device or account and per IP address. The IP address is stored only as a non-reversible check value; the counters are deleted after a few minutes.
• Device identifier: With every request the app sends a device identifier (identifierForVendor, not an advertising ID). It is used to assign daily quotas and to find errors, and is not used for advertising.
• Debug requests: A debug request contains the device serial number and the current location, which the app sends for a support or development check. The app only retrieves the status of a request with a secret polling token. An administrator sees the request and decides in the web admin. We delete debug requests after 90 days (Art. 6(1)(f) GDPR).

5. SmoGo ID (account)

When you create an account we process the details you provide: email address, username, password (stored only as a secure hash), optional display name and phone number. For business accounts also company name, commercial register and VAT number, proof (confirmation code sent to the registered address, proof document) and, if you claim a place as owner, a verification video. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

Sign in with Apple or Google: If you use “Sign in with Apple” (Apple Distribution International Ltd., Ireland) or “Sign in with Google” (Google Ireland Limited, Ireland), we receive an identifier from them and, if you allow it, your email address and name. With Apple this can be a private relay address. We only load the sign-in scripts when you choose to sign in or link an account.

Sign-in and session: After signing in, the app or website stores a session token (details in section 13). Sessions expire after 30 days. Accounts of administrators receive a session of only 12 hours after signing in with the second factor (TOTP).

Emails (confirmation codes, password reset, account notices) are sent through our own mail server (mail.smogo.app).

Deletion: You can delete your account at any time in the app (Account) or by email to us. On deletion we remove sign-in data, email address, name, phone number, messages, reviews, visit list, push devices, credit balance, newsletter subscription, beta details, as well as verification videos and proof files from our server. Your contributions (places, photos, routes, reports) remain but are no longer linked to your account (see 18). We keep billing records for 10 years because the law requires it (Art. 6(1)(c) GDPR).

6. Places, photos, reviews, messages and reports

• Places and photos: What you submit (name, address, description, category, coordinates, up to five photos, contact name and phone) is stored with your account so that we can check and publish it (Art. 6(1)(b) GDPR). Published places and photos are visible to everyone. Contact name, phone and email address are not published.
• Reviews: Stars and text are public. The first word of your display name is shown. If no name is set, or it contains an email address, no name is shown.
• Visit list (“I was here”): Only you and we can see which places you have marked. The list serves your personal overview (Art. 6(1)(b) GDPR).
• Messages: Text, sender and recipient of messages between users or to businesses. Your counterpart sees your display name, never your email address. We use messages only to deliver them.
• Reports: If you report a place, a review or other content, we store the reason, your message and optionally your email address for follow-up questions (Art. 6(1)(f) GDPR, protection against abuse).

7. Search with Google (Google Places)

If SmoGo finds nothing suitable in its own data, we also show results from Google Maps. Our server sends these requests to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Your device has no direct contact with Google. We transmit neither your IP address nor your account, only the search term or the map section. Google may transfer data to the USA (EU-US Data Privacy Framework).

We count search terms per day and store them together with the number of results. This history is not linked to your account. It serves to manage the Google quota (Art. 6(1)(f) GDPR).

Daily quota: The number of Google requests per day is limited because every request costs us money. We therefore count per device or browser and additionally per network. The counting works without cookies.

With consent to “more precise Google search counting” (Art. 6(1)(a) GDPR): the website forms a check value (hash) from technical characteristics of your browser (e.g. screen size, graphics card, time zone). The app uses its device identifier. Only this check value with the day’s counter is stored; it is deleted after two days.

Without this consent we count by a hashed value from your IP address and the browser details your browser sends anyway (Art. 6(1)(f) GDPR). The limit is then stricter, because several people on one network share the quota.

8. Maps, routes, weather and location

• Location in the app: Only if you allow it and only while you use the app. The app uses the location on your device for distances, the nearest bus stop and routes.
• What is sent to our server: (a) For route planning the app sends start and destination as coordinates. We use them to calculate the timetable connection and do not store the coordinates. (b) To determine the country (Premium availability rules), Apple converts the location into a country once; we only receive the country code, never your coordinates. (c) Place suggestions and notices contain the coordinates you choose or that arise from your notice. (d) A ski run recording stores the track (coordinates and altitude) only if you explicitly start and save the recording. This feature is currently not public.
• Apple Maps: Maps and route calculation in the app run through Apple Maps (MapKit). Apple processes start and destination under its own privacy terms. Apple is an independent controller for this processing.
• Map on the website: Map tiles from OpenStreetMap are only loaded by your browser after you consent to “Map” (Art. 6(1)(a) GDPR). Your browser then transmits your IP address to the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). Without consent you see a placeholder and the website does not connect to OpenStreetMap.
• Weather: Our server fetches weather data from the Norwegian Meteorological Institute (MET Norway) for fixed coordinates in Smolyan. No data about you is transmitted.
• Images from third parties: Some images come from Wikimedia Commons (Wikimedia Foundation, USA). The payment brand logos on the pricing page are loaded directly by your browser from there; your IP address is transmitted in the process (Art. 6(1)(f) GDPR).

9. Statistics (self-hosted, only with consent)

With your consent (Art. 6(1)(a) GDPR) we count on our own server which pages or sections are accessed, without Google Analytics and without other providers. We transmit: the page or section accessed, language, device type and, on the website, the domain of the referring page (e.g. google.com). We derive the country from the connection.

No cookies are set and no IP addresses are stored. To count visitors per day, we form a check value from the IP address and browser identifier (or the app’s device identifier) with a secret daily key. The daily key is discarded at midnight (UTC); afterwards no entry can be linked to a person or device.

If your browser sends “Do Not Track” or “Global Privacy Control”, we do not count – even with consent. Entries are deleted after 13 months. You can withdraw your consent at any time with effect for the future.

Website statistics with Matomo: In addition to our own count, the website uses Matomo on our own server (analytics.tanotrading.com). Matomo only loads if you have consented to „Statistik“ (Art. 6(1)(a) GDPR). Matomo sets no cookies, does not store full IP addresses and provides only aggregated counts (visits, page views, country, browser). The data stays on our servers. We delete entries after 13 months.

App: The app measures performance data (start and loading times, hangs) only with your „Statistik“ consent. Transmitted are device, operating system, app version and timing values, but no account or user data.

App statistics with Matomo: With your „Statistik“ consent the app sends to the same Matomo server which section of the app was opened, the language, the app version and a daily identifier that changes every day. No advertising ID, no cookies, no account. The IP address is only needed for the connection and is not stored in full. We delete entries after 13 months.

10. Advertising

Premium users see no advertising; then no advertising services are loaded either.

Website – Google AdSense: On the website we show ads from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The AdSense script is only loaded after you have made a choice in the consent dialog, and never on the legal pages. With consent to “personalised advertising” (Art. 6(1)(a) GDPR) Google may use cookies and similar technologies to tailor ads to your interests and measure their performance. Without consent Google only shows non-personalised ads based on the page content and approximate location (derived from the IP address). Even then Google may use cookies or similar technologies to limit ad frequency, for billing and to prevent fraud. More: policies.google.com/technologies/ads.

App – Google AdMob: In the app we show ads from Google AdMob (Google Ireland Limited). With your consent given via Google’s form (in the EU and the United Kingdom), Google and its partners may use device and advertising identifiers, approximate location (derived from the IP address) and usage data to personalise and measure ads. Only then does iOS additionally ask whether SmoGo may track you across apps of other companies (App Tracking Transparency). Without consent Google only shows non-personalised ads. Google may transfer data to the USA (EU-US Data Privacy Framework). More: policies.google.com/technologies/partner-sites.

11. Purchases and payments

• In the app Premium, passes and credits are bought through Apple’s App Store. Apple processes the payment. We only receive the signed purchase confirmation (product, term, transaction identifier) to assign Premium or credits to your account. If a verified email address is stored on your account, App Store Premium also applies on the website.
• On the website the Payment Center of TANO TRADING LTD OOD processes the payment. The Payment Center passes the payment on to payment service providers (e.g. Stripe). We receive email address, purchase status and term to unlock Premium. Card data is processed only by the payment service provider.
• The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We keep invoices and payment records for 10 years (Art. 6(1)(c) GDPR).

12. Notifications and newsletter

The app only sends push notifications if you allow them. For this we store the device token of the Apple Push Notification service together with the device language. You can withdraw the permission in the iOS settings.

We only send the newsletter with your consent (double opt-in, Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email. When you delete your account, your address is removed from the newsletter.

Waiting list and beta requests: While access to the website is locked, you can add your email address to a waiting list (double opt-in). Beta requests contain name, email address and a note. We use these details only to notify you or to select test users (Art. 6(1)(b) or (a) GDPR).

13. Storage in the browser and on the device

Website: The website stores your sign-in in the cookie “smogo_token” (one year, only for smogo.app, transmitted only encrypted) and in the browser’s local storage. The local storage also holds your profile (display name, role) and your privacy choice (key “smogo.consent”, with timestamp). For the duration of the session the browser also stores a short-lived access token for our interface. We do not set tracking cookies.

App: The sign-in is kept in the device’s Keychain. Settings, your privacy choice with timestamp, language, push token and the advertising configuration are kept in the app’s settings. Content such as timetables and images is stored by the app in the cache directory so that it works offline. The system may remove part of it when storage is low.

These storages are necessary for the function you request and therefore need no consent (Section 25(2) No. 2 TDDDG).

If error reports cannot be sent at the time (for example without a network connection), the app keeps them temporarily in the device cache and sends them later. These reports contain no information that identifies you personally.

14. Recipients and transfers to third countries

We operate our servers ourselves (TANO TRADING LTD OOD, Smolyan). We use no hosting providers. These services receive data as far as necessary for the respective purpose:

• Cloudflare, Inc. (USA): network, protection and Turnstile (see 3 and 4).
• Google Ireland Limited (Ireland, group with US parent): sign in with Google, AdSense, AdMob, Google Places (see 5, 7, 10).
• Apple Distribution International Ltd. (Ireland, group with US parent): sign in with Apple, App Store and purchases, push notifications, App Attest, Apple Maps and country detection (see 4, 5, 8, 11, 12).
• OpenStreetMap Foundation (United Kingdom): map images, only with consent (see 8).
• Wikimedia Foundation (USA): images and logos (see 8).
• Payment service providers (e.g. Stripe, USA): card payments via the Payment Center (see 11).
• MET Norway (Norway): weather data, without information about you.

Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on EU standard contractual clauses (Art. 46 GDPR). Authorities receive data only where we are legally obliged to provide it.

We process error reports and the website statistics on our own servers in Smolyan. They are not passed on to third parties.

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Simply write to [email protected].

You can also lodge a complaint with a data protection supervisory authority, in particular in the country where you live. The authority responsible for us is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), bul. „Prof. Tsvetan Lazarov“ 2, 1592 Sofia, www.cpdp.bg.

16. Children

SmoGo is not directed at children under 14. Children under 14 may only create an account with the consent of their parents.

17. Obligation to provide data and automated decisions

You are not obliged to provide us with data. However, without the technically necessary connection data SmoGo cannot be used, and without account data account functions are not available. We do not carry out automated decision-making, including profiling within the meaning of Art. 22 GDPR.

18. Storage periods

• Account (sign-in data, email address, name, phone): until the account is deleted.
• Sessions: 30 days, for administrators 12 hours. We remove expired sessions.
• Messages, reviews, visit list, push devices, newsletter: until you delete them or until the account is deleted.
• Verification video and proof (business): until the account is deleted. We then remove the files from the server.
• Contributions without account link (places, photos, routes, reports): indefinitely as part of SmoGo, without a link to you.
• Purchases without account link (transaction identifier, amount): indefinitely as proof; invoices and payment records 10 years.
• Request counters (IP as check value): a few minutes.
• Server logs: 7 days.
• Statistics: 13 months, without IP address.
• Debug requests (serial number, location): 90 days.
• Google search terms (without account link): indefinitely as daily counts.
• Waiting list, beta requests: until the end of the waiting list or beta phase.
• Reports: until the report has been processed.
• Error reports (device and error details): 90 days.
• Performance data and response times (no personal reference): 90 days.
• Matomo statistics (website and app): 13 months.

19. Changes

We adapt this privacy policy when SmoGo or the legal situation changes. The version published here applies.

Status: 15 October 2026