Privacy Policy

1. Introduction

Choose.place ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services.

2. Data Controller

Choose.place is operated by Union LTD d.o.o., Kosančićeva 77, 12000 Požarevac, Serbia (registration number 07962223, tax ID 100441058). For the purposes of data protection laws, we are the data controller responsible for your personal information. You can reach us at [email protected] or through the contact page. Our servers are located in the European Union (Germany) via Hetzner.

3. Information We Collect

Account Information

When you create an account, we collect your email address, username, and password (stored securely using bcrypt encryption).

If you sign up for the newsletter without an account, we keep your email address, where you signed up, and when you confirmed. Nothing is sent before you confirm with the link in our email. If you unsubscribe, we keep the address marked as unsubscribed so it isn't emailed again; contact us to have it deleted completely.

Game Data

We collect information about your gameplay, including:

Game scores, completion times, and accuracy
Stamp transactions and balance history
Achievement progress and unlocked countries
Leaderboard rankings and challenge participation
Campaign and belt progression

Subscription Data

If you purchase a premium subscription, Polar (our payment provider) collects payment information. We only store your subscription status and Polar customer ID - we never see or store your payment card details.

Technical Information

We automatically collect certain information when you visit our website, including your IP address (for security purposes), browser type, and device information. With every game, including games played without an account, we store the type of device (phone, tablet or computer), the website that sent you to us - only its domain, such as google.com - and the first page you opened on our site, without anything after its address (such as /travel/5-days-in-hanoi). If you came to the game through a game link in one of our travel guides, articles or comparisons, we also note which kind it was. We use this to understand how people find and play our games. On our travel guides, articles and comparisons we count, for each page and day, how many visits there were, how far they read and for how long the page was being read. These are only totals per page: nothing about you or your visit is kept, and no cookie is used for it.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

Contract: Processing necessary to provide our services (account, gameplay, subscriptions)
Legitimate Interest: Security measures, fraud prevention, and service improvement
Consent: A weekly newsletter with new guides and stories, and now and then a reminder about the games (such as a new Daily), only if you say yes: the box when you sign up, a newsletter form or button on the site (also at the end of a game), or the switch in your profile, and only after you confirm your address with the link we send. Every such email has a one-click unsubscribe link, and you can switch them off in your profile at any time. Account emails (welcome, password reset, password changed) are sent to every account.

5. How We Use Your Information

Provide and maintain our gaming services
Process your account registration and manage your profile
Display leaderboards and enable competitive features
Track your progress, stamps, and achievements
Process subscription payments (via Polar)
Send important service updates (account, subscription status)
Send the weekly newsletter and the odd reminder about the games, only if you opted in
Improve our games and user experience
Detect and prevent cheating and abuse

6. Data Retention

We retain your data for as long as your account is active. Specifically:

Account data: Until you delete your account
Game scores and progress: Until you delete your account
Stamp transaction history: Until you delete your account
Server logs (IP addresses): 30 days for security purposes

When you delete your account, we permanently delete your personal data within 30 days. Some anonymized, aggregated data may be retained for analytics.

7. Data Security

We implement appropriate security measures including:

HTTPS encryption for all connections
Secure password hashing (bcrypt)
EU-based servers (Hetzner, Germany)
Regular security updates

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to protect your data.

8. Cookies

We use only essential cookies required for the service to function:

Session cookie: Keeps you logged in
CSRF token: Security protection

We do not use tracking cookies or advertising cookies. We count visits with Cloudflare Web Analytics, which sets no cookies and does not follow you across sites. Since we only use essential cookies, no cookie consent banner is required.

9. Third-Party Services

We use the following third-party services:

Polar (Payment Processing)

Polar processes all payments and subscriptions. They collect payment information directly via Stripe. See: Polar Privacy Policy

Hetzner (Hosting)

Our servers are hosted in Germany by Hetzner. See: Hetzner Privacy Policy

Cloudflare (Network, Security, Analytics)

All traffic to Choose.place passes through Cloudflare, which protects the site from attacks, runs the Turnstile check on our contact form, and counts page views without cookies (Cloudflare Web Analytics). Cloudflare processes your IP address and browser details for this. See: Cloudflare Privacy Policy

Sentry (Error Monitoring)

When something breaks, the error report goes to Sentry (EU region, Germany). It can include your IP address, browser details and, if you are signed in, your username and email, so we can find and fix the problem. See: Sentry Privacy Policy

Resend (Email)

Account emails (welcome, password reset, password changed), the newsletter and reminders you opted in to, and contact form messages are sent through Resend, which receives your email address and the message. See: Resend Privacy Policy

10. International Data Transfers

Your data is stored on servers in the European Union (Germany), and error reports go to Sentry's EU region. Cloudflare and Resend are US companies: Cloudflare handles traffic on its global network and Resend delivers our emails. Where they process personal data outside the EU/EEA, they rely on the safeguards the GDPR requires (the EU-U.S. Data Privacy Framework or Standard Contractual Clauses).

11. Your Rights (GDPR)

If you are in the European Economic Area, you have the following rights:

Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Delete your account and all associated data
Portability: Export your data in a machine-readable format
Objection: Object to processing based on legitimate interest
Withdraw consent: Where processing is based on consent

To exercise these rights, please contact us or use the account settings in your profile.

You also have the right to lodge a complaint with your local data protection authority if you believe we have violated your rights.

12. Children's Privacy

Our service is not intended for children under 13 (or 16 in some EU countries). We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top indicates when the policy was last revised.

14. Contact Us

If you have any questions about this Privacy Policy or want to exercise your data protection rights, please contact us.