Privacy Policy
Effective date: June 22, 2026
Tirana Guide ("we", "us", "our") is a mobile travel guide for Tirana, Albania, operated through the Tirana Guide app and the website at https://devolist.com/apps/tirana-guide. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have.
By installing or using Tirana Guide, you agree to this Privacy Policy. If you do not agree, please do not use the app.
1. Who we are
Data controller: Tirana Guide
Contact: [email protected]
Website: https://devolist.com/apps/tirana-guide
For privacy-related requests (access, correction, deletion, or complaints), email [email protected] with the subject line "Privacy request".
2. What Tirana Guide does
Tirana Guide helps visitors discover places, events, travel tips, and practical information about Tirana. Some features work without an account. If you create an account, you can sync profile details, receive notifications, and use booking or reservation features where available.
3. Data we collect
3.1 Information you provide
- Account details: name, email address, phone number (optional), and password (stored only as a secure hash on our servers).
- Sign-in providers: if you use Google or Apple sign-in, we receive your Firebase user identifier and the profile fields those providers share (typically name and email).
- Bookings and reservations: when you request a table or service through the app, we process the details you submit (name, email, phone, party size, date/time, notes) to pass the request to the venue or our booking workflow.
- Support messages: if you contact us, we keep your message and contact details to respond.
3.2 Information collected automatically
- Device identifier: a random app-generated device ID sent with API requests (header `X-Device-Id`) to measure anonymous app opens, notification delivery, and sponsor-ad impressions/clicks. This ID is not your phone's hardware ID.
- Usage analytics: aggregated app activity via Google Firebase Analytics (e.g. screens viewed, session length, crash data).
- Push notification token: if you allow notifications, your Firebase Cloud Messaging (FCM) token, device platform (iOS/Android), and notification preferences are stored so we can send alerts you opted into.
- Approximate location: only when you use map or "near me" features — your device may share GPS coordinates locally; we do not continuously track your location in the background unless you grant that permission and a feature requires it.
- Technical logs: IP address, app version, and timestamps in server logs for security and abuse prevention.
3.3 Advertising data
- Google AdMob: the app may show Google ads. AdMob may collect advertising identifiers and usage data under Google's policies. You can limit ad personalisation in your device settings.
- Sponsor ads: when you view or tap a sponsored listing in the app, we record the ad ID, event type (impression/click), and your device ID to provide campaign statistics to advertisers. We do not sell your personal profile to advertisers.
3.4 Third-party services in the app
Depending on features enabled in your version of the app, these providers may process data under their own privacy policies:
| Service | Purpose |
| --- | --- |
| Google Firebase Authentication | Sign-in with email, Google, or Apple |
| Google Firebase Analytics | App usage and stability |
| Google Firebase Cloud Messaging | Push notifications |
| Google AdMob | In-app advertising |
| Yesim (optional) | eSIM / mobile data partner links from the home screen |
We do not control third-party sites you open from the app (venue websites, maps, partner offers). Review their policies before sharing personal data.
4. How we use your data
We use personal data to:
- Provide and improve the Tirana Guide service and content
- Authenticate you and keep your account secure
- Process bookings, reservations, and support requests
- Send push notifications you have enabled (travel tips, promos where opted in)
- Measure anonymous usage and fix bugs
- Report aggregated sponsor-ad performance
- Comply with law and protect against fraud or abuse
We do not use your data for automated decisions that produce legal or similarly significant effects.
5. Legal bases (EEA / UK users)
Where GDPR applies, we rely on:
- Contract — to provide the app and account features you request
- Legitimate interests — security, analytics, and service improvement (balanced against your rights)
- Consent — push notifications and optional marketing where required
- Legal obligation — retaining minimal deletion records where required
6. How long we keep data
- Account data: until you delete your account, then erased from active systems without undue delay.
- Session tokens: until expiry or logout, whichever comes first.
- Push device records: until you uninstall, disable notifications, or we retire stale tokens.
- Anonymous device analytics: retained in aggregate form; raw device IDs may be rotated or deleted periodically.
- Booking records: may be kept longer where needed for accounting, dispute resolution, or legal obligations; personal fields are disassociated when the account is deleted where possible.
- Deletion audit log: after account deletion we may keep only a one-way hash of your email, deletion timestamp, and request source — not your readable name or email — for compliance and abuse prevention.
7. Who we share data with
We share data only with:
- Service providers that host our API, database, email, and Firebase/Google cloud infrastructure under data-processing terms
- Venues and partners when you submit a booking or "list your business" enquiry
- Law enforcement or regulators when required by applicable law
We do not sell your personal information.
8. International transfers
Our servers and providers may process data outside Albania or your home country (including the EU and United States). Where required, we use appropriate safeguards such as standard contractual clauses or provider certifications.
9. Your rights
Depending on your location, you may have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Delete your account and personal data (see [Account Deletion](/apps/tirana-guide/account-deletion))
- Object to or restrict certain processing
- Withdraw consent where processing is consent-based
- Lodge a complaint with your local data protection authority
To exercise these rights, email [email protected]. We may need to verify your identity.
10. Account deletion
You can permanently delete your account at any time:
- In the app: Profile → Delete account (password confirmation required for email accounts)
- On the web: [Account Deletion page](/apps/tirana-guide/account-deletion)
- By API: authenticated `DELETE` or `POST` to the endpoints listed on the Account Deletion page
Deletion removes your name, email, phone, password hash, Firebase link, and active login sessions from our database.
11. Children's privacy
Tirana Guide is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.
12. Security
We use HTTPS, hashed passwords, access controls, and industry-standard hosting practices. No method of transmission over the internet is 100% secure; use a strong, unique password and keep your device updated.
13. Changes to this policy
We may update this Privacy Policy from time to time. We will post the new version at `/apps/tirana-guide/privacy` and update the effective date above. Continued use after changes means you accept the updated policy.
14. Contact
Tirana Guide — Privacy
Email: [email protected]