Skip to main content

Privacy

Signing in, your language and light or dark mode work without asking. With your permission we also count which pages are viewed, so we know which cities to improve next. No ads, no profiles, nothing passed on. You can change this at the bottom of every page.

Privacy policy
MEVAYAMEVAYA
Plan

Privacy Policy

What we collect, why we collect it, and what you can ask us to do about it.

Last updated: October 2026

1. Controller

Semih SesKirchenrain 5ÖhringenGermany

Email: hello@mevaya.eu

2. What we process, and why

Account data

When you create an account we store your email address, a hashed password and the display name you choose. This is necessary to give you a login and to associate your saved plans and passes with you. Legal basis: Art. 6 (1) (b) GDPR — performance of a contract.

Plans and trips

City, date and the stops in the day plans you save are stored so you can return to them. Building a plan without an account does not create a stored record tied to you. Legal basis: Art. 6 (1) (b) GDPR.

Purchases

We store the order (product, amount, date, the cities it unlocks) and the identifier of the corresponding payment at our payment provider. We never receive or store your card number. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for the retention periods German tax law imposes on invoice-relevant records.

Support reports

If you send a report through the help page, we store the topic and message text so we can investigate. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in correcting errors in our data.

Server logs and abuse prevention

Our hosting provider processes technical request data (including IP address) to deliver the site and to rate-limit abusive traffic. Legal basis: Art. 6 (1) (f) GDPR.

Embedded YouTube videos

Some Journal articles contain a MEVAYA video hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video is not loaded when the page opens: until you click play, no connection to YouTube is made and no data is transferred. Only when you click play is the player loaded from youtube-nocookie.com, YouTube’s privacy-enhanced mode. YouTube then receives technical data such as your IP address and the page you are on, may store information on your device, and may transfer data to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework. YouTube acts as an independent controller. Legal basis: Art. 6 (1) (a) GDPR — your consent, given by clicking play. See policies.google.com/privacy.

Page statistics (only with your consent)

If you choose “Allow statistics” in the privacy notice, your browser sends us the following on each page view: the page you opened, the page you came from, your browser type (user agent) and a random tab ID. The ID sits in your browser's session storage and disappears when you close the tab; it only stops several views in the same tab from counting as several visitors. We store no IP address with these entries, build no profiles and link nothing to other websites. Purpose: seeing which cities and pages are used, so we improve the right ones first. Legal basis: your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Without consent, none of this is sent or stored. You can withdraw at any time via “Privacy settings” at the bottom of every page; nothing is sent from then on.

Maps (OpenStreetMap)

City pages and day plans show a map. Your browser loads the map images directly from the tile servers of the OpenStreetMap Foundation (OSMF, United Kingdom), which receive your IP address in the process. Nothing is stored in your browser for this, and we serve the map software (Leaflet) ourselves. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in showing the planned route on a map. OSMF privacy policy: osmfoundation.org/wiki/Privacy_Policy.

Visitor count (Vercel Web Analytics)

To count how many people actually visit MEVAYA, we use Vercel Web Analytics. It sets no cookies and stores nothing in your browser. For each page view it records the page, the page you came from, your browser, operating system, device type and the country, derived from your IP address. The IP address itself is not stored; visits are told apart by a hash that is renewed every day, so no one can be recognised across days or on other websites. We only see totals. Vercel processes this data as our hosting provider. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in knowing how many people use the site.

3. Processors

We use the following providers, each under a data processing agreement:

  • Supabase — database, authentication and storage of account, plan and order records.
  • Vercel — hosting and delivery of the website.
  • Stripe — payment processing. Stripe acts as an independent controller for the payment data it collects; see stripe.com/privacy.
  • Resend — delivery of transactional email (account and purchase confirmations).

Where a provider offers EU-region hosting we select it. Where data is transferred outside the EU/EEA, the transfer is covered by the European Commission’s standard contractual clauses.

4. How long we keep things

Account, plan and trip data are kept for as long as your account exists and are deleted when you delete it. Order and invoice records are kept for the statutory retention periods under German commercial and tax law, currently up to ten years, even after account deletion — we are required to keep them and cannot delete them earlier.

5. Your rights

Under Art. 15 to 21 GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted, subject to the retention periods above;
  • restrict processing;
  • receive your data in a portable format;
  • object to processing based on legitimate interest.

You can export your data and delete your account from your account page, or write to hello@mevaya.eu.

6. Complaints

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

7. Cookies and browser storage

We only store in your browser what a feature you use needs. The one exception is page statistics, and only with your consent:

  • Sign-in cookies (sb-…-auth-token): only when you sign in; they keep you signed in until you sign out. Necessary.
  • Language cookie (MEVAYA_LOCALE, 12 months): holds only the language, such as “de”, so mevaya.eu opens in your language. Necessary.
  • Display (mevaya-theme, local storage): only if you pick Evening or Sunrise at the bottom of the page; holds only that choice. Necessary.
  • Your privacy choice (mevaya-consent, local storage): “statistics allowed” or “only necessary” and the date, so we don't ask on every visit; we ask again after 12 months. Necessary.
  • Review prompt note (mevaya:reviewAsked:…, local storage): only for signed-in users after a PDF export; stops us asking for a review twice in the same sign-in. Necessary.
  • Tab ID for page statistics (mevaya_sid, session storage): only with your consent; disappears when you close the tab and is deleted immediately if you withdraw.

We use no advertising or cross-site tracking cookies. You can change your statistics choice at any time via “Privacy settings” at the bottom of every page.