Updated 6 November 2026 · Versione italiana
Privacy Notice
Information under Articles 12 and 13 GDPR.
1. Joint controllers
Lorenzo Ostolani and Luca Bazzocchi are the joint controllers. They operate the project and jointly determine the purposes and essential means of processing through Cesena Remembers. They jointly decide service purposes, features, data categories, providers and security measures, and coordinate requests, incidents and deletion. Contact: [email protected].
The public Google Play developer name is OstoDev. Google separately processes data required for Google Play and Play Console.
2. Data processed
The app and website process account and authentication data (Firebase UID, email, Google/Firebase authentication attributes), display name, username and avatar; game data (XP, tours, visited points of interest, quiz results, achievements and statistics); social data (friend requests and relations); GPS coordinates when location permission and the in-app preference are enabled; device, app version, IP and technical logs; FCM tokens and notification preferences; Crashlytics diagnostic data; and, for banned accounts, UID, reason and date in Firestore banned_users. The app is not designed to collect special-category data, contacts, photos or chat content.
3. Purposes and legal bases
- Account and requested functions: Article 6(1)(b) GDPR.
- Profiles, game progress, leaderboard and social features: Article 6(1)(b) for requested game functions and Article 6(1)(f) for profile display and service operation.
- Optional location and push notifications: Article 6(1)(a), where consent is the applicable basis. OS permission is a technical control and is not, by itself, GDPR consent.
- Security, abuse prevention, moderation and diagnostics: Article 6(1)(f), legitimate interests in protecting users, accounts, infrastructure and service reliability.
- Legal obligations: Article 6(1)(c); legal claims: Article 6(1)(f), where applicable.
4. GPS and maps
When permission is granted and the in-app GPS preference is enabled, the app reads location to show the user's position, calculate distance to a stop and detect arrival. During an active tour, the app automatically refreshes the route to the current stop. The device's current coordinates and destination coordinates are sent to Mapbox Directions whenever location changes by approximately 40–45 metres or the destination changes. This happens automatically; the user does not need to request each update. Map tile requests also disclose IP address, requested tile URL/coordinates and technical data to the relevant provider. The app uses CARTO, Stadia Maps and Esri/ArcGIS for map tiles. A continuous GPS history is not stored in the Firestore profile, although game progress may record visited places and completed stops.
5. Public profiles
Public profiles and basic leaderboard data can be queried by any authenticated account, not only friends and not only adults. They may show display name, username, avatar, XP, friend count and completed-tour count. Detailed statistics are restricted to the account owner and reciprocal friends. Use a nickname: do not use your full name, date of birth, school, address, phone, email or other identifying details. Other authenticated users, including minors, may view public profiles.
6. Quizzes and providers
The quiz request contains the point-of-interest identifier, place name and description, current XP and language. The client does not send Firebase UID, email or password to the quiz API. The backend receives the source IP and technical request data. Requests to https://pascal.ispascalcomandini.it:8000 use HTTPS/TLS and the app trusts the server certificate bundled with the app. GroqCloud receives prompt content and server connection metadata. The project does not declare a dedicated Zero Data Retention configuration; standard GroqCloud terms apply. Groq states that inference inputs and outputs are not retained by default but may be temporarily retained for reliability or abuse investigations for up to 30 days; usage metadata is collected. Generated quizzes may contain errors.
Providers include Google/Firebase (Authentication, Firestore, FCM, Crashlytics and App Check), GroqCloud, Mapbox, CARTO, Stadia Maps, Esri/ArcGIS, Cloudflare Pages/CDN, Google Fonts, GitHub and Google Play. The Istituto Superiore Pascal - Comandini provides a dedicated Raspberry Pi and network connectivity. Under the described operating arrangement, only the joint controllers administer the server, containers, application databases and application logs; school staff have no credentials or ordinary access to application data. The school provides physical infrastructure and connectivity and is not appointed as an Article 28 processor for application data in this arrangement. Any network-security logs independently collected by the school are governed by its own purposes and privacy information. Providers may act as processors or independent controllers depending on the service. Some providers may process data outside the EEA under applicable transfer safeguards.
7. Firebase and diagnostics
The notification microservice reads only fields needed for friend requests, FCM tokens and notification preferences, not email addresses. Crashlytics may receive stack traces, exception type, installation identifiers and device information; collection is disabled in Debug builds and enabled in non-Debug builds. Google's stated Crashlytics retention period is 90 days. App Check is configured for selected Firebase services and uses Play Integrity in Android Release builds. It is not user authentication and is not used as access control for the custom quiz backend.
8. Retention and deletion
- Account, profile, progress, leaderboard and social data: for the life of the account; successful in-app deletion removes operational Firestore records. Provider backup copies follow their applicable deletion cycles.
- Firebase Authentication: deletion is requested when the account deletion flow completes; subsequent removal follows Google's service terms.
- FCM tokens: until opt-out, replacement or account deletion.
- Crashlytics: 90 days for stack traces and associated diagnostic identifiers.
- Docker logs: up to three files of 10 MB per container; rotation is size-based, not a fixed number of days.
- Support emails: 12 months after closure unless a dispute or legal obligation requires longer.
banned_users: the separate UID, reason and ban-date record is not removed by ordinary account deletion. It is retained for up to 24 months from the ban date to prevent repeated abuse, then deleted by the controllers unless a legal obligation or documented need to protect legal claims requires longer retention.
In-app deletion requires re-authentication and removes the operational profile, public profile, friend statistics, leaderboard entry, username reservation, related friendships/requests, FCM token and Firebase Authentication account. A separate moderation record, if present, remains for the period above. See account deletion instructions.
9. Your rights
Subject to GDPR, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests. You may withdraw consent at any time where consent is the legal basis. Contact [email protected]. You may also complain to the Italian Data Protection Authority.
10. Minors
The service is limited to people aged 14 or over. Before Google Sign-In, users declare that they are at least 14. Under-14s may not register or use the service. This is self-declaration: the app does not request or collect date of birth and does not verify age with identity documents. The checkbox is an interface gate and is not stored as a separate timestamped record. In Italy, Article 2-quinquies of Legislative Decree 196/2003 sets 14 as the age for a child's consent to processing for directly offered information-society services where consent is the legal basis; it does not automatically grant full contractual capacity.
11. Security, website and automated processing
The project uses Firebase Authentication, Firestore security rules, App Check for configured Firebase services, Play Integrity in Android Release builds and HTTPS. The quiz backend uses HTTPS/TLS on port 8000; containers communicate over a private Docker network. The website is hosted through Cloudflare Pages and does not use traffic analytics or behavioural advertising tools. Google Fonts receives ordinary connection data such as IP and user agent. XP, progress and quiz generation do not make decisions with legal or similarly significant effects under Article 22 GDPR. This notice may be updated when the app, providers, purposes or law change.