Privacy Policy

Last Updated: 4 August 2026

Marco is a self-guided audio walking tour app for iOS. We provide downloadable audio tours of major cities that use GPS geo-fencing to automatically play narration as you walk.

Contact: support@walkmarco.com Website: walkmarco.com

1. Who We Are

Marco Walking Tours is operated by Marco, registered with IFZA, Fujairah, UAE.

2. Data We Collect

2.1 Account Data

Data	When Collected	Storage Location	Retention
Email address	Sign-up (email or social)	Supabase (EU)	Until account deletion
Display name	Sign-up or profile edit	Supabase (EU)	Until account deletion
Password	Email sign-up only	Supabase Auth (hashed, never plaintext)	Until account deletion
Auth provider ID	Social sign-in (Apple/Google/Facebook)	Supabase Auth (EU)	Until account deletion
Terms acceptance timestamp	Sign-up	Supabase user_metadata	Until account deletion
Safety acknowledgement timestamp	First tour start	On-device storage	Until app uninstall

Legal basis: Contract performance (account creation and service delivery)

2.2 Location Data

Data	When Collected	Storage Location	Retention
GPS location (real-time)	During active tour playback	Device memory only (NOT sent to server)	Not persisted
Background location	During active tour only	Device memory only	Not persisted

Important: GPS location is processed entirely on-device for geo-fence trigger detection. We do NOT transmit your real-time location to our servers during tour playback. Background location access is used only when a tour is actively in progress and stops when the tour ends. Legal basis: Consent (iOS location permission prompt with explanation)

2.3 Tour & Usage Data

Data	When Collected	Storage Location	Retention
Tour history (stops visited, progress)	During tour playback	Supabase (EU)	Until account deletion
Purchase history	On purchase	Supabase (EU) + RevenueCat (US)	Until account deletion (Supabase); per RevenueCat retention policy
Saved tours	User action	Supabase (EU) for signed-in users; on-device for guests	Until removed by user or account deletion
Recent searches	User action	On-device only	Until cleared or app uninstall
Review text and rating	User submission	Supabase (EU)	Until deleted by user or account deletion

Note on tour history: We store which stop number you reached and timestamps (started, completed). We do NOT store your GPS coordinates or walking route in tour history. Legal basis: Contract performance (tour delivery, purchase entitlements, resume functionality)

2.4 Downloaded Tour Content

Data	When Collected	Storage Location	Retention
Audio files (MP3)	User downloads tour	Device filesystem	Until user deletes download
Tour metadata (stop info, route data)	User downloads tour	On-device storage	Until user deletes download
Tour waypoint coordinates	User downloads tour	On-device storage	Until user deletes download

Note on waypoint coordinates: Downloaded tours include the GPS coordinates of tour stops and walking route waypoints. These are publicly available tour route coordinates (not your personal location data). They are stored on your device only and are removed when you delete a downloaded tour. Legal basis: Contract performance (offline tour delivery)

2.5 Device & Technical Data

Data	When Collected	Storage Location	Retention
Device model, OS version, app version	On crash/error	Sentry (EU)	Per Sentry retention (90 days default)
Crash reports and stack traces	On error	Sentry (EU)	Per Sentry retention
Anonymised usage events	During app use (if opted in)	PostHog (EU)	Per PostHog retention

PII stripping: Before any error report is sent to Sentry, we automatically remove your email address, username, and IP address. Legal basis: Legitimate interest (app stability and improvement)

2.6 Marketing & Attribution Data

Data	When Collected	Storage Location	Retention
IDFA / advertising identifier	Only with ATT consent	AppsFlyer (EU)	Per AppsFlyer retention
Install attribution	App install	AppsFlyer (EU)	Per AppsFlyer retention
Conversion events	On purchase (with ATT consent)	Meta (US) via AppsFlyer	Per Meta retention

Legal basis: Consent (App Tracking Transparency prompt required before any tracking)

2.7 User Preferences (Non-Personal)

Data	Storage	Notes
Playback speed, auto-play setting	On-device only	Not sent to server
Download-on-cellular preference	On-device only	Not sent to server
Geofence radius preference	On-device only	Not sent to server
App/tour language selection	On-device only	Not sent to server
Analytics opt-out preference	On-device only	Not sent to server
Currency selection	On-device only	Not sent to server

These preferences are stored locally on your device and are not transmitted to our servers.

3. How We Use Your Data

Purpose	Data Used	Legal Basis
Create and manage your account	Email, name, password	Contract
Deliver tour content and audio playback	Tour data, GPS (on-device)	Contract
Process purchases and verify entitlements	Purchase history, user ID	Contract
Enable tour progress and resume	Tour history (stop progress)	Contract
Save and sync your saved tours	Saved tour IDs	Contract
Send verification and password reset emails	Email address	Contract
Detect and fix crashes	Device info, crash data (PII stripped)	Legitimate interest
Improve the app based on usage patterns	Anonymised analytics events	Legitimate interest
Measure advertising effectiveness	IDFA, conversion events	Consent (ATT)

4. Third-Party Data Processors

All processors with access to personal data are listed below.

Processor	Data Received	Purpose	Server Location
Supabase	Account data, tour history, reviews, purchases, saved tours	Database, authentication, file storage	EU
RevenueCat	User ID, purchase receipts	Payment processing via Apple IAP, entitlement management	US
PostHog	Anonymised usage events, device info	Product analytics	EU
Sentry	Crash/error data (PII stripped), device info	Error tracking, performance monitoring	EU
Resend	Email address	Transactional email (verification, password reset)	US
AppsFlyer	Device ID, install attribution, conversion events	Marketing attribution, campaign measurement	EU
Meta	Conversion events, device ID (ATT consent required)	Ad campaign optimisation	US
Mapbox	Approximate location (map tile requests)	Map rendering, offline map tiles	US
Apple	Account data, payment data	Sign in with Apple, App Store IAP	US
Google	Account data	Google Sign-In	US

International Data Transfers

Our primary database (Supabase) and analytics (PostHog) are hosted in the EU. Some processors are US-based (RevenueCat, Resend, Meta, Mapbox, Apple, Google). Transfers to the US are covered by Standard Contractual Clauses or equivalent safeguards as part of each processor's data processing agreement.

5. Analytics & Tracking

5.1 PostHog (Product Analytics)

We track anonymised events to understand how the app is used. Users are identified by a random UUID, not by email or name.

Opt-out: You can disable analytics tracking at any time via Settings > Analytics. This stops all event tracking entirely.

5.2 Sentry (Error Tracking)

Error reports are sent to Sentry for crash detection and debugging. Before sending, we automatically remove your email address, username, and IP address. Sample rate is set to 20% to reduce data volume.

5.3 AppsFlyer & Meta (Marketing Attribution)

Marketing attribution tracking only occurs if you grant permission via Apple's App Tracking Transparency (ATT) prompt. If you decline, no advertising identifiers or conversion events are shared with AppsFlyer or Meta.

6. Data Security

Passwords are hashed server-side (never stored in plaintext)
Auth tokens are stored in iOS Keychain (encrypted at rest)
All API communication uses HTTPS/TLS
Row-Level Security ensures users can only access their own data
All payments processed exclusively by Apple (App Store IAP) or Google (Play Billing)
We never handle, store, or have access to your credit card or payment details

7. Your Rights

Under GDPR and applicable data protection laws, you have the right to:

Right	How to Exercise
Access your data	Contact support@walkmarco.com
Rectify inaccurate data	Update your profile in-app, or contact support
Delete your data	Use "Delete Account" in Profile screen, or contact support
Port your data	Contact support@walkmarco.com
Object to processing	Disable analytics in Settings; contact support for other objections
Withdraw consent	Revoke location permission in device Settings; revoke ATT consent in device Settings; disable analytics in app Settings
Restrict processing	Contact support@walkmarco.com

Account Deletion

You can delete your account directly within the app (Profile > Delete Account). This permanently deletes your profile, tour history, saved tours, reviews, and purchase records from our database, signs you out, and removes auth tokens from your device. Purchase records may be retained by RevenueCat as they are tied to your Apple/Google account.

8. Data Retention

Data Category	Retention Period
Account data	Until account deletion
Tour history	Until account deletion
Purchase records	Until account deletion (our systems); per Apple/Google/RevenueCat policies
Reviews	Until deleted by user or account deletion
Saved tours	Until removed by user or account deletion
Analytics events	Per PostHog retention policy
Error/crash reports	90 days (Sentry default)
Marketing attribution	Per AppsFlyer retention policy

9. Children's Data

Marco is not directed at children. We do not knowingly collect personal data from users under 16 years of age. If we become aware that we have collected data from a child under 16 without parental consent, we will delete it promptly.

10. Cookies & Similar Technologies

The Marco mobile app does not use cookies. We use the following on-device storage:

iOS Keychain: Auth tokens only
On-device storage: Non-sensitive preferences and cached data
Device filesystem: Downloaded tour audio files

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes through the app or via email.

12. Contact Us

If you have questions about this privacy policy or wish to exercise your data protection rights:

Email: support@walkmarco.com Website: walkmarco.com