Privacy Policy

The short version

• No accountThere is no sign-up and no login. Using Darb never requires your name, your email address or your phone number.
• No ads, no trackingThe app contains no advertising networks and no third-party analytics or tracking tools.
• Nothing is soldWe do not sell, rent or trade information about you, and we share nothing beyond the handful of service providers listed below.
• Mostly on your deviceYour language, your progress through the tours and games, and anything you download for offline use stay on your phone.

Information you give us

There is exactly one place in the app where we ask for personal details: the contact form. When you write to us, we receive the name, email address, subject and message you typed, so that someone on our team can read it and reply.

That message is stored in our admin system and used for nothing else. It is not added to a mailing list and it is never used for marketing.

Information collected automatically

Two things are recorded on our servers while you use Darb. Both are built so that they cannot be traced back to you as a person.

• Sign scansWhen a Darb QR sign is scanned or its link is opened, we record which code it was, the date and time, whether it was opened in the app or in a browser, the device platform, the browser identification string and the page that referred you. We do not store your IP address: it is mixed with a secret value that changes every 24 hours and turned into a one-way fingerprint. That lets us count how many different people scanned a sign today, without being able to recognise anyone tomorrow.
• Anonymous countersPlain totals — how many quizzes were submitted, how many certificates were created, how many times a tour was opened — are increased by one. They are numbers only, attached to no device and no person.

As with any website, our hosting provider also keeps standard web-server logs for a short period, for security and troubleshooting.

Push notifications

If you allow notifications, your device is issued a token by Google Firebase Cloud Messaging and sends it to us. We use it to subscribe your installation to broadcast topics — everyone, plus the language you read the app in — so we can announce events, new tours and news.

The token identifies an installation of the app, not you. No name, email address or phone number is attached to it, and it tells us nothing about what you do in the app. Turning notifications off in your phone settings, or uninstalling the app, ends this.

Permissions the app asks for

Each permission is requested only when a feature needs it, and refusing one never blocks the rest of the app.

• LocationShows places near you and your position on the map. Your coordinates are sent to our server only to answer that request, and are not stored or logged against you.
• CameraReads Darb QR codes, and nothing else. No photo or video is taken, saved or uploaded.
• NotificationsOptional, and used only as described above.
• FilesUsed when you choose to save something to your own device — a completion certificate, or an event added to your calendar.

What stays on your device

The app keeps the following in its own storage on your phone: the language you chose, your progress through tours, quizzes, challenges and treasure hunts, your recent searches, any text, images and audio you downloaded for offline use, and any sign scans waiting to be reported the next time you are online.

None of it is sent to us, apart from those scan reports. Clearing the app data or uninstalling the app erases all of it — and because we never held a copy, it cannot be restored.

Services we rely on

Darb is built with as few outside services as possible. This is the complete list.

• Google Firebase Cloud Messagingdelivers push notifications, and receives the notification token described above.
• OpenStreetMapsupplies the map images. Your device requests them directly, so those servers can see your device IP address whenever a map is displayed.
• Apple App Store and Google Playdistribute the app. Downloads, updates and the statistics they show us are governed by their own privacy policies, not this one.
• Our hosting providerruns the servers holding the content and the records described above.

Cookies

Our web pages set only the essential cookies needed to serve the page and to protect forms from abuse. There are no advertising, profiling or analytics cookies of any kind.

Children

Darb is a cultural guide suitable for all ages. There are no accounts, no profiles and no user-generated content, and we do not knowingly collect personal information from children. If you believe a child has sent us personal details through the contact form, write to us and we will delete the message.

How long we keep information

• Contact messageskept while we handle them, and afterwards as a record of the correspondence. Ask us and we will delete yours.
• Scan recordskept as long-term statistics on how the signs are used. The visitor fingerprint they contain is already anonymous and cannot be linked back to you.
• Notification tokenskept until the device unsubscribes, the app is uninstalled, or Firebase reports the token as no longer valid.

Your choices and your rights

You may ask what information we hold about you, ask for it to be corrected, or ask for it to be deleted, by writing to the address below. Because the app has no accounts, in almost every case the only thing we hold is a message you sent us — so please write from, or tell us, the email address you used.

Location, camera and notification permissions can be withdrawn at any time in your phone settings.

Security

Traffic between the app and our servers travels over HTTPS, and the admin system that holds contact messages is reachable only by named, authorised members of our team. No system is perfectly secure, but we keep as little as possible precisely so there is as little as possible to lose.

Changes to this policy

If this policy changes, the new version is published on this page and the date at the top is updated. Significant changes are also announced in the app.