Privacy policy

Bivaq is an independent solo project. The data controller is Pavol Milý, identified in the imprint. One address serves both purposes — general contact, and exercising your data-protection rights (access, correction, deletion, objection, portability, and withdrawing consent): info@bivaq.sk.

Account — your email and, if you sign up with a password, a hashed password; or, if you use “Sign in with Google”, your Google account identity. We use this to create and secure your account. Legal basis: performance of our agreement to provide you the service.

Profile — your display name and, optionally, an avatar, bio, home region, country, and outdoor details (favourite sleep spot, favourite gear, years outdoors, longest trip, preferred shelter types, and an “archetype”). You choose what to add. Legal basis: consent. These fields are public (see below).

Contributions — shelters you add, status reports, water reports, and photos. This is the map. Legal basis: our legitimate interest in maintaining a shared, useful map, and your choice to post. Contributions are public and shown with your display name.

Private records — the places you save (wishlist) and the nights you log (“slept here”). Legal basis: performance of our agreement. These are not public.

Support form — if you use the support form to offer to help with Bivaq's running costs, we store the email address you enter and, if you fill them in, your message and your Bivaq username. We use them for one thing: to write back to you about it. Legal basis: consent, which you can withdraw at any time by writing to the contact address above; we then delete the entry. Kept while the conversation is open and deleted when it is finished. It is not public — only the operator can read it — and it is never used for a newsletter or any other mailing.

Supporter badge — if you have supported Bivaq, we may record a supporter flag on your account so a badge shows on your profile. Legal basis: consent. This flag is public: anyone who opens your profile can see the badge. Ask at the contact address above and we remove it.

Waitlist (closed) — Bivaq once had a waitlist for a planned paid tier. It is closed, the form is gone, and no new addresses are collected. Addresses collected while it was open are still held and have not been mailed; they will be written to once, to say the paid tier is not happening and everything is free, and then deleted. Legal basis: consent. Not public. You can ask for your entry to be deleted before then.

Bivaq+ status (dormant) — the mechanism that recorded whether an account held the former paid tier still exists in the database and holds one record. It grants nothing and gates nothing — every feature is free to everyone — and it is not used. Legal basis: performance of our agreement. Not public.

Public: your contributions (shelters, status reports, water reports, photos), your display name and avatar, and any profile details you fill in — bio, home region, country, and the outdoor fields listed above. Anyone can see these on your public profile and next to your contributions.

Private: your email address, your saved places (wishlist), and your slept-here logs. Only you (and, for operating the service, the site operator) can see these.

If you allow it, your browser shares your location so we can show nearby shelters and local weather. We ask before we use it, and we don't store your coordinates — they stay in your browser for the session.

The only time your location leaves your device is for weather: when you have shared it and no shelter is selected, we send your approximate coordinates to the weather provider (below) to fetch the forecast. When a shelter is selected, that shelter's coordinates are used instead. Sorting shelters by distance happens in your browser.

Every uploaded photo is re-encoded in your browser before it's stored, which strips all embedded metadata — including any GPS location in the original file. The stored image carries no hidden location or camera data. This applies to every upload, community and admin alike.

We use only strictly necessary cookies. There are two kinds, both set by this site and readable only by it:

Session cookies — they keep you signed in. Only present once you sign in, and gone when you sign out or delete your account.

A language cookie — NEXT_LOCALE, so the site keeps showing you the language you are reading. It is set only when that differs from the language your browser asks for — an English browser reading the Slovak pages, say — it holds a language code and nothing else, and it is gone when you close your browser.

There are no advertising cookies and no tracking cookies, and neither of these is used to recognise you anywhere else. Our page-view measurement (below) sets no cookie at all and stores nothing on your device. Because nothing here is stored for any purpose beyond running the service you asked for, there is no consent banner to click.

We use Vercel Web Analytics, run by our hosting provider, to count how often pages are viewed and which sites link to us. We use it to see which parts of Bivaq are worth the work — nothing else depends on it.

It is cookieless. For each page view it records:

The page — the address of the page you viewed, and the kind of page it is (a shelter page is also counted as “a shelter page”, so the figures can be read per page or per kind). The address is the path only: anything after a “?”, including what you type into the search box and the filters you set, is not sent.

The referrer — the site you came from, if any.

Coarse technical data — country, device type, browser and operating system, derived by the provider from your request. A country, not a position: this has nothing to do with the map's location feature described above, and that location is never sent to it.

The dashboard also shows a visitor count, which is estimated by the provider from the request itself. Nothing is stored on your device for it: no cookie, no identifier in your browser's storage, nothing that another website could read. Your IP address reaches the provider the way it reaches any web server, and is used to derive the country and count the view — we never see it, and the figures we can query are aggregate counts only.

What it does notdo: it does not build a profile of you, give you an advertising identifier, or follow you to other websites. It is not shared with advertisers, and Bivaq runs no advertising. Nothing it collects is joined to your Bivaq account — if you are signed in, these figures still don't say it was you.

Legal basis: our legitimate interest in knowing whether the site works and is used (Art. 6(1)(f) GDPR). Because the measurement is aggregate and cannot identify you, it needs no consent and there is no banner to click. If you would rather not be counted at all, any content blocker that blocks analytics scripts will stop it, and the site works exactly the same.

We rely on a small number of providers to run Bivaq:

Supabase — our database, authentication and file storage. It holds your account, profile and contributions.

Vercel — application hosting, and the page-view measurement described above. As the host it processes standard request data (such as your IP address and browser type) to serve and secure the site; as the analytics provider it receives the page viewed, the referrer and coarse technical data, and returns aggregate counts. It sets no cookie for either purpose.

Google — only if you choose “Sign in with Google”, to verify your identity.

Open-Meteo — the weather provider. It receives coordinates (a shelter's, or your approximate location as described above) to return a forecast. No account or name is sent.

OpenFreeMap / OpenStreetMap — map tiles for the default map. Loading the map sends your IP address and the map area you are viewing to the tile servers, as with any web map.

OpenTopoMap — tiles for the hiking map layer, only while you have that layer selected. Same request data as any tile server: IP address and map area.

Waymarked Trails — tiles for the marked-paths layer, only while you have that layer switched on. It is off by default, and it works over any base map, so it is now your switch rather than your choice of map that decides whether this server is contacted. Same request data as any tile server: IP address and map area.

Mapbox — tiles for the satellite layer, only where that layer is offered and while you have it selected. Same request data as any tile server.

Wikimedia — shelter and mountain-range photos sourced from Wikimedia Commons are loaded directly from Wikimedia's servers, so displaying one sends your IP address there — we don't re-host the images.

There is no payment provider in this list, and that is not an omission: Bivaq takes no payments. Nothing is sold, there is no checkout, and no card or bank details are collected or processed anywhere in the service. If that ever changes, the provider will be named here before it is used.

These providers act as our processors or independent controllers. Some may process data outside your country; where they do, appropriate safeguards apply.

We keep your account and content while your account exists. You can delete your account yourself, any time, from the Account section of your profile.

When you delete your account, we delete your personal data: your login (email, password or Google link), your profile and avatar, your saved places and your slept-here logs. Your contributions stay on the map — shelters, reports and photos keep their value to other people — but they are anonymised: your name is removed and they show as “Bivaq user”. This can't be undone.

If you are in the EU/EEA or UK, you have the right to:

• Access — ask what data we hold about you.
• Rectify — correct it. Most fields are editable in your profile.
• Erase — delete your account and personal data yourself, from your profile.
• Port — get a copy of the data you provided.
• Restrict or object — to processing based on legitimate interest.

Use the self-service tools where they exist (edit or delete from your profile); for anything else, email info@bivaq.sk. You can also complain to your local data protection authority.

Bivaq isn't directed at anyone under 16, and we don't knowingly collect their data.

If this policy changes, we'll update this page and the “last updated” date above.