Privacy policy

Version of 24/10/2026. Takes effect on the date of publication.

This policy explains what personal data Brisavia handles when you use the app (iPhone and Android) and the brisavia.com website, why, for how long, who we share it with and what rights you have. We have deliberately written it in plain language.

In short: you use Brisavia without an account; what is yours (adventures, diary, GPS recordings, photos) stays on your phone; we only send data to our servers when a feature you asked for needs it; the account features (sync, Friends) are optional and every share is your choice; we do not sell data, there is no advertising, and this site uses no cookies or tracking.

1. Who is responsible

The data controller is Helder Pereira (an individual), with postal address Rua Particular de Francos 206, 4250-361 Porto, who develops and runs Brisavia. Contact for anything about privacy: privacidade@brisavia.com.

2. What stays only on your phone

This data is kept in the app, on your device, and does not go to our servers (unless you choose one of the account features, see sections 5 to 7):

• saved trails, adventures and stops, the diary and notes;
• the full GPS recordings of your walks and your location, used on the device for the map, navigation, voice prompts and detecting discoveries;
• photos (the app only keeps references to your photo library);
• offline map packages, downloaded AI models and your conversations with the Assistant;
• the Caderneta (stamps, goals and territories), calculated on the phone itself, and your private zones.

You can export or delete all of this in the app, under Profile. Deleting your account does not touch this data.

3. What reaches our servers even without an account

• Installation identifier: at launch the app registers with a random identifier, the platform (iOS or Android) and the app version, and receives an access code. It lets the app talk to our server and limits abuse. It contains neither your name nor your email. We keep it while the installation is used, delete it after 12 months without use and also if you ask.
• Imports: when you import a trail (by link, GPX or KML file, coordinates), the server reads the content and stores the result (title, route, statistics, source address and, if the page has one, the address of its share image), linked to the installation identifier (and to the account, if you are signed in), so it can return it quickly and for a security record. We delete that record automatically after 90 days. When the trail comes from a public page, the result also stays in the shared trail catalogue, with no link to you.
• Searches and routes: the text you search for (the name of a mountain range, a place) and, when you ask for a route or "near me", the coordinates requested, reach the server so it can answer. Route calculation and place search are done by OpenRouteService, always from our server and without your identifier. We cache calculated routes for 7 days, by the coordinates requested and without your identifier; the text of searches is not cached.
• Water and places along the route: when you open an adventure, the app sends the planned route to the server to find the water points and places near it. We do not store that route.
• Offline maps: when you ask for the size of an offline map, we keep the area requested (a rectangle of coordinates and the zoom levels), linked to the installation identifier. We delete it after 90 days.
• Request-limit counters: to stop abuse we keep, for about an hour, a counter per installation and per IP address.
• Technical server logs (the address requested, which may include the text of a search or coordinates, the status and errors; never the content of conversations), up to 30 days, to detect faults and abuse.

The Assistant runs on the phone (the device's model, an open model you download, or simple rules). What you type or say to the Assistant is not sent to our servers; only the searches it makes, for example the name of a mountain range, reach us to find trails. Voice dictation uses the system's speech recognition (Apple or Google). Cloud AI is not available at this time (section 7).

4. Walk with me (live position sharing)

It only happens when you start a share, and you can end or revoke it whenever you want. While it lasts, we send to the server:

• the latest positions (about 300 points over the last 6 hours), the battery level, the distance walked and the state of the share;
• the title and the name you choose to show, the planned route and the expected start and finish times;
• a link with a random secret (we keep only a fingerprint of it).

Whoever has the link sees the page brisavia.com/l/… with the map, your position and the battery. No account and nothing to install is needed, and the page uses no cookies. Whoever you send the link to decides who else sees it. Your private zones are applied on the phone before positions leave it.

The link stops working 24 hours after the share ends, or as soon as you revoke it, and positions are deleted on revoking. The rest of the share's data is deleted automatically shortly after; an abandoned share is deleted after 48 hours.

If you turn on the late reminder, we keep your phone's push notification code (see section 9) to remind you if you pass the expected finish time. Legal basis: your consent, when you start the share.

5. Account and sync (optional)

An account restores your data on another phone and enables the features that need you to be identified (Friends). You only create one if you want to, with "Sign in with Apple" (iPhone) or "Sign in with Google" (Android). We neither ask for nor store a password. We keep:

• the identifier Apple or Google gives your account for Brisavia and, if they provide it, your email only as an irreversible fingerprint (we do not store the email itself; with "Hide My Email", Apple gives us a relay address);
• the display name (optional), the language, the plan and the record that you declared you are 16 or older;
• the account's sessions (device identifier, dates of use) and, with Apple, a code that is only used to revoke access when you delete the account.

After you tap "Link this phone", we sync documents between your phones: saved trails, adventures, discoveries, diary entries, walk summaries (distance, time, climb and a simplified route, already without your private zones) and preferences (units, voice, dog mode and private zones with a shifted centre). We do not sync full GPS recordings, photos, offline maps, the Caderneta or Assistant conversations. There is a limit of 20 MB per account.

Legal basis: performance of the contract (providing you the account and sync). We keep this data until you delete the account (see section 11).

6. Friends: friends, leagues, teams and discoveries (optional, with an account)

The Friends area only works with an account and everything in it starts switched off. Nothing is public: what you share is only seen by your friends (mutual friendships, by invitation) or by the members of a league you are in. There are no private messages and no "people near you". When you use Friends, we handle:

• Profile: your display name, your avatar colour and, if you want, a unique @username (3 to 20 characters, which you can change once every 30 days; the old one stays reserved for you for 30 days) and a one-line bio. The name, the @username and the bio go through a filter of offensive words before they are accepted and are visible only to your friends and, the name and the @username, to the members of your leagues. Your notification and sharing choices, and the version of the Friends rules you accepted, with the date.
• Profile photo and cover (optional): if you choose a photo from your gallery, the phone crops it, shrinks it and re-encodes it as a JPEG (which removes the location and other data from the photo) and sends it to private storage on the server, with no public address, where the server accepts only JPEG and strips the metadata again. Only your friends can see it, never blocked people nor league members who are not your friends; the cover can also be the track of your last walk or an illustrated Brisavia cover, which involve no photo. You can remove the photo and the cover whenever you like, in the app (Profile, Edit), and they are deleted at once; deleting the account deletes them too. The photo you pick as the background of the Story stays on the phone only. We do not scan photos automatically: we only look at one if someone reports it, and the one who looks is a person.
• Invitations: a single-use code, valid for 7 days (brisavia.com/c/…). Whoever opens it, signed in, sees your name before accepting. Friendships (with the date), the people you have blocked (with the name they had at the time) and the "Boa!" you give and receive.
• Walks shared with friends: only if you turn on "Show my walks to friends". We send the summary of each walk saved in the diary (title, day, distance, duration, climb, municipalities or provinces and stamps), with no start time and no starting point. The track is only sent if you turn it on for that walk; it is already cut by your private zones, and the server trims a further 300 m at each end and simplifies it.
• Public walk links (optional): if you tap "Share walk link", we create a link (brisavia.com/w/…) that anyone who has it can open, without an account. The page shows the title, the region, the day (never the time), the distance, the climb, the stamps, the water and places along the way and the track, cut by your private zones and by 300 m at each end; your name only appears if you turn on "Show my name". The link expires after 90 days and you can renew it for another 90 days in the app (Renew); it also stops working if you turn it off in the app or delete the walk or the account, and as soon as you turn it off (temporary copies can take up to 5 minutes to disappear). An expired link stays hidden for 30 more days, so you can renew it, and is then deleted. The page uses no cookies and asks search engines not to index it. Whoever you send the link to decides who else sees it.
• Private leagues (up to 12 people, by invitation): the league's name, its members and each member's points, visible only to the members.
• Team and territory tables: the district (Portugal) or province (Spain) you choose as your team, once a season. The tables show only sums per territory, with no names, and a territory only appears with at least 10 participants. Season challenges and "Your season" (your numbers for the season).
• Verified discoveries: when a discovery counts for points, the phone sends the place, the time, 2 or 3 positions that confirm it, a summary of the approach (distance, moving time, number of points), whether the location was simulated, and the municipality or province. The server checks it against cheating. We never send a discovery, or positions, inside your private zones. "Discovered by N people" only appears from 5 people and never says who. We also keep your water confirmations (drinkable, not drinkable, dry).
• Reports, blocks and moderation: you can report a person's name, photo (and cover) or @username, or block them. We keep the report (who, whom, what was reported, the reason and an optional note). Two reports from different people hide the name, the photo or the @username for everyone but the person themself, until it changes or is reviewed. The controller reviews reports in a closed console, can hide a photo or take away an @username (the person has to pick another one) and every action is logged.

Legal basis: performance of the contract for the Friends features you turn on; consent for the profile photo and cover (you choose to upload them, and you can take them down whenever you like), for showing your walks and the track to friends and for creating public walk links (you can turn it off at any time, and the walks or the links stop appearing); legitimate interest for verifying discoveries, preventing abuse and moderation.

Friends notifications (friendship accepted, "Boa!", end of season) use the push notifications of section 9 and start switched off.

7. Assistant and AI

The Assistant understands what you ask on the phone. Depending on the device, it uses Apple Intelligence (iPhone), Gemini Nano (Android), an open model you download (iPhone) or, if none is available, simple rules. Screenshots you attach are read on the phone itself, with Apple Vision (iPhone) or ML Kit (Android). Your messages and images are not sent to our servers.

What reaches our servers:

• only the searches the Assistant makes after understanding the request, for example the name of a mountain range to find trails;
• the phone's position, only when you ask for something "near me", and it is used only for our searches;
• routes always come from the catalogue and the routing engine, never invented by AI, and GPS (navigation, recording, Walk with me) never depends on AI.

Cloud AI: the optional online AI step and the cloud assistant are not available to users at this time. Before we open them, we will update this policy and ask you first.

Brisavia does not keep the conversations: nothing stays in the database or in the logs, which only hold counts. The server only counts requests (how many per month, linked to the account, and totals per day), to apply limits.

8. Who we share it with (processors and recipients)

We do not sell data or use it for advertising or profiling. We use these providers, only for what is necessary:

• Cloudflare, Inc.: hosting of the server and the site, database, storage and network. The databases and the file storage are in the Western Europe region (a location we chose), but that is only a location hint: we do not guarantee that the data always stays in the European Union, and Cloudflare is a US company. It is our main processor.
• Apple: "Sign in with Apple" and push notifications on iPhone (APNs).
• Google: "Sign in with Google" and push notifications on Android (Firebase Cloud Messaging).
• OpenRouteService (HeiGIT gGmbH, Germany): route calculation and place search. It receives the text or the coordinates of the request, not your identifier.
• OpenFreeMap: the map tiles loaded by the app and the site. It sees your IP address and the map area you ask for.
• Hugging Face: if you download an AI model, the file comes from huggingface.co to your phone; they see your IP address.
• jsDelivr (code delivery network): the site pages with a map, such as Walk with me and the trail pages, load the MapLibre map library from jsDelivr, which sees the IP address of whoever opens the page.
• Third-party pages: when you import a link, our server visits that page to read it. If the page has a share image (OpenGraph), the app may show it, with the name of the page as credit: in that case it loads it directly from the source page, which sees your IP address.

Some of these companies are outside the European Union (for example in the United States). In those cases transfers rely on mechanisms provided for by the GDPR, such as standard contractual clauses or the EU-US Data Privacy Framework.

9. Push notifications

If you accept notifications, we keep your phone's code given by Apple or Google (and the language and time zone) to send you notices from the app itself: the Walk with me reminders and, if you turn them on in Friends, friendship accepted, "Boa!" and end of season. You can refuse or turn them off in the phone's or the app's settings. The text of the notice (for example the name of the friend who gave you a "Boa!") passes through Apple or Google to reach your phone. We delete the code when it stops being valid, when you delete the account or if you ask. Legal basis: consent.

10. This website

The brisavia.com site uses no cookies, has no visit analytics and does not track anyone. Cloudflare temporarily processes the IP address of visitors to deliver the pages and protect the service. The pages with a map (Walk with me and the trail pages) load the map library from jsDelivr and the maps from OpenFreeMap, which see the IP address of whoever opens them (see section 8).

If one day we use visit statistics, it will be Cloudflare Web Analytics, which uses no cookies and does not identify people, and this policy will be updated before that.

11. How long we keep it

• Walk with me positions: deleted when you revoke the share; the link and the rest of the data last up to 24 hours after the end.
• Imports and offline-map requests: 90 days, deleted automatically. Installation identifier: deleted after 12 months without use, or if you ask.
• Account and synced documents: until you delete the account. The account stops existing at once and the data is deleted for good after 14 days. Documents deleted on one phone stay recorded for 90 days, so the deletion can reach your other devices.
• Friends: the profile, friendships, blocks and leagues, until you remove them or delete the account; a walk shared with friends, until you turn sharing off, delete the diary entry or the account; a public walk link, until it expires (90 days after you create or renew it; hidden for 30 more days so you can renew it, and then deleted), you turn it off, or you delete the walk or the account; discoveries, season numbers, challenges and water confirmations, until you delete the account; reports not yet resolved, while both accounts exist, and resolved ones, for 1 year after they are resolved (or until one of the accounts is deleted). The tables of a closed season are archived only as sums per territory, with no people.
• Notification code: until it stops being valid or you delete the account. Count of Assistant requests (numbers only, see section 7): until you delete the account. The record of the controller's actions in the moderation console (who, when, why): 1 year.
• Technical logs: up to 30 days. Limit counters: about an hour. Technical database backups may keep already deleted data for a short period (up to about 30 days) before it disappears.

12. Legal bases

• Performance of the contract: account, sync and the Friends features you turn on (friends, leagues, team, challenges, discoveries).
• Consent: live position sharing, push notifications, the profile photo and cover, showing your walks to friends and public walk links (you can withdraw it at any time).
• Legitimate interest: request limits, security, the record of imports, verifying discoveries against cheating and moderation.

13. Your rights

You have the right to access your data, correct it, erase it, restrict or object to its processing, data portability and to withdraw consent. In the app you can:

• export your data (Profile, Export; with an account, the export includes everything the server holds about you, Friends and discoveries included; the photo and the cover appear in the list with their size and date, but not the files);
• delete the account (Profile, Account, Delete account) or all the data on the phone (Profile, Delete everything).

You can also write to privacidade@brisavia.com. We reply within one month. If you think we handle your data wrongly, you can complain to the supervisory authority: in Portugal, the Comissão Nacional de Proteção de Dados (cnpd.pt); in Spain, the Agencia Española de Protección de Datos (aepd.es).

14. Minimum age

The app can be used without an account. An account, and therefore Friends, is only for people aged 16 or over: we ask for a declaration when the account is created and do not store the date of birth. If we learn that an account belongs to someone under 16 (for example, if someone tells us at privacidade@brisavia.com), we delete it: the controller deletes the account and its data from the management console, as described on the "Delete account" page.

15. Security

Connections use HTTPS. Access codes and the Walk with me link are kept only as fingerprints, invitations are single-use and expire after 7 days, walk links are long random codes that expire after 90 days unless you renew them, there are no passwords, access to the data is restricted, the management console is closed behind authentication and every action in it is logged, and the public Walk with me page has hardened protections. No system is perfect: if there is a breach that affects you, we will tell you and the supervisory authority, as the law requires.

16. Changes

If this policy changes in a material way, we will say so in the app and on the site before the change applies. We keep the earlier versions.