Privacy notice

Last updated: 17 October 2026

This notice explains what personal data the three parts of PinVia process, why and for how long: the website www.pinvia.it, the app for following routes (player.pinvia.it) and the organiser area (organize.pinvia.it). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Article 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003). The Italian version is the reference text.

1. Who the controller is

The controller is Stefano Bianchini, VAT number 04439480403. For any question about your data, or to exercise your rights, write to privacy@pinvia.it.

No data protection officer (DPO) has been appointed: one is not required for a service like PinVia (Article 37 GDPR).

2. In short

• You don’t sign up to use the app: we don’t ask for your name or email and we don’t give your phone an identifier.
• No cookies on the website or in the app, no advertising, no profiling, no third-party analytics.
• Like any website, our server receives your IP address with every request. We keep it in full for at most 6 months, for security only.
• Route statistics are daily counts, with nothing that links them to whoever followed the route.
• Organisers have an account with email, name and password. The name is shown as the author of published routes.

3. What the server records (for all three parts)

The website, the app and the organiser area run on the same server. The server needs your device’s IP address to send it the answers: for the Court of Justice of the European Union it is personal data, even if on its own it doesn’t say who you are. We handle it as follows:

• Security log: full IP address, date and time, address of the page or request (without parameters, coordinates or invitation codes), result, response size and “user agent” (name and version of the browser and operating system). Next to it is the server error log, which also contains the full IP address. Both delete themselves after at most 6 months: an attack is sometimes discovered weeks later, and we need to be able to reconstruct it. They are used to block automatically (with the fail2ban program), for one hour, addresses that send too many requests or probe for vulnerable files, and to reconstruct an attack or abuse. Only in that case may they be handed to the judicial authorities or the police, at their request.
• Operation log: shortened IP address (for IPv4 addresses the last of the four numbers is set to zero; IPv6 addresses are not recorded), date and time, request without parameters, result and size. It doesn’t contain the browser. It has a maximum size: the oldest lines are deleted as new ones arrive.
• Rate limits: to prevent abuse we count how many requests arrive from the same IP address (and, for sign-ins, for the same email) within a minute. The count is stored as a fingerprint (hash) and is deleted at the latest one hour after it expires, which takes a few minutes.

The website www.pinvia.it uses no cookies or other tools that store data on your device, and loads nothing from other sites.

4. The app for following routes (player.pinvia.it)

No account, no cookies

The app doesn’t ask you to sign up, uses no cookies and doesn’t give your phone an identifier that recognises it from one visit to the next.

What stays on your phone

To work, the app saves some information in your phone’s browser storage:

• preferences (light or dark look, vibration, language, 3D map and compass, welcome screen already seen);
• progress on each route: stops reached and completed, answers and attempts at puzzles;
• a queue of statistics not yet sent because you were offline (at most 200 events, discarded after 7 days);
• downloaded content for offline use: the routes you opened (up to 30 days), the map areas already seen (up to 14 days) and the images (up to 30 days), as well as the files of the app itself.

This information is not sent to us (except for the statistics described below) and only serves to give you the service you asked for: that’s why your consent is not needed (Article 122 of the Italian Code). You can erase it at any time from About and privacy → Erase everything PinVia has saved, or by clearing the site data in your browser settings.

Your location and the compass

The app uses your phone’s location only if you allow it through the browser permission. During a route the distance to the stops is calculated on the phone and the location is not sent. Only to search for nearby routes does the app send the server a location rounded to about 100 metres: the server uses it to answer and doesn’t keep it (it is also removed from the logs described above). If you don’t grant permission you can still open a route from a link or a QR code.

The compass direction, when on, only rotates the map on the phone: it is neither saved nor sent.

Anonymous statistics

When you start a route, reach a stop or get to the end, the app sends the server only that fact: which route, which stop, which event and the day, with no time, location or phone identifier. The server adds one to that day’s count and keeps nothing else. These are anonymous data: the organiser only sees the totals.

Puzzles

Puzzle answers are checked on the phone and not sent. If you ask to see the solution, the app downloads it from the server like any other content.

Map, images and videos from other sites

Some content comes from external services. When your phone downloads it, those services receive at least your IP address, browser and the time of the request, and handle them under their own privacy notices, as independent controllers:

• Map: from OpenFreeMap (Hyperknot Software Kft., Hungary). According to its privacy policy it doesn’t log IP addresses except when investigating abuse, and it may use Cloudflare’s delivery network (United States).
• Images: organisers may use images hosted on other sites of their choice. The app doesn’t tell those sites which page you came from (no “referrer”).
• Videos: a stop may contain a YouTube video (Google Ireland Limited). Nothing is loaded until you tap “Play”. After that, the video comes from youtube-nocookie.com, the privacy-enhanced mode, and YouTube may store information on your device and collect viewing data under its own privacy policy.

Reports

If you report content by writing to report@pinvia.it we receive your email address and what you write. We use them only to handle the report and keep them for 12 months after closing it.

5. The organiser area (organize.pinvia.it)

• Invitation: accounts are created by invitation only. The email and name you are invited with are given to us by the administrator who invites you. The invitation is deleted 90 days after acceptance, revocation or expiry.
• Account: email, name, password (stored only in hashed form, never in clear), version and date of the terms of use you accepted, date of any suspension. The name is public: it is shown as the author of the routes you publish. You can change it from the Profile page.
• Sign-in: to keep you signed in we use two technical cookies, pinvia-session (the session) and XSRF-TOKEN (protection against forged requests). On the server the session keeps your IP address and browser. It ends when you sign out or after 120 minutes of inactivity, and its data is deleted at the latest one hour later. They are needed for the service and require no consent.
• Password recovery: we send you a link valid for 60 minutes. The code is stored only in hashed form and using it closes all open sessions.
• In your browser: the organiser area remembers the last map area you viewed and a copy of changes not yet saved, so they aren’t lost if the connection drops.
• Uploaded images: if you use the media gallery, images stay on our server with the original file name. We remove EXIF data (for example the coordinates where the photo was taken).
• Route content: you choose texts, images and videos and you are responsible for them. If they contain other people’s personal data, make sure you may publish it. To check that external images work, the server periodically queries the addresses you entered, without sending any data about app users.
• Statistics: you only see the anonymous counts of your routes described in section 4.
• Billing: if you choose a paid service we ask for your invoicing details (name or company name, address, tax code or VAT number, certified email or recipient code). We process them outside the organiser area, only to issue the electronic invoice, which goes through the Italian Revenue Agency's Exchange System (Sistema di Interscambio). Invoices and the data they contain are kept for 10 years, as required by Italian law (Article 2220 of the Civil Code and Article 39 of Presidential Decree 633/1972), even if you close your account in the meantime.

Emails from the organiser area (invitation, password recovery) are sent from noreply@pinvia.it through Aruba S.p.A., IT.

6. Why we may process this data (legal bases)

• Organiser accounts, sign-in and password recovery: performance of the terms of use you accept (Article 6(1)(b) GDPR). For the invitation, before acceptance: our legitimate interest in letting you know about the invitation you received (point (f)).
• Server logs, rate limits, fail2ban: legitimate interest in running the service and protecting it from attacks and abuse (Article 6(1)(f) and Recital 49 GDPR).
• Approximate location for nearby routes and delivery of app content: legitimate interest in providing the service you ask for, without keeping anything (point (f)).
• Map and images from other sites, videos on request: legitimate interest in showing you the content of the route you opened (point (f)); the video loads only if you ask for it.
• Information stored on your device and technical cookies: strictly necessary for the requested service (Article 122 of the Italian Code), without consent.
• Billing: performance of the contract for the paid service (Article 6(1)(b)) and the legal obligation to issue and keep invoices (point (c)).
• Reports and requests by email: legitimate interest in handling content reports and the obligation to answer data requests (Article 6(1)(c) and (f)).

7. Who receives the data

• OVH SAS (Roubaix, France), which provides our server (Frankfurt am Main, DE), as processor under Article 28 GDPR.
• The email provider (Aruba S.p.A., IT), to send and receive emails, as processor.
• The external services described in section 4 (OpenFreeMap, image sites, YouTube), which receive data directly from your phone as independent controllers.
• For billing: the Italian Revenue Agency, which receives the electronic invoice through the Exchange System, as independent controller; the accountant who keeps our books; the electronic invoicing service we use, as processor.
• Authorities, only if they request it in the cases provided by law.

We don’t sell data and don’t give it to anyone for advertising or marketing.

8. Transfers outside the European Union

We don’t transfer data outside the European Union. Some external services used by the app may do so: Cloudflare (for OpenFreeMap) and Google (for YouTube) also operate in the United States and participate in the EU-U.S. Data Privacy Framework, found adequate by the European Commission in its decision of 10 July 2023. External images may be hosted on sites in any country, chosen by the organisers.

9. Your rights

You may ask to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format (portability) and object to processing (Articles 15-22 GDPR) by writing to privacy@pinvia.it. We reply within one month.

• Organisers: you may ask at any time for your account to be closed. We delete the account and the related data, except what we must keep by law: invoices and billing data are kept for 10 years (Article 17(3)(b) GDPR).
• App users: since there are no accounts or phone identifiers, we cannot link the data we process to you (Article 11 GDPR). You erase the data stored on your phone yourself, as explained in section 4.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.

10. Other information

• Required data: you don’t have to give us any data to use the app, and location is optional. For an organiser account, email, name and password are required: without them we cannot create it.
• Automated decisions: no decision about you is made automatically and there is no profiling. The only automatic action is fail2ban temporarily blocking an IP address, for one hour, in case of anomalous requests.
• Changes: if we change this notice we update the date at the top of the page. If the change concerns organisers, we let them know.