Awaystamp privacy policy

Last updated: 12 October 2026

Español

Data controller

Juan Zurita Ruiz-Ruano, an individual trading as ZuritaTech (tax ID 26828689V), at Calle Alta Cartuja, 20, Granada (España). Contact: admin@zuritatech.com. Awaystamp never sells your data.

This policy covers the Awaystamp app and its pages on this website. The GDPR and Spain's LOPDGDD apply and, depending on where you live, the UK GDPR, Brazil's LGPD and US state privacy laws; we extend the rights described below to everyone.

What data we process and why

• Account (email, username, display name, password stored only as an irreversible hash, favourite team and home city): to identify you, keep your session and work out the distance of your trips.
• Sessions (access tokens with an expiry date, stored as hashes): to keep you signed in and let you sign out.
• Sign in with Google (optional): if you choose to sign in with Google we receive your verified email, your name and an identifier of your Google account; we never get your Google password. We use it to create or recognise your account.
• Usage statistics and crash reports (Firebase Analytics and Crashlytics, by Google), only if you accept when you open the app; you can change it any time in your account menu. The statistics count which features are used (for example, how many visits are logged) with an installation identifier, without your name, email or content. If the app crashes, technical data about the crash is sent (Android model and version, app version and app state). They are used to improve the app and fix bugs.
• Friend code: a 6-character code linked to your account. Anyone who knows it can see your username and display name and follow you, for the friends leaderboard; it gives access to nothing else.
• Stadium visits (stadium, date, teams, score, competition, departure city, distance, transport, whether you went as home, away or neutral, and your notes) and who can see them (everyone, friends or only you, chosen for each visit): for your passport, points and statistics.
• Photos and tickets you add to a visit: they are recompressed before leaving your phone, which removes their metadata (including GPS location); on the server they are re-encoded and served through signed links that expire. A person reviews them before approving them, to moderate content and verify visits.
• Points, rankings and follows (who you follow and who follows you, your points and counts of stadiums, matches, countries, kilometres and photos): for the global, team, friends and season rankings. Your username, display name and points appear in those rankings to other users.
• Public profile: only if you turn it on, zuritatech.com/awaystamp/u/<username> shows your passport without exact dates. You can turn it off at any time.
• Pro subscription (product, purchase token, status and expiry): only if you subscribe, to check with Google Play that it is active. Google processes payment details; we never see them.
• Real 3D view (Pro): we count how many times you open it each month to apply the plan's limit. When you open it, your phone downloads the 3D imagery straight from Google (Photorealistic 3D Tiles), which sees your IP address and the stadium area you are looking at.
• Map: map tiles are downloaded from OpenFreeMap, which sees your IP address and the area you are looking at. Only if you tap “I'm at the ground now”, Awaystamp asks permission to read your position once and compares it with the ground's on your phone; it is never sent to or stored on our servers. Without that permission you can log the visit manually.
• Advertising identifiers (Google AdMob): only on the free plan, only when ads are shown and according to your choice in Google's consent form. Never with Pro.
• Age range in Brazil: if your phone is from Brazil, the app asks Google Play for your age range (for example, 13-15 or 18+) to comply with Brazil's Digital ECA; unless Play confirms you are an adult, ads are not personalised. It is used on your phone only: it never reaches our server.
• Reports, blocks and moderation: the reports you send (who, reason and your text), the fans you block and the moderation decisions about your account or photos (what was decided and why). We use them to review reports, apply blocks and explain any measure to you. The person reported doesn't see who reported them.

Legal basis

Performance of the service you request (GDPR art. 6(1)(b)) for the account, visits, photos, rankings and subscription. Your consent (art. 6(1)(a)) for the public profile and ads, which you can withdraw at any time; withdrawing it doesn't affect earlier processing. Our legitimate interest (art. 6(1)(f)) in moderating photos and names, handling reports and blocks, preventing abuse and protecting the service. Compliance with legal obligations (art. 6(1)(c)) to handle notices of illegal content and explain our decisions (EU Digital Services Act).

Recipients and processors

We only share data with providers that supply us with a service, under contract, and don't use it for any other purpose:

• IONOS SE: hosting of our server, database and photos, on a VPS in Frankfurt (Germany), within the European Union.
• Cloudflare, Inc.: delivery network and attack protection. Connections to our website and API pass through its servers, which see your IP address and technical connection data; it doesn't keep your account content.
• Google Play (Play Billing): purchases and subscriptions.
• Google (Sign in with Google and Firebase Analytics and Crashlytics): access with your Google account, if you choose it, and, only if you accept, usage statistics and crash reports.
• Google (Map Tiles API, Photorealistic 3D Tiles): real 3D view for Pro users.
• Google AdMob and Google's consent form (UMP / IAB TCF): ads on the free plan, only according to your choice.
• OpenFreeMap: map tiles.
• Backblaze, Inc. (B2 storage, US East region, USA): encrypted server backups (database and photos). We have signed its data processing agreement (DPA) with standard contractual clauses.

International transfers

Some providers (Google, and Cloudflare where involved) may process data outside the European Economic Area, for example in the US. The encrypted backups are kept at Backblaze (US East region, USA), which is a transfer to the US. In every case GDPR safeguards apply: the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep data

• Account, visits, photos, points and follows: as long as you keep the account. Deleting it erases them immediately (see “Delete account”).
• Backups: on our own server, 14 days; the encrypted off-site backups (daily, weekly and monthly, at Backblaze), up to 12 months. A deleted item can persist in them for up to that period; they are only restored in case of disaster.
• Reports and blocks: as long as the account concerned exists; the moderation notices we send you, as long as your account exists.
• Purchase records the law requires us to keep: for the legal period.

Your rights and how to use them

You can access, rectify and erase your data, object to or restrict its processing, ask for portability and withdraw your consent at any time. You can delete your account from the app (more detail on Delete account).

For any other request email admin@zuritatech.com; we reply within one month at most. If you're not satisfied, you can complain to the Spanish Data Protection Agency, AEPD (aepd.es), or to the authority in your country.

Minimum age and children

Awaystamp's minimum age is 14. If the law of your country requires a higher age (for example, 15 in France or 16 in Germany), that is the one that applies to you. Awaystamp isn't directed at anyone below that age; if you think a minor has given us data, write to us and we'll delete it.

Automated decisions

Points are calculated automatically from your visits. We make no decisions that produce legal effects on you or similarly affect you; photo moderation is done by a person.

Security

Encrypted connections (HTTPS), passwords stored as irreversible hashes, revocable sessions, photos served through signed links that expire and logs without your account content. If a breach affects you, we'll tell you as the law requires.

Changes to this policy

If we make a material change, we'll tell you in the app before it applies. The date above shows the latest revision.