Privacy

The short version: no ads, no trackers, no analytics, no selling of anything about you. We collect the minimum a traveling story needs, and this page lists all of it.

Cookies — exactly two, both functional

• dunio_session — keeps you signed in after you log in. Lives 90 days. Set only when you sign in.
• dunio_lang — remembers the language you clicked. Lives 1 year. Set only when you pick one.

Neither tracks you, which is why there is no cookie banner: the law only requires consent for cookies that do more than provide what you asked for.

If you write a chapter

• Your chapter is public, forever, by design — the publish button says so before you press it. Sign it with your name, an alias, or nothing.
• Locations are coarse on purpose: chapters say "Lisbon", never coordinates. We never read your GPS.
• An email is optional. If you leave one it is never shown to anyone — it exists only to send you the journey updates you asked for, and a private link that lets you edit or delete your own chapter at any time.
• Deleting a chapter leaves a dated marker ("removed by its writer") and erases your text, name and email for good.
• Public chapters may be featured on dunio.world. For anything beyond our own site involving a recognizable face, we ask you first, by email.

If you follow a card

• One email address per card, used only for that card's updates. Every email contains an unsubscribe link that works instantly.

If you make an account

• A username, an optional email (verified if you use a sign-in link), and — if you choose a password — a salted hash of it, never the password itself.
• Google or Apple sign-in shares only your basic profile (name, email) with us; we verify their signature and store no tokens.

If you buy a card

• Payment happens on Stripe; we never see or store card numbers.
• We keep the order (amount, your account, your email) and the shipping address you enter — used to mail you your card, then kept only as long as bookkeeping requires.
• When a card comes home through our relay, we ask for a delivery address at that moment, use it once, and delete it.

Who processes data for us

• Cloudflare — hosts the site and stores its data (EU jurisdiction for our storage).
• Stripe — payments.
• Postmark — delivers our emails.
• Google — turns typed place names into map points, server-side only; no Google code ever runs in your browser here.

Your rights

Access, correction, deletion, portability — the full GDPR set. Chapters and follows are self-service (the links in your emails); for anything else, one message to hello@dunio.world and a human answers. Nothing here is automated decision-making, and nothing is profiled.