This preview describes the app and its selected account-retention policy. Before public launch, the operator must complete its legal identity and address, implement and verify the retention schedule, and confirm provider retention limits, agreements and international-transfer safeguards.
Who is responsible?
The owner and operator of Easygoing is responsible for the service and acts as the data controller for the processing described in this notice. The owner determines why and how personal data is used, sets and documents necessary retention periods, and is responsible for reviewing and enforcing them, including deletion by contracted service providers. Easygoing is the service name; the controller’s legal name and postal address still need to be added. Contact: [email protected].
What we process and why
Account data includes your email and account identifier, and profile information supplied through Google if you choose Google sign-in. Saved journeys and preferences are stored when you use those features. Search locations, travel dates and times are processed to calculate routes and forecasts. Technical request data and error information support security and troubleshooting.
The intended basis for requested account and planning features is performance of the service contract (GDPR Article 6(1)(b)). Necessary security processing may rely on legitimate interests (Article 6(1)(f)), subject to a documented balancing assessment. Any optional marketing or non-essential tracking requires a separate legal basis and, where required, separate freely given consent. This notice does not request that consent.
Service providers and data transfers
Supabase supports authentication and database storage. Resend delivers sign-in emails and processes the email address and delivery information needed for that service. Google processes sign-in information if you choose it. Route, location and weather requests may be processed by NS, PDOK, Open-Meteo and MET Norway, depending on the feature and provider availability. Their roles, hosting locations and applicable contracts must be verified before launch. If data leaves the EEA, a valid transfer mechanism and any necessary additional safeguards must be confirmed; EU-only hosting is not promised here.
Privacy & Security
Sensitive keys stay on the server
Private API credentials and administrator service keys are used on the server and are not included in the website delivered to your browser. The website uses a public connection key; this key does not grant access to another traveller’s private records. Easygoing does not currently collect payment details or sell tickets.
Encryption in transit
Registration, sign-in and account requests to our authentication and database services use HTTPS with TLS encryption. This protects those requests while they travel between your browser and the service. HTTPS for the public website must also be verified before launch; the local development preview runs over HTTP.
Access to your records
Database access rules link profiles and saved journeys to their account owner. Signed-in travellers can read and change their own records, and guests cannot access these private records. Administrative access is checked separately on the server and is restricted to authorised roles.
Storage and retention
The EU General Data Protection Regulation (GDPR, called the AVG in the Netherlands) requires personal data to be kept only as long as necessary for its purpose. It does not set one universal retention period for all account data. The periods below are Easygoing’s policy choices, not fixed periods prescribed by the GDPR.
| Stage | Period and action |
|---|---|
| While you use your account | We retain the account information and preferences needed to provide your account features. You can remove saved journeys in the app or request account deletion at any time. |
| 12 months without use | After 12 consecutive months without signed-in use, your account is deactivated. We send a notification to your registered email address. |
| 90-day reactivation period | Your account data is retained for 90 days from the notification so you can reactivate your account. If it is not reactivated within that period, the account, profile, preferences and saved journeys are deleted from active systems. |
| Deletion at your request | Email [email protected] at any time, before or after inactivity. You do not have to wait 12 months or the additional 90 days. We assess and carry out valid erasure requests without undue delay and respond within the GDPR deadline, normally one calendar month. |
Preview status: Scheduled account deactivation, notification and deletion still require implementation and verification. The schedule above is not yet a verified automatic feature.
Searches and sessions. Unsaved search locations and travel times are processed to provide results; the app does not create a permanent personal search history. Saved journeys follow the account schedule above. Browser session information supports staying signed in and is removed locally when you sign out; signing out does not delete your account.
Logs and backups. The owner must separately document and enforce the shortest necessary periods for operational and security logs, sign-in email delivery records and provider backups. Their exact limits and deletion behaviour have not yet been verified for this preview. Backup copies must be restricted to recovery, expire on a documented schedule, and have earlier deletions reapplied if restored. No fixed backup-erasure deadline is promised until the provider settings and contracts have been verified.
Limited exceptions. If a specific Dutch or EU legal obligation or a necessary legal claim requires longer retention, only the relevant records may be retained, with restricted access and a documented reason and end date or review criterion. The owner must delete or irreversibly anonymise them when that need ends. These exceptions do not justify keeping an entire account indefinitely.
Official guidance: Autoriteit Persoonsgegevens: retaining personal data (updated 30 December 2024) and the EDPB Data Protection Guide for Small Business (launched in 2023).
Your choices and privacy rights
Searching does not require an account. You can delete saved journeys in the app. To request access, correction, account deletion, restriction, portability where applicable, or object to processing based on legitimate interests, contact the address above. If consent is used, you may withdraw it without affecting earlier lawful processing. Only proportionate identity checks should be requested. GDPR requests are generally due a response within one month; a justified extension must be communicated within that month.
You may complain to the Dutch Autoriteit Persoonsgegevens or the competent supervisory authority where you live or work. Journey recommendations do not make a legal or similarly significant decision about you.
Changes to this notice
We will update this notice when processing changes and provide additional notice where required. Its date and draft status are shown above.