Privacy Policy

Last updated: 29 July 2026 · Roots & Routes · Erasmus+ KA210-YOU-6B6F91F9

1. Who we are

Roots & Routes is a Small-scale Partnership project under Erasmus+ (Agreement No 2025-1-ES02-KA210-YOU-000349717). The platform is co-developed by three partners:

• Asociación La Añada Europea (Spain, Coordinator) — OID E10039348
• Remény Horgonya Szociális Segítő Egyesület (Hungary) — OID E10306840
• EuroLinks — Avrupa'da Eğitim Öğretim ve Bilgi Paylaşım Ağı Derneği (Türkiye) — OID E10344398, technical maintainer of the platform

2. What data we collect — and when

2.1 Anonymous visitors

If you use the platform without signing in, we collect nothing personal. You can still add a heritage point, an initiative or a route — those contributions are stored publicly but without any identifier tying them to you.

2.2 Signed-in users (Google Sign-In)

If you sign in with Google, the following fields are saved to the Firestore rr_users collection under your unique Google user ID:

• email — the email address of the Google account you signed in with
• displayName — the name Google returned
• photoURL — a URL Google publishes for your avatar (image is not copied to our servers)
• createdAt, lastSeenAt — timestamps
• consentAcceptedAt — the moment you accepted this policy

Every contribution you post while signed in also stores your Google user ID in a createdBy field, so you can find and manage your own contributions.

2.3 What we do NOT collect

• We do not use analytics or advertising trackers.
• We do not store any Google authentication tokens on our servers.
• We do not sell or share your data with third parties.
• The Result 2 mobile app "Heritage Diary" entries are stored only on your device (IndexedDB); they never leave the phone.

3. Where the data lives

Public contributions and profile records are stored in Google Cloud Firestore (region: europe-west3, Frankfurt, Germany). Firebase Authentication is provided by Google Ireland Ltd. All communication uses HTTPS (TLS 1.2+).

4. How long we keep it

• Profile record — for the lifetime of your account. You can delete it any time from the Privacy tab.
• Contributions — for the lifetime of the project result. They stay available as open educational resources under CC BY-NC-SA 4.0 unless you delete them.
• Deletion requests — after processing, requests are retained for 12 months for audit, then permanently erased.

5. Your rights under GDPR

You have the right to:

• Access — view every piece of data we have about you (Profile tab)
• Rectification — Google Sign-In pulls fresh data on every login; just update your Google profile.
• Erasure ("right to be forgotten") — delete individual contributions (Contributions tab) or your entire profile (Privacy tab). You can also file a formal deletion request that includes your posted content.
• Data portability — email us to request a JSON export of your data.
• Withdraw consent — sign out and use the platform anonymously.

6. Contact

Data controller: EuroLinks — Avrupa'da Eğitim Öğretim ve Bilgi Paylaşım Ağı Derneği · Küçükbostancı Mah. Küçükbostancı Sk. No:14 B,C,E Bloklar, Altıeylül / Balıkesir, Türkiye · eurolinks.org

You have the right to lodge a complaint with your national data protection authority.

7. Cookies / local storage

We use browser localStorage only for:

• Remembering your language choice (rr_lang)
• Storing PWA install dismissal state (Result 2 only)
• Gamified training progress on Result 2 (points, badges — device-only)

No third-party cookies are set.

8. Content licence

All open content published on Roots & Routes (training modules, seed heritage points, sample routes) is licensed under Creative Commons CC BY-NC-SA 4.0. User contributions inherit the same licence at posting time.

Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.