How we handle your data

Who handles the data

The data controller is Matteo Casavecchia.

For any question about this policy, or to exercise the rights described further down, write to camperepoi@tutamail.com.

We have no data protection officer, and we are not required to have one.

If you only read the site

We ask you for nothing, and we ask you to accept nothing.

The server that hosts the site records the requests it receives, as any server does: IP address, time, page requested and browser type. They serve to keep the site running and to notice attacks, they are kept for a short time and they are not used to profile anyone. The legal basis is our legitimate interest in keeping a secure service standing.

Visit statistics are collected with Umami, installed on our own machine: it uses no cookies, it does not follow people from one site to another, and it keeps no data that would let anyone recognise you. Besides the pages read, it counts the steps of signing up: which button people come from, how far they get and how many sign-ups are completed. These are counts, and they carry neither your email address nor your profile.

If you register

To sign in you can use a link sent to your email, or your Google account.

• With the email link we keep your address and the date you opened the link
• With Google we receive your email address and the name you have on Google. We do not receive the password, and the access tokens Google hands us we discard straight away, because after you are in the site asks Google for nothing else

In both cases we keep the language of the page you signed up from: it is the one we write your mails in, if you ask for them. We do not deduce it from anything else, and you change it from your profile.

The name that appears next to your comments is the one you choose, and you can change it whenever you like.

The legal basis is the performance of the service you asked for: without an email there is no way to let you in.

What you save

Inside your personal page you can save favourite places, keep a diary of the places where you have been with a note of your own and your photos, mark the events you want to go to, and put trips together.

The notes are private. They appear on no public page, they end up in no index, and nobody but you reads them. The trips and the events you mark are private too: there is no page on this site that shows somebody else's trip or calendar.

The events you mark with "I'm going" serve two purposes: reminding you of them a few days before, if you want, and asking you afterwards whether you went. If you answer yes, the event becomes a visit in your diary, with its date.

When you open the page for the first time you find it already full of examples, which carry the word "example" and go away on their own as soon as you save something of yours. They are not your data and they are not stored anywhere: they are put together when the page opens, from the places on the site.

The photos in your diary

To each visit in the diary you can add up to three photos. Only you see them.

• They are not public. They appear on no page of the site, they have no address that works for anyone else, and we ask search engines not to look at them
• We remove all the data hidden in the file before keeping it: the GPS position of the shot, the date, the phone model. From the date of the shot we suggest, if you like, the date of the visit, and then we throw it away
• We shrink them to 1600 pixels on the longest side: enough to look at them again, and we do not keep the original
• They sit on the site's server, inside the European Union, and like the rest of the database they end up in the backups we make every night on a disk of our own, in Italy
• They go when you remove them, when you remove the visit or when you delete your profile; they leave the backup the following night, and the older backups when those expire

Your town, the areas and your tastes

You can indicate, if you like, the town you live in, choosing it from the ISTAT list. We keep its code and nothing more precise: it lets us tell you which events are within about a hundred kilometres of home, in the start of the month mail, and suggest the right area. Nobody sees it, and you remove it whenever you like. It is a different piece of data from the starting point of your trips, below: deleting one does not touch the other.

You can also choose the areas you travel in (North, Centre, South and islands, abroad) and what you like (sea, mountains, villages, art cities and so on). They serve to choose the events and places to show you, and we use them for nothing else.

Where you set off from

You can indicate, if you like, the point your trips start from and come back to. It serves one purpose only: to draw the route in full, out and back, instead of having it begin at the first stop.

It is the most sensitive piece of data this site keeps, and this is why we treat it the way we do:

• We do not ask you for an address. You choose a point by tapping a map, and there is no field in which to write a street
• We save the position rounded to about a kilometre, not the exact point. It is not a promise: it is the way the database column is made, and a more precise point does not fit into it even if you tap one
• You choose the name ("Home", the name of your town, whatever you prefer). We do not deduce it from anywhere, and we do not ask any outside service to tell us what place it is: what you tap on the map does not leave this site
• It appears on no public page and no other user sees it
• It goes into the GPX file you download from your trips, because the navigator needs it. The page tells you so before you download it, and you can take the starting point out of the route with a tick
• You remove it whenever you like, with a command that sits next to where you put it, and it goes with your profile

If you also enter the dates of a trip, bear in mind that those two pieces of information together say when you are not at home. They stay inside your profile and we show them to nobody, but it is right that you should know before writing them.

The mails we send you

Besides the link to sign in, the site can send you two mails, only if you ask for them, each with its own consent: you find them switched off, and you turn them on and off from your profile.

• The start of the month mail, on the first of the month: the events in your areas, the weekends and where to sleep. If there is nothing in your areas that month, it does not go out
• The alerts mail: an event you marked is about to start, one of your saved places has the dates of an event, a new place in your areas. At most one a week, and never on the same day as the monthly mail

Resend sends them on our behalf, from the address eventi@camperepoi.it, and at the bottom of each one there is the link to unsubscribe with one click, without signing in. The mails contain no images that tell us whether you opened them; the links carry a label that says which mail they come from, so that the visit statistics can count how many people arrive from the mail, and it does not say who you are.

We keep a record of the consent: when you gave it, when you withdrew it and from where (sign-up, the profile or the link at the bottom of a mail). We keep it because whoever sends a mail to someone must be able to show that the person had asked for it, and a "yes" that gets overwritten would forget exactly that. The record is yours like the rest: it is in the download of your data and it goes with the profile. The legal basis of these two mails is your consent, which you withdraw whenever you like without anything else changing.

Alerts

On your page there is a bell that tells you the same things as the alerts mail, plus one: when a page you saved has been updated. Alerts come from what the site already knows (the dates in the calendar, your saved places, your areas, the events you marked), each kind has its own switch, and nothing reaches the bell that you have not asked for. By email, only if you asked for it.

Reports and comments

Reports and comments go through moderation before they appear. When a comment is approved it becomes public, together with the name you chose; an approved correction enters the site's data when we carry it into the pages. On reports you can ask, with a tick box, that it be said the report is yours: if you do not tick it, the correction goes in without your name.

If you delete your profile, what had already been approved stays with the site but loses your name: a correction made is a correction made, and undoing it would make the information worse for everybody.

If you write to us

The form on the contact page sends an email to a mailbox we read ourselves, and it saves nothing in any database: what you write lives the way a mail message lives, and it is deleted by deleting the message. We ask you for a name and an address, and the address serves one purpose only, answering you.

It goes into no mailing list, we do not use it to send you anything else, and we give it to nobody. The legal basis is our legitimate interest in answering the people who write to us first.

Your location

The "Near me" page asks the browser where you are, and it asks only when you press the button, after explaining why.

Your location does not leave your device. Distances are worked out inside the browser, with the data of the places that are already on the page: nothing reaches the server, and we keep nothing.

On the same page you can also search around a place instead of around you, by writing its name. In that case the word you write reaches us, and it is we who ask OpenStreetMap for the coordinates: your browser talks to nobody else, and what reaches OpenStreetMap is our server's address, not yours. We keep the answers aside so as not to ask the same thing twice, and what that memory holds is the name of the place, not who looked for it.

Who else touches the data

• Hostinger, which hosts the site and the database, on a server located inside the European Union: this data does not leave here
• Resend, which sends the sign-in emails, the start of the month mail and the alerts mail, and the messages you write from the contact form. It is a United States company, so your address leaves the European Union, with the contractual guarantees the European rules provide for
• Google, if you choose to sign in with your Google account

Nobody else. The data is not sold, not exchanged and not handed to anyone who sells advertising.

How long we keep it

• Sign-in session: 30 days, then you have to come back in
• An unused sign-in link: it expires within hours and disappears
• Profile and the data you have saved, including diary, photos, marked events, areas, tastes and town: as long as you want them. When the profile is deleted they go with it
• Record of consents to the mails: as long as the profile exists, and it goes with it
• Alerts: as long as the profile exists. The ones you remove with the cross stay marked as removed, so that they do not come back in front of you
• A sign-up started and not confirmed: one hour, then it disappears
• Backups: every night, on a disk of our own; what you delete leaves the backup of the following night, and the older backups when they expire
• Starting point: as long as you want it. You can remove it at any moment without touching the rest
• Approved reports and comments: they stay, without your name
• Messages sent from the contact form: they stay in the mailbox like any other email, and they go when we delete the message
• Server logs: a few weeks

Your rights

You can ask to see the data concerning you, to correct it, to delete it, to limit its use, to object to the processing, and to receive it in a format another service can read.

Two of these you do not even have to ask for: inside your personal page you will find the download of your data and the deletion of your profile, and they work on their own. The download is a zip archive, containing a file that can be read even without the site, and the photos of your diary.

If you believe your data is handled badly, you can lodge a complaint. The controller is in Italy, so the authority of reference is the Garante per la protezione dei dati personali, www.garanteprivacy.it. But if you live or work in another country of the European Union, you can also turn to that country's authority, or to the one where you think the breach happened: the choice is yours, and the authorities talk to each other.

Who can register

The site is not meant for children under 14, and we do not ask for data from anyone below that age.

When this changes

If this policy changes, the date below changes with it, and important changes we also announce on your personal page.

Last updated: 6 October 2026.