Privacy Policy

1. Who is the data controller

• Data controller: Alberto Méndez Cabrera.
• Trade name: BetaZetaDev.
• Project: Pocket Coruña.
• Location: A Coruña, Galicia, Spain.
• Email for privacy matters and exercising your rights: hi@pocketcoruna.com
• Website: pocketcoruna.com

This policy applies to the following services, which together we call “Pocket Coruña”:

• The Pocket Coruña mobile app for Android (Google Play) and iOS (App Store).
• The website https://pocketcoruna.com, in all its language versions.
• The events section, published at https://pocketcoruna.com/es/eventos/, its detail pages and its versions in other languages, which can also be reached through the domain https://corunaeventos.com, which only redirects to that address.

The owner’s details also appear in the Legal Notice.

2. Summary

3. What Pocket Coruña is

Pocket Coruña is a practical guide to A Coruña. It lets you discover places and routes, check events and activities, find mobility options (urban buses, BiciCoruña and taxis), see weather information and, if you wish, receive rain alerts.

The tourist content (places, routes, tips and photographs) and the base map are included in the app itself, and the map works offline. Bus times, BiciCoruña availability, events and the weather require an Internet connection.

4. Data processed by the mobile app

This section describes how the Android and iOS app currently works. If a later version changes this processing, we will update this policy.

4.1. Usage statistics (Google Analytics for Firebase), only with your consent

If you accept, the app uses Google Analytics for Firebase, a Google service, to obtain usage statistics, find out which features are used and improve the app. We do not use these statistics to show advertising, and Pocket Coruña does not show advertising.

• It is voluntary. The first time you use the app, we ask whether you want to share usage statistics. You can accept or reject just as easily, and rejecting does not prevent you from using any feature.
• It is disabled until you accept. If you reject or close the request without answering, statistics remain disabled. The request is not shown again on its own.
• You can change your mind at any time in Settings → Privacy → Share usage statistics. When you reject or withdraw it, the app stops collecting statistics, deletes the Analytics data stored on the device and resets its identifier. Withdrawing it does not automatically delete data that Google has already received, which is retained as described in section 11.
• No advertising purposes. Even if you accept, storage for advertising purposes, the use of data for advertising and ad personalisation remain denied.

If you accept, the following is recorded:

• Usage data: general app events (for example, the first opening or sessions), the screens visited and some actions within the app, such as selecting places and routes from the catalogue, identified by their content code.
• Technical data: device model and operating system, app version, language and the country or region that Google derives from the IP address.
• Technical identifiers: the app instance identifier and the Firebase installation identifier, both randomly generated, and, on Android, the installation source from Google Play. The app does not access the Android advertising ID or Apple’s advertising identifier (IDFA).

We do not send your name, email, phone number, the texts you type or your GPS location to Analytics, and we do not assign our own user identifiers. Until you accept, the app does not send usage statistics; Google’s SDK may only transmit technical signals about the consent status, without the Analytics instance identifier.

The service is provided by Google: you can consult its Privacy Policy and the information on privacy in Firebase. International transfers are explained in section 10.

4.2. Location

The app requests access to your location only while you are using it: it does not declare or request background location. Permission is requested when you use a feature that needs to know your position, for example the button to locate yourself on the map, “Near me” in Discover or BiciCoruña, location in Bus or Taxi, or “Use my location” in “How to get there”. If you had already granted permission, the app reads your position when it opens in order to show distances.

Your position is used to:

• Show nearby places and calculate distances.
• Find the nearest bus stops, BiciCoruña stations and taxi ranks.
• Centre the map and show your position.
• Estimate walking, bus or bike options in “How to get there”.

All of this is calculated on your device. Your location is not sent to our API or to Firebase Analytics. The app only keeps it in memory for a few seconds and does not store a location history on the device. The precision requested is low for most features; the Taxi screen requests the system’s default precision. On Android 12 or later and iOS 14 or later you can grant approximate location only.

Directions in Google Maps or Apple Maps. When you tap a button to open directions in an external maps app, the coordinates travel in the link that is opened:

• When opening the route from “How to get there”, your position as the origin and the destination are sent.
• When opening navigation to a place, a BiciCoruña station or a taxi rank, only the destination coordinates are sent; the maps app then uses its own location.

On iOS, Apple Maps opens and, in all other cases, Google Maps. From that point on, the processing is the responsibility of Google or Apple under their own policies.

If you do not grant permission, you can still browse places, routes, lines, stops, stations, events and the weather; you only lose sorting by proximity and your position on the map. You can withdraw permission at any time in your device settings.

4.3. Rain alerts (Firebase Cloud Messaging)

Rain alerts are disabled by default. The system notification permission is only requested when you turn on “Rain alerts” on the Weather screen, and you can turn them off at any time in the app or by withdrawing the permission in the system settings.

What Google and Apple process.

• To be able to deliver notifications, the Firebase Cloud Messaging SDK generates, when the app opens, a registration token associated with your installation, even if you have not turned on alerts. This is the SDK’s default behaviour.
• On iOS, the app also obtains from the system an Apple Push Notification service (APNs) token, without showing any dialog, and final delivery is carried out by Apple.
• When you turn on alerts, the device subscribes to the common topic coruna_rain, and Google manages that subscription on its servers. When you turn them off, the subscription is cancelled.

What our infrastructure receives.

• The app does not send the token or any device identifier to our servers.
• Alerts are generated by our own automated process, which publishes each alert to the common topic through the Firebase API, without knowing which devices are subscribed.
• Each alert contains only weather information common to A Coruña (time slot, expected precipitation and an episode identifier), not personal data. The text is composed on your device, in its language.

Alerts received are stored on the device (ten at most) until the rain episode ends or you turn off alerts.

Rain alerts are independent of usage statistics: they work the same if you reject or withdraw your consent for Analytics. As there are no user accounts, Pocket Coruña does not keep a database of subscribed devices.

4.4. Data stored on your device

The app stores information in your device’s local storage (SQLite database, system preferences and caches). Pocket Coruña has no accounts, no synchronisation and no backups of its own for this data, and our server does not receive your favourites or your search history.

The app does not store the language you choose within it. The Firebase SDKs also store their own identifiers on the device: the installation identifier and the messaging token and, only if you accept statistics, the Analytics instance identifier.

System backups. The app does not exclude its data from the operating system’s backups. Therefore, depending on your settings, the Android (Google) backup or the iCloud or computer (Apple) backup may include local data such as your favourites, your search history or your preferences, including your decision on usage statistics, which the app applies again when restored. These backups are managed by Google or Apple in your account, under their terms; Pocket Coruña has no access to them.

4.5. Connections to external services

To show up-to-date information, the app connects directly to these services:

Our API obtains bus, BiciCoruña and event data from their sources and returns it to you, so those sources do not receive your requests. Data on lines, stops, stations, weather and events is public information, not personal data. The base map is included in the app and does not make requests to map servers.

4.6. In-app event viewer

The details of each event are shown in an integrated web viewer that loads the corresponding page of pocketcoruna.com. This viewer:

• Uses the app’s own web storage (cookies, local storage and cache), separate from your phone’s browser, which is kept until you clear the app’s data or uninstall it.
• Shows the same cookie notice as the website. Your choice in the viewer is independent of the one you make in the browser. Google Analytics only loads in the viewer if you accept it there.
• Also loads event images hosted by third parties, described in section 6.
• Only navigates within pocketcoruna.com. Other links (external websites, phone, email or maps) open outside the app.

The app does not send any device identifier to the viewer.

4.7. Other actions that open external services

Some actions open other apps or websites that you choose to use: calling a taxi service opens the phone app or, if the service offers it, WhatsApp; links to official or event websites open the browser; sharing a place opens the system share menu with the text and image you choose. In these cases, any further processing is the responsibility of those apps or services.

The legal documents and source credits, accessible from the Settings screen and from the consent request, open in the device’s browser.

4.8. What the app does not do

• It has no user accounts, registration or sign-in.
• It has no in-app purchases or subscriptions.
• It does not show advertising or integrate advertising SDKs.
• It does not integrate crash reporting services or analytics tools other than Firebase Analytics, which is only enabled if you accept it.
• It does not access contacts, photos, camera, microphone or calendar.
• It does not request background location.

5. Data processed by the pocketcoruna.com website

5.1. Server and technical logs

The website, the events section and the app’s API are served from our own server hosted on the infrastructure of Akamai Connected Cloud (Linode).

Pocket Coruña’s servers may record technical information about connections, such as IP addresses, access dates and requests made, for operational, security and abuse prevention purposes. These logs are kept for as long as necessary to fulfil those purposes and, where applicable, to meet legal obligations.

5.2. Web analytics (Google Analytics 4), only with your consent

Across the whole website, including the events section and its detail pages, we use Google Analytics 4 only if you accept it, to find out in aggregate how many people visit us, where they come from and what content they view. Google Analytics sets two first-party cookies (_ga and _ga_7C4N3PGT5F) with a random identifier and processes browsing, browser and device data, and an approximate location derived from the IP address.

• It does not load until you accept it. If you reject it or make no choice, the Google Analytics code is not downloaded and its cookies are not set.
• Google Signals and the use of data to personalise ads are disabled in the website’s tag configuration.
• We store your choice for 12 months. You can change or withdraw it at any time from “Cookie settings” in the footer of every page; when you withdraw it, we delete the Google Analytics cookies and stop loading it.

Details are in the Cookie Policy.

5.3. Browser local storage

The website stores in your browser, without sending them to any server, your language, your cookie choice, the last video shown on the home page and a temporary copy of the events calendar so that it keeps working if the connection fails. The calendar also uses a service worker that caches event images and deletes them once the event has passed.

5.4. External resources

The fonts, icons and the website’s own images are served from our own server: the home page and the information pages do not connect to third-party servers except Google Analytics, if you accept it. The events section is the exception, as explained below.

6. Events section and corunaeventos.com

The events section (/eventos/, its detail pages and its versions in other languages) is part of pocketcoruna.com and shares its server and its cookie notice. The domain corunaeventos.com points to our same server and only redirects to https://pocketcoruna.com/es/eventos/. The redirect does not set cookies.

The following are involved in this section:

• The server’s technical logs (section 5.1).
• Google Analytics 4, only if you accept it (section 5.2).
• Your browser’s local storage (section 5.3).
• Event images, which in many cases are loaded directly from the servers where they are published by the Ayuntamiento de A Coruña, the organisers or their image providers. These servers receive your IP address and the technical data of the connection.
• Event location: the detail pages show the venue and address of the event together with a link to open it in Google Maps. No map or Google resource is loaded on the page; Google only receives data if you tap that link.

The detail pages that the app opens in its in-app viewer are these same pages (see section 4.6).

7. Communications with you

The email address hi@pocketcoruna.com is a contact and support channel. When a person contacts Pocket Coruña by email, the data provided is used exclusively to handle and manage their query, request or issue. There are no user accounts, and we do not use email addresses to build profiles or to send commercial communications.

Communications are kept for as long as necessary to handle them and, afterwards, for the periods that may be necessary to comply with legal obligations or to deal with possible liabilities.

If you write to us through our Instagram account, the messages are also processed by Meta under its own privacy policy.

8. Purposes and legal bases

This table summarises the purposes and legal bases, under Article 6 of the General Data Protection Regulation (GDPR), of the processing carried out by the website and the app. For storing or accessing information on your device, Article 22.2 of Spanish Law 34/2002 on Information Society Services (LSSI-CE) also applies.

Withdrawing your consent does not affect the lawfulness of prior processing. Consent for usage statistics only refers to Analytics: rain alerts and the other features do not depend on it. Where processing is based on legitimate interest, you can object to it by writing to us (see section 13).

9. Providers and recipients

We do not sell your data or share it with third parties for commercial purposes. The following providers and services are involved:

In addition, the following act as independent controllers, under their own policies:

• Google Maps and Apple Maps, when you open directions from the app (section 4.2) or an event’s location from the website.
• The servers hosting event images, which receive technical connection data.
• The services you open from the app or the website (phone, WhatsApp, external websites, Instagram).
• Google and Apple with regard to any system backups you have enabled.

Other sources, such as the Ayuntamiento de A Coruña, BiciCoruña, the urban bus service or OpenStreetMap, only provide us with public information and do not receive any of your data as a result of your use of Pocket Coruña. We may also disclose data to authorities, judges and courts where there is a legal obligation to do so.

10. International transfers

Some providers may process data outside the European Economic Area, in particular in the United States:

• Google (Firebase and Google Analytics): Google LLC declares its participation in the EU-U.S. Data Privacy Framework, recognised by the European Commission’s adequacy decision of 10 July 2023.
• Akamai Technologies (hosting): Akamai Technologies, Inc. declares its participation in the same EU-U.S. Data Privacy Framework.
• Apple (notifications on iOS): according to its privacy policy, transfers of data from the European Economic Area are governed by standard contractual clauses.

You can consult the official list of participating organisations at dataprivacyframework.gov.

11. Data retention and deletion

Retention of Google Analytics data. Pocket Coruña uses Google Analytics to obtain statistics on the use of its services, with two independent properties: one for the mobile app and another for the website. In both, the configured retention period is 2 months for event data and 14 months for user data, within the categories of information subject to Google Analytics retention controls. The configuration resets the user data retention period when new activity is recorded. These periods do not necessarily affect aggregated statistical reports or other technical data that Google may process under its own retention policies.

When you uninstall the app, all the local data described is deleted from the device, including the Firebase identifiers and the event viewer storage. Data already received by Google or Apple is governed by the periods indicated and by their own policies. At the end of the periods, data is deleted or anonymised, unless we must keep it blocked to deal with possible legal liabilities.

12. Security

All communications of the app and the website with our servers and with external services use encrypted connections (HTTPS), and unencrypted requests to the website are redirected to HTTPS. We also minimise data: there are no accounts, location is not sent to our servers and preferences are stored on the device.

No system is completely invulnerable; if we detect a security breach affecting personal data, we will act in accordance with the applicable regulations.

13. Your rights and choices

You can exercise the following rights at any time:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer necessary or you withdraw your consent.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to keep your data without processing it in certain cases.
• Portability: receive, in a structured format, the data you have provided to us, when the processing is based on your consent or a contract and is carried out by automated means.
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise them, write to us at hi@pocketcoruna.com stating which right you wish to exercise. As Pocket Coruña has no accounts, in many cases we will not be able to link data to you; if necessary, we will ask you for the minimum information essential to locate it and verify your identity. We will reply within one month, which may be extended by two further months in complex cases, as provided for in the GDPR.

Controls available to you

• Location: withdraw the permission in your device’s location settings.
• Rain alerts: turn them off on the Weather screen or withdraw the notification permission in the system settings.
• Favourites and search history: delete them from the app, by clearing its data in the system settings or by uninstalling it. Also check your Android or iCloud backups if you have them enabled.
• App usage statistics: give or withdraw your consent in Settings → Privacy → Share usage statistics. As the app has no accounts, we do not have any data that would allow us to link to you the data that Google has already received, so it may not be possible to locate it.
• Website and event viewer cookies: change your choice in “Cookie settings”, in the footer of any page, or delete cookies from your browser. In the app viewer, your choice is managed from the viewer itself.

If you believe that we have not properly handled your rights, you can lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency) (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, Spain, or with the supervisory authority of the European Union Member State in which you habitually reside.

14. Minors

Pocket Coruña offers general information about the city. It has no features specifically aimed at minors and no forms or accounts that collect identifying data.

If you are under 14, you need the consent of your parents or guardians to provide us with personal data, for example when writing to us, in accordance with Article 7 of Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.

15. Cookies and similar technologies

The inventory of cookies and storage used by the website and the event viewer, their purposes, their duration and how to accept, reject or withdraw your consent are set out in the Cookie Policy.

16. Changes to this policy

We will update this policy when Pocket Coruña’s features, the providers we use or the regulations change. We will always publish the current version on this page, with its last updated date. If the change is significant, we will also announce it visibly on the website or in the app.

17. Contact

For any question about this policy or about the processing of your data, write to us at hi@pocketcoruna.com.

See also the Terms of Use, the Legal Notice and the Cookie Policy.