Privacy Policy
Albania Insider · Last updated 10 November 2026
This policy explains what personal data Albania Insider collects, why, who it is shared with, and the rights you have. We collect as little as we can: you can use most of the app without an account.
Who is responsible for your data
The data controller is ehoxha, tirana. You can reach us at support@landofeagles.app for anything about your data.
What we collect and why
| Data | When | Why |
|---|---|---|
| Email address, username and password (we store only a secure hash of the password, never the password itself) | When you create an account | To create and secure your account, let you sign in, and send you a code if you forget your password |
| Things you save or create: favorite places, trips and itineraries, reviews, price and trail reports, saved phrases, downloaded packs, achievements and points, posts you report and people you block | When you use those features while signed in | To keep them in your account and show them on any device you sign in to. Reviews and reports you post are shown to other users with your username. Reports about posts are reviewed by us to remove content that breaks our rules. |
| ATM fee and border wait reports (the fee or wait time, the ATM or crossing, and the time) | When you report what an ATM charged or how long a border crossing took | To show other travellers typical fees and waits. Others only see totals and medians, never your username. Reports are linked to your account so one person cannot flood the numbers. |
| Your device's location | Only if you allow it, while you use the map, Discover, Emergency, ATM or "Ask an Insider" screens | To show places, ATMs, experiences and emergency services near you, and to rank answers by distance. Your location is sent with the request and is not stored. |
| Photos you take or choose of a receipt, menu or sign | Only when you use the receipt check or the menu and sign translator, after you agree to send the photo for AI processing. The app asks for camera or photo library access at that moment. | To read the text with OpenAI and compare prices with typical local prices, or translate it. We do not keep the photo. For the receipt check we keep the items and amounts that were read (with card-like numbers removed) and the result, linked to your account. For translations we keep nothing beyond a short-lived cached result. |
| Questions you ask "Ask an Insider" and the answers | When you ask a question, after you agree to send it for AI processing | To answer from the app's published travel information using OpenAI, to count your free questions, and to check answer quality. OpenAI receives your question and the matching travel information, not your email, username or location. |
| Trip preferences you enter in the AI Trip Planner (destination regions, days, budget, travel style and interests) | Only when you ask the AI Trip Planner to generate an itinerary and after you consent on the AI data-sharing screen | To generate your custom Albania itinerary using OpenAI. Your email and username are not sent to OpenAI. |
| Shared trips, travel companions and calendar export | When you share a trip, add a companion or export a trip to your calendar | Sharing creates a link that anyone who has it can open to see the trip's name, description, dates and plan, without your username or email; you can stop sharing at any time. To add a companion you enter the email of their Albania Insider account; companions can see and edit the trip and see each other's usernames. Calendar export creates a calendar file of the trip's plan. |
| Referral codes | When you view your code or redeem someone else's | To give both accounts the free days the offer promises. We record which account referred which. |
| Partner link clicks | When you open a partner offer (such as an eSIM or car rental) from the app | To count which offers are used, so we can be paid by the partner. We record the link, the time and your account if you are signed in. What you do on the partner's site is covered by their privacy policy. |
| Purchase history and entitlement records (product ID, store transaction ID, start and expiry dates) | When you buy or restore a Trip Pass or Lifetime access | To unlock paid features on your account across devices and honour refunds. Apple processes your payment details; we never see your card or bank details. |
| Push notification token, the app's language and your alert choices | Only if you allow notifications on your device | To send trip reminders, saved bus and ferry route updates, and weather, earthquake and wildfire alerts that you opt into, in your language. Alerts about weather and wildfires use the places in your trips, not your device's location. You can turn notifications off at any time in Settings. |
| Password reset and email verification codes | When you verify your email or ask to reset your password | To check it's really you. Codes expire after 15–30 minutes. |
| Technical data such as your IP address, crash reports, a record of AI requests (feature, size and cost) and first-party funnel events (onboarding, paywall view, purchase and restore steps) | When the app talks to our servers or encounters an unexpected error | To run the service, limit abuse (for example, too many sign-in attempts or AI requests), stay within our AI budget, diagnose crashes, and understand whether the purchase and restore flow works smoothly |
When you use the SOS button, the app opens your phone's dialler or share menu. Your location goes only to the person or app you choose; it is not sent to us.
We do not access your contacts, show ads, sell your data, or track you across other apps and websites. We use the camera and photo library only for the photo tools above, and only when you start them.
Data stored on your device
The app keeps your sign-in session in your phone's secure storage (Keychain on iPhone, Keystore on Android) so you stay signed in, downloaded offline region packs and map areas (places, phrases, transport and emergency contacts in a local SQLite database, plus map tiles), and settings such as your language, your AI and photo consent choices and whether you've seen the introduction. Signing out or deleting the app removes them.
Legal bases
- Contract: to provide your account, purchases and the features you use, including shared trips, companions and referral rewards.
- Consent: for your location, push notifications, camera and photo access, and sending photos, questions or trip preferences to OpenAI. You can withdraw consent at any time.
- Legitimate interests: to keep the service secure, prevent abuse, keep AI costs under control, measure partner offers and fix problems.
- Legal obligation: where the law requires us to keep or share information (such as tax and accounting records for purchases).
Who we share data with
We share data only with service providers who process it for us under contract, and only as needed:
- Hosting, database and file storage providers, which run our servers and serve the offline map packs.
- An email provider, which delivers verification and password reset emails.
- Apple (App Store) and RevenueCat, which process in-app purchases, verify receipts with your user ID and let you restore purchases across devices.
- OpenAI, which receives only what you send with your consent: photos for the receipt check and the menu and sign translator, your "Ask an Insider" questions with the matching travel information, and your AI Trip Planner preferences. OpenAI does not receive your email, username or location and does not use API submissions to train its models.
- Expo (Push Notification service) and Apple Push Notification service (APNs), which deliver push notifications to your device token if you enable them.
- Sentry, which receives crash and error diagnostics (stack traces and device/OS version, without your password or payment details) so we can fix bugs quickly.
- OpenFreeMap, which provides the online map. Your phone loads map tiles directly from it, so it sees your IP address and the map area you view, under its own privacy policy. Offline map packs come from our own file storage.
We may disclose data if the law requires it, or to protect the rights and safety of our users or others.
Transfers outside Albania and the EU
Some providers may process data in other countries. When that happens we rely on safeguards the law recognises, such as the European Commission's standard contractual clauses.
How long we keep data
- Account data and everything linked to it, including receipt results, "Ask an Insider" questions, reports, shared trips and referral records: until you delete your account. Deletion is immediate in our live database; copies in backups are removed within 30 days.
- Records of AI requests, funnel events and partner link clicks: when you delete your account they stay only as anonymous counts, no longer linked to you.
- Cached AI results: removed automatically when they expire.
- Password reset codes: they expire after 15 minutes.
- Server and error logs: up to 30 days.
Your rights
Under Albania's personal data protection law (Law No. 124/2024) and, where it applies, the EU General Data Protection Regulation, you can ask us to:
- give you a copy of your data, or send it to you in a portable format;
- correct data that is wrong;
- delete your data (you can also delete your account yourself in the app);
- restrict or object to how we use it;
- withdraw consent at any time, without affecting what was done before.
Email support@landofeagles.app from the address on your account. We reply within one month. You can also complain to Albania's Information and Data Protection Commissioner (idp.al) or to the data protection authority in the EU country where you live.
Children
Albania Insider is not meant for anyone under 16, and we don't knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
Security
Connections to our servers are encrypted, passwords are stored only as secure hashes, and sign-in attempts are rate limited. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach when the law requires it.
Changes to this policy
When we change this policy we update the date at the top. If a change is significant, we will tell you in the app before it applies.