Privacy

This is a translation for convenience; the Romanian version prevails.

In short: an account is optional. Without an account, your preferences stay on your phone. With an account, we keep them on the server so you have them on any device, until you delete the account. We don't use ads or tracking tools, and you can delete everything at any time.

Updated on 29 October 2026.

Who is responsible for the data

The controller is IDEAL GENIUS ADVANCE SRL, CUI (tax ID) 37213946, J40/3407/2017, Bucharest, Romania. WhereTo is a Purceas product. Contact for any question about data: contact@purceas.com.

What data we use and why

Data	Where it is kept	Why	Legal basis
Your preferences (what you like, what you avoid, budget, starting area, the names you give), saved places and what the app "learns" from your choices	Only on your device (localStorage)	To suggest options that suit you	The service you request
Your approximate location, only if you share it	Nowhere: it is rounded to ~100 m and used once for the calculation	Distances and travel times	Consent (the browser permission)
The account, only if you create one: display name (optional), passkeys (the public key, not your fingerprint or face), sessions (device type), preferences, saved items and collections, your plans, reminders and notifications, the browser's notification subscription, what you share with your partner	On the server, until you delete the account. Exceptions: sign-in codes expire after 10 minutes; closed sessions are deleted after 30 days, read notifications after 180, finished reminders after 90	Sync across devices, reminders at the time you choose, planning as a couple	The service you request
Your email address, only if you add and confirm it (in Settings or by signing in with an email link)	On the server, until you remove it in Settings or delete the account. An unconfirmed address is not kept: the confirmation link expires after 24 hours and sign-in links after 15 minutes	Sign-in links and the reminders you choose to get by email. No marketing	The service you request
Plans saved without an account, and votes	On our server, 30 days	So your partner can see the plan and vote from the link they receive	The service you request
Invitations for your partner (preferences sent by link)	On the server, 7 days	So your partner can fill them in from another phone	The service you request
Reports of wrong information (the type and your note)	On the server, as long as needed for the correction; the link to your browser is deleted after 90 days	Correcting the data and limiting abuse	Legitimate interest
Usage statistics (e.g. "recommendations requested", "a plan was saved"), with no personal identifier and without the text of searches	On the server, 13 months	To see what works and what doesn't	Legitimate interest
If you sign in with Google or Facebook: the account identifier at that provider and your first name (it becomes the display name only if you haven't chosen another). We don't ask for or receive your email, friends list or other data, and we don't post anything on your behalf	On the server, until you disconnect the provider in Settings or delete the account	To recognise you the next time you sign in	The service you request
The linked partner	Sees only what you choose in "For the two of us" (preferences, saved items, history — all off by default) and the plans you vote on together	Planning as a couple	The service you request; you can stop it at any time
A random identifier (cookie `wt_anon`), set only when you save a plan or send an invitation, a report or an outcome after an outing	In your browser, 1 year	So you can later delete exactly the rows you created	The service you request

We don't ask for real names, email or phone numbers. We don't send promotional messages; the only reminders are the ones you ask for. We don't sell or rent data, we don't profile you for advertising and we don't use artificial intelligence for recommendations.

Who else receives data

Cloudflare (hosting, database, network and sending emails), as a processor. The data is stored on Cloudflare's infrastructure, in the EU/EEA where available.
Google and Meta (Facebook), only if you choose to sign in with them: they learn that you signed in to WhereTo. We receive from them only the identifier and your first name.
The browser's notification service (Apple, Google, Mozilla or Microsoft), only if you turn notifications on: it receives the text of the reminder, end-to-end encrypted for your device.
MET Norway (weather forecast): receives only the coordinates of the city or the area, rounded to ~1 km. No data about you.
Wikimedia Commons and Flickr (photos) and OpenFreeMap (map): your browser downloads the images and the map directly from them, so they see your IP address, as with any website. We request them without a "referrer". Photos we receive from venues are hosted by us.
openrouteservice (HeiGIT), if enabled: receives the start and end coordinates of a route, with no other data.
When you tap "Book", "Tickets" or "Directions", you go to the website of the venue or the organizer, or to the map, which have their own policies.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. The quickest way: with an account, My account → Settings has "Download my data" (portability) and "Delete account"; without an account, Preferences → Delete everything deletes from the server the plans, invitations, votes and feedback linked to your browser and clears the data on your device. For any other request, write to contact@purceas.com; we reply within 30 days at most. You can file a complaint with ANSPDCP (the Romanian data protection authority).

Deleting data received from Facebook

If you signed in with Facebook, you can remove the link in My account → Settings → Linked accounts or delete the whole account in Settings → Delete account. If you remove WhereTo in your Facebook settings (Apps and websites), Facebook notifies us automatically and we delete the identifier we received; if that was the only way to sign in to the account, we delete the account too.

Children

WhereTo is meant for adults. We don't knowingly collect data about children.

Changes

If we change anything important, we update the date above and say so on the home page.