Privacy policy

Who is responsible

The Jarbas team (the defaria project) is the controller of the personal data described here. Contact: beta@jarbas.app.

We are a small team walking this with pilgrims. There is no advertised head office and no ads on this site.

What this policy covers

This website, the beta form, the confirmation email, and the confirmation page.

It does not yet cover an account inside the app, a conversation with Jarbas on the trail, or a digital book. Those do not exist as a public product today.

What we collect

Only what you send in the beta form, plus the technical minimum to run the request:

• Email address
• Optional window for when you expect to walk (free text)
• Preferred language
• Route choice: Central Way, Coastal Way, or not yet decided
• Language of the page when you submitted
• Time of consent and whether you confirmed the email
• Optional UTM values if they are already in the address bar (source, medium, campaign)

What we do not collect

We do not collect your name, payment details, GPS, photos, or a browsing profile.

We do not add analytics, advertising pixels, or social trackers to this site. Your IP address is used in memory to limit repeated submissions (five per minute). It is not stored with your beta record.

Why we use the data

To confirm the address is yours (double opt-in), to keep you on the tester list, and to email you when the beta opens. Selection is not guaranteed.

We do not send marketing newsletters. We do not sell the list.

Legal basis

Consent, Article 6(1)(a) of the GDPR. You tick the box on the form and confirm the email. You may withdraw at any time by writing to beta@jarbas.app. Withdrawal does not affect processing already carried out.

How long we keep it

At most 24 months from collection, or until you ask us to delete it.

If you never confirm the email, we may remove the pending record sooner. After deletion, copies may remain for a short time in encrypted backups.

Who processes the data

We store the list in PostgreSQL with Neon. We send the confirmation email with Resend. The site is hosted by Vercel.

These providers act on our instructions. They are not given the list to market their own products.

Transfers outside the EEA

Vercel, Neon, and Resend may process data in the United States or other countries. Where that happens, we rely on the European Commission’s standard contractual clauses or an equivalent safeguard under Article 46 GDPR.

Cookies

This site does not set advertising or analytics cookies. The beta form does not use a tracking cookie: the second step uses a short-lived session token returned by the server.

The host may set a strictly necessary cookie to operate the site. There is no cookie banner because we do not use optional cookies.

Your rights

You may ask to access, correct, delete, or restrict your data, or to receive a copy (portability), as far as the GDPR allows. You may also object and withdraw consent.

Write to beta@jarbas.app. You may lodge a complaint with the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt, or with the authority of your country of residence.

Children

The beta form is for people aged 16 or over. We do not knowingly collect data from younger children. If we learn that we have, we will delete it.

When the app exists

Before the app collects an account, a conversation, a plan, photos you add, or location for geofences (not turn-by-turn GPS), we will publish an updated policy and ask for consent where the law requires it.

Jarbas is not a map and does not replace emergency services. Location, if it comes, will exist to notice a stage or a place — not to follow every step.

Changes

If we change this policy in a material way, we will update the date on this page. If you are on the beta list, we will also email you.

If the Portuguese and other language versions diverge, the Portuguese text prevails.