Privacy Policy
Your privacy is important to us, and we collect as little personal data as possible. You can browse the app without giving us any personal information. We only collect personal data when you submit a reservation request or choose to create an optional account, as explained below.
To keep the app stable and improve it, we use third-party tools that collect usage and diagnostic data such as screens viewed, button taps, session length, crash reports, device model and operating system version. Some features also check which navigation applications are installed on your device so that we can offer them to you; this check happens on your device and the result is not sent to us.
We do not sell your personal data, we do not use it for advertising, and we do not carry out automated decision-making or profiling.
Japodium is an independently run app, operated by its owners and based in Bosnia and Herzegovina. The owners of the app are the data controller responsible for the personal data described in this policy. For any privacy question or request — including a request for the controller's full identity and contact details — reach us at info@japodium.com.
When you use our reservation feature to request guided sport and recreational services (such as rafting tours, guided city tours, quad riding, etc.) from independent local tourist and extreme sport agencies, we collect:
Note that Sign in with Apple does not provide a profile photo, and if you use Apple's "Hide My Email" feature we receive only a relay address rather than your real email address.
We use your personal information only to:
What you submit in the app is a reservation request, not a completed booking. It appears in the app as "Pending" until our administrator reviews it and the details are agreed between you and the third-party provider, at which point it appears as "Confirmed". Confirmation means the provider has agreed the details with you; it does not make Japodium a party to the activity itself.
If you are in the European Economic Area, we rely on the following legal bases under the General Data Protection Regulation (GDPR):
Before you submit a reservation request or update your account information, you must tick a box confirming that you have read this Privacy Policy and our Terms of Service. That tick records that you have been informed; it is not the legal basis for handling your reservation, which rests on the grounds set out above.
Important: We act solely as an intermediary booking platform. Your contact details are shared with the independent third-party service provider you choose to book with. Once we pass your details on, that provider becomes an independent controller responsible for your personal data under its own privacy practices. We do not provide any recreational services ourselves.
We use the following processors, who handle personal data only on our instructions:
You can optionally create a free account by signing in with your existing Google or Apple account. An account is not required to make reservation requests — it simply lets you create and manage your requests more easily.
What we store: When you sign in, we create a profile in our content management system (Strapi, hosted on Render) using information from your Google or Apple account, such as your email address and, where available, your profile photo. In the "Account" tab you can add or update your first and last name, phone number, and email address at any time.
Pre-filled requests: If you are signed in, your saved contact details are filled in automatically. Since a request cannot be submitted without a full name, email address, and phone number, any missing details you enter in the form are also saved to your account, so you don't have to enter them again.
Continuing as a guest: You can always submit a request without an account by choosing "Proceed as guest." In that case we create no account profile and store no database record of you — but see "Data Security and Retention" below, because a copy still exists in the confirmation emails.
Your reservations: When you submit a request while signed in, your requests and their details (including your contact information and current status) appear in the "Reservations" tab. You can cancel any upcoming reservation at any time. A record of cancelled reservations remains stored in our database, linked to your account, unless you delete your account.
Editing or deleting your account: You can edit your personal data or permanently delete your account at any time in the "Account" tab. You may also request deletion by emailing info@japodium.com.
Guest requests: We do not store your details in our database. However, the request is emailed to you and to our administrator, so a copy exists in our mailbox and, for a short period, in Mailgun's sending logs. We delete administrator mailbox copies after 12 months, or sooner on request.
Account requests: If you are signed in, your profile and reservation records are stored in our content management system (Strapi, hosted on Render) until you delete them or your account. Deletion removes the data from the live database immediately; residual copies in encrypted backups are purged within 90 days.
Security: All data is encrypted in transit using TLS, and access to our content management system is restricted to authorised administrators.
We use Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring. These collect usage and diagnostic data together with identifiers such as an app instance ID, device model, operating system version and IP address, as well as statistics about reservations (date, number of participants, provider name). This data is pseudonymous rather than fully anonymous — it is not linked to your name, but it is not completely anonymous either, so we treat it as personal data. You can withdraw your consent to analytics at any time by contacting us at info@japodium.com.
Some of our processors are based outside the European Economic Area, mainly in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or, where applicable, an adequacy decision such as the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply.
If you are in the European Economic Area, you have the right to request access to your personal data, and to its rectification, erasure, restriction of processing, or portability. You may also object to processing based on our legitimate interests, and withdraw any consent you have given at any time.
If you have an account, you can exercise most of these rights directly in the "Account" tab, where you can view, correct and permanently delete your data. Otherwise, email us at info@japodium.com and we will respond within one month. If you submitted a request as a guest, we hold no database record, but we can delete the copy held in our mailbox on request.
You also have the right to lodge a complaint with your local data protection supervisory authority. In Bosnia and Herzegovina this is the Personal Data Protection Agency (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini). If you have concerns about how a service provider handles your data after a booking, please contact them directly.
The app is rated 4+ and can be downloaded and browsed by anyone. We do not knowingly collect personal data from children, and the app is not directed at them. If you are a minor, a parent or guardian should submit any reservation request on your behalf and agree the arrangements with the service provider. If you believe a child has provided us with personal data, contact us and we will delete it.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and inform you without undue delay where we are required to do so.
We may update this policy from time to time. The date below shows when it was last changed, and if we make a significant change we will notify you in the app before it takes effect.
If you have any questions or concerns regarding privacy, feel free to contact us via info@japodium.com.
Last updated: 25 September 2026