Privacy Policy

Last updated · July 2026

Who we are

Brunskilt (“we”, “us”) is a free tool that helps drivers in Norway discover the country's brown tourist signs. You can reach us at erik+signs@marawaca.com.

What we collect

• Account data. If you sign up, we store your email address, a salted bcrypt hash of your password, and your display name. We never see your raw password.
• Location. The mobile app and web frontend can request your device location so we can show nearby signs. Location data is processed on your device and, when you explicitly submit a rating or tip, attached to that submission. We do not upload a GPS trace or retain a server-side location history; the on-device planned Journey history described below contains route plans and completion summaries, not recorded GPS tracks.
• User-submitted content. Ratings, written comments and tips you post are stored alongside your user ID so you can edit or delete them later.
• Server logs. Standard web-server logs (IP address, user agent, timestamps, URL paths) are retained for up to 30 days for debugging and abuse prevention.

What we do not collect

• We do not use third-party advertising cookies.
• We do not sell or rent personal data.
• We do not track you across other websites.

Cookies & local storage

When you sign in on the web, we store a session token in your browser's localStorage so you don't have to log in again. This is functional, not analytical, and no data is sent to third parties. The mobile app uses Expo Secure Store for the equivalent purpose.

The mobile app also keeps your current Journey and up to 25 completed journeys on this device. This Journey history is scoped to your signed-in account and includes the planned route, completion totals, and passed-sign summary; it is never uploaded as a route or location history. Use Clear history in Passport to remove completed Journey history from the device.

Third-party services

• Plausible Analytics — privacy-friendly, cookieless page-view counting. Only used when enabled by the operator.
• Sentry — error monitoring. Captures JavaScript / backend stack traces when something breaks. Only used when enabled by the operator.
• OpenAI — used for optional audio narration. Our backend may contact OpenAI when route audio is prepared or played. It sends public sign context, never your account or location data.
• Map tiles & imagery — the configured map tile provider and Wikimedia Commons may serve map tiles and sign photographs directly to your browser. We do not proxy this traffic.

Your rights

Under GDPR you have the right to access, correct, export and delete your personal data. You can:

• Delete your account from the app, which removes your user record and, via database cascades, all of your ratings, tips, custom routes and favorites. Use the “Delete account” button on your profile, or DELETE /api/users/me if you prefer the API.
• Request a data export by emailing the contact above. We will respond within 30 days.

Children

Brunskilt is not directed at children under 13. If you believe we have data from a child, email us and we will delete it.

Changes

We may update this policy as the service evolves. Material changes will be highlighted on this page.

← Back to Brunskilt