JERNUN · PRIVACY POLICY

Privacy policy

Jernun (Journey) by Orbitshare · Last updated 2026-10-29

1. Provider and data controller

2. Data we use and why

• Account and authentication: Names, email addresses, phone numbers, account IDs and sign-in information are used to register, sign in, recover passwords and contact you about the service. Account passwords are stored as hashes.
• Google sign-in: If you choose it, we receive identity, email and profile information supplied by Google to authenticate and link your account.
• Location: Used to find nearby places and verify check-ins. Check-in coordinates and accuracy are transmitted and stored with your history to award stamps and detect misuse. Manage location permission in your device settings; denying it may prevent these features from working. The app does not request background location permission.
• Profile and your content: Profile photos, biographies, place photos, reviews, journals, trips and accompanying images are displayed and stored according to the features and settings you choose.
• Usage: Favourites, check-in history, stamps, achievements, XP and settings record progress and support your account.
• Drivers and guides: Service information, areas, vehicles, calendars, portfolios and work records or amounts entered by the account owner support driver/guide features. Published information is separate from private work records.
• Contact and security: Data requests, document acknowledgement history and technical service records help handle requests, verify rights, prevent fraud and resolve problems.

3. Necessity and grounds for processing

We use the information needed to provide the services you request and manage your account. Security and misuse prevention rely on necessary legitimate interests with regard for your rights. We may also process data to fulfil legal obligations. Where an activity requires consent, we request it separately for that activity. Acknowledging this policy is not blanket marketing consent.

4. Disclosure and external services

Reviews, place photos and service information you choose to publish may be visible to other users. Journal and trip visibility depends on your publishing and privacy settings.

Services used by relevant features include Google authentication and OpenStreetMap map imagery. Loading maps sends network requests to the map provider. External websites and map apps have their own providers’ policies.

We use DigitalOcean for servers, databases, images and database backup storage in Singapore (SGP1). Email requests use Google Gmail, which may process information in countries where it operates. Access is limited by role, and we consider appropriate safeguards for providers and related data transfers.

5. Retention and deletion

Account information and history are retained to provide service while your account is active. Start account deletion in the app or use the account and data deletion page. We complete requests in primary systems within 30 days after verifying ownership and receiving all necessary information. If restrictions or legal obligations prevent deletion of specific data, we explain the data, reason and retention period or end criteria.

Database backups are made daily, encrypted before upload and held in private storage. Cleanup removes files aged 29 days after each successful daily backup, keeping scheduled retention within 30 days. Deleted primary data may remain in older database copies for up to 30 additional days. Backups are for disaster recovery, not normal service use. Before returning a restored database to service, the operator must reapply relevant deletion requests received after the backup.

This backup process does not create a separate backup set of image files. Account-linked images are deleted from primary image storage through account deletion. Request emails and records needed for request handling, security or disputes are used and retained only as necessary for those purposes and legal obligations. Contact us to ask about or exercise rights over these records.

6. Rights and contact

You can request access or a copy, correction, deletion, restriction, objection, receipt or transfer of data, and withdraw consent for activities based on consent, subject to applicable legal conditions. Contact tadasama115599@gmail.com. We may request only the information necessary to verify ownership and notify you of the result or reasons we cannot fulfil a request. You may lodge a complaint with Thailand’s Personal Data Protection Committee office as provided by law.

7. Security and minors

We use role-based access restrictions and safeguards appropriate to the service. Do not send passwords or OTPs by email. If you cannot legally consent or enter a contract independently, your parent or guardian should contact the provider before you create an account.

8. Policy updates

We identify updated versions on this page. Acknowledgement of an earlier version does not extend to a new purpose requiring consent.