Privacy Policy
Goomee is operated by High Five International, Diepestraat 2 bus B, 1640 Sint-Genesius-Rode, Belgium. We are the data controller for the personal data described here. You can reach us at goomee.support@gmail.com.
This policy explains what we collect, why, who else sees it, how long we keep it, and what you can do about it. It is written to be read, not to be survived.
1. What we collect
| Data | What it is |
|---|---|
| Account | Your email address and, if you set them, a display name and profile picture. |
| Consent choices | Whether you have granted location, notifications and personalisation, each separately, together with when and where you granted or withdrew it. |
| Approximate location | Only while you are using the app, and only if you allow it. See section 3. |
| Your activity | Places you save, places you open, your travel history, and trips created with the planner. |
| Product analytics | Which recommendations were shown and which you engaged with, tied to your account and a session identifier. Used to improve ranking. |
| Partner clicks | When you open a booking or partner link from Goomee, we record which place and which partner, so the partner can attribute the referral. |
| Notifications | A device token so we can send push notifications, and a record of what we sent. |
| Payments | None today: the app is free. If paid features are added, Stripe will handle them and card details will never reach our servers. |
| Contact form | Your name, email address, the topic you chose and your message, when you write to us through the website. Used only to answer you. |
| Stability | If the app crashes, a record that it did and the technical reason, sent on next launch. |
We do not use advertising identifiers. Goomee does not ask for App Tracking Transparency permission, contains no advertising SDKs, and does not track you across other apps or websites. We do not sell personal data.
2. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of a contract (Art. 6(1)(b)) |
| Showing nearby recommendations | Your consent (Art. 6(1)(a)) |
| Personalising what you are shown | Your consent (Art. 6(1)(a)) |
| Push notifications | Your consent (Art. 6(1)(a)) |
| Measuring and improving the product | Legitimate interests (Art. 6(1)(f)) |
| Partner referrals | Legitimate interests (Art. 6(1)(f)) |
| Security, abuse prevention, rate limiting | Legitimate interests (Art. 6(1)(f)) |
| Payments | Performance of a contract and legal obligation |
| Answering messages you send us | Legitimate interests (Art. 6(1)(f)) |
Where we rely on consent you may withdraw it at any time, in the app, without affecting anything done before you withdrew it. Each purpose is granted and withdrawn independently — turning off personalisation does not turn off location, and neither closes your account.
3. Location
Goomee asks for location only while the app is open. There is no background location tracking.
Your precise coordinates are used to answer the question you are asking — what is good near you, right now — and are then discarded. For caching we round your position to a coarse grid cell rather than storing your exact position against your account, so the record of where you were is approximate by design.
Weather information is requested using that same coarsened cell, not your precise position, and carries no account information.
If you turn on recommendation notifications, we keep the area you last used the app in, rounded to about 1 km, so that an evening suggestion is for somewhere near you. It is replaced each time you use the app, and removed with the device when you turn notifications off or delete your account.
4. Personalisation and the AI planner
If you enable personalisation, we build a taste profile from what you save, open and skip, and use it to rank what you are shown. This is profiling in the sense of the GDPR. It affects the order of recommendations. It produces no legal or similarly significant effects, and there is no automated decision-making of the kind described in Article 22.
You can reset your taste profile at any time from the app, which erases the signals behind it, or switch personalisation off entirely and keep using Goomee.
My Goomee Planner generates itineraries using Google’s Gemini models on Google Cloud. The trip details you provide are sent to that service to produce the itinerary. We do not send your email address, name or account identifier.
5. Who else processes your data
We use a small number of providers, each under a data processing agreement, each only for the purpose named:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | European Union |
| Google Cloud Run | Hosting our API | Belgium (EU) |
| Google Cloud | Place information, maps, the AI planner, spoken content | See section 6 |
| Stripe | Payments | EU / US |
| Apple | Delivering push notifications | EU / US |
| Open-Meteo | Weather for a coarse area | EU |
| YouTube (Google) | Short videos of museums and landmarks, played in YouTube’s own player. When one plays, YouTube receives your device’s IP address. You can switch videos off in the app under Privacy & Security. | EU / US |
| Gmail (Google) | Sending account emails (confirming your address, resetting your password) and receiving the emails you send us | EU / US |
| Web3Forms | Delivering contact-form messages to our inbox by email | See their privacy policy |
| Vercel | Hosting this website and counting its visits (see section 10) | EU / US |
Partners whose booking links you follow receive the fact of the referral. Once you leave Goomee you are on their site, under their privacy policy.
6. Transfers outside the EEA
Our database and API are hosted in the EU. Some providers, in particular Google and Stripe, may process data outside the European Economic Area. Where that happens it is covered by the European Commission’s Standard Contractual Clauses and the provider’s own transfer safeguards. You can ask us for details of the safeguards in place.
7. How long we keep it
- Account data — until you delete your account.
- Saved places, history and trips — until you delete them, or your account.
- Product analytics — 90 days, then deleted automatically.
- Recommendation records — 30 days.
- Contact messages — as long as needed to handle your question, then deleted.
- Technical caches — expire automatically; place data is refreshed at least every 30 days.
- Consent records — kept for as long as we need to demonstrate that consent was given, as the GDPR requires.
Deleting your account removes your profile, your saved places, your history, your trips, your profile picture and the signals behind your taste profile.
8. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, receive a portable copy, object to processing based on legitimate interests, ask us to restrict processing, and withdraw consent.
Two of these are built into the app and need no request:
- Download everything we hold about you — a single JSON file, including a link to your profile picture.
- Delete your account — immediate and permanent.
For anything else, email goomee.support@gmail.com. We respond within one month, as the GDPR requires.
9. Security
Your data is isolated at the database level: every row carrying personal data is protected by a policy that allows access only to the account that owns it, enforced by the database rather than by application code remembering to check. Traffic is encrypted in transit. Card details are handled by Stripe and never reach us.
10. Cookies and statistics on this website
This website sets no cookies. To see how many people visit and which pages they read, we use Vercel Web Analytics, which works without cookies and does not identify you: visits are only counted in aggregate, no profile is built of you, and nothing is shared with advertisers. That is why you were not asked to accept anything.
The site also remembers the language and the light or dark theme you choose, in your browser’s own storage. That stays on your device and is never sent to us.
11. Children
Goomee is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes
If we change this policy we will update the date at the top, and for anything significant we will tell you in the app before it takes effect.
13. Complaints
If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain to the Belgian supervisory authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
dataprotectionauthority.be