Tourguide Privacy Policy

Last updated: September 30, 2026

This Policy supplements our Terms of Service and Community Guidelines.

This Privacy Policy describes how Robert Michels (“we,” “us,” or “our”) collects, uses, discloses, and retains information when you use the Tourguide mobile application, the Tourguide web experience, and related pages at tourguide.rmichels.com (collectively, the “Service”).

We are located in British Columbia, Canada. This Policy is written with Canadian privacy expectations in mind, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies to our handling of personal information.

1. Who we are

Operator: Robert Michels, operating the Tourguide Service in British Columbia, Canada
Contact: contact@tourguide.rmichels.com

For privacy questions, access requests, and complaints, please use this email. We do not publish a personal phone number or home address for general correspondence.

The Service is branded as Tourguide. It helps users discover, create, and run self-guided tours with maps, navigation, community content, optional social features, and an AI guide.

2. Age requirement

The Service is intended for people who are not minors in the place where they live (for example, at least 18 years old where that is the age of majority). We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us and we will take reasonable steps to delete it.

3. Information we collect

We collect information in the ways below. We collect only what we need to operate the Service.

3.1 Account and profile

• Google Sign-In (optional): If you sign in with Google, we receive information from Google needed to authenticate you (such as your Google account identifier, email address, and display name). We do not offer Facebook, Twitter/X, Instagram, LinkedIn, or other social login providers in the app.
• Anonymous (“guest”) use: You may use much of the Service after Firebase anonymous authentication, without linking Google. Anonymous users receive a Firebase user ID.
• Optional guest contact form: If you choose to enter a name, email, and/or company on guest sign-in, we store those fields in Firestore under guests/{your anonymous user id}, along with a timestamp and visit count.
• Registered user profile (Firestore users/{uid}): Username (public identity), email, Google sign-in ID, display name (from Google; not shown as primary identity in the app), saved tour IDs, email subscription preferences, embedded moderation reports you filed, and sign-in timestamps.
• Username registry: A mapping from normalized username to user ID in usernames/ so usernames stay unique.

3.2 User-generated and social content

• Tours and waypoints: Titles, descriptions, locations, visibility, ratings aggregates, and related metadata you create or edit.
• Tour images: Photos you upload for tours, stored in Firebase Storage at tour_images/{authorId}/{tourId}. You may also attach images from your device camera or photo library, or use place photos from Google Places where you select them in the app.
• Ratings and comments: Star ratings, comment text, vote counts, and your user ID associated with that content on public or shared tours.
• Reports: Content you submit when reporting tours, comments, or users (including report category and description), stored in Firestore collections such as user_reports and comment_reports. Some tour-level moderation data is handled server-side and is not directly readable in the client.
• Friends and invites: Friend relationships, friend requests, and tour session invites between mutual friends (usernames and user IDs).
• Tour sessions (“Tour with friends”): Session metadata (tour ID, host, participants) and, while a session is active, periodic GPS coordinates and username for participants who share location, in tour_sessions/{sessionId}/locations/{userId}.

3.3 Location and maps

• Device location: With your permission, we collect precise location to show nearby tours, run navigation, center maps, and build AI context. You can decline or revoke permission in device settings; some features will be limited.
• Reverse geocoding: On web, city/region/country may be derived via our Cloud Function proxy to Google’s Geocoding API from coordinates you share. On mobile, similar place details may be resolved on-device via platform geocoding and Google Places where used.
• Directions: When you request routes, waypoint coordinates and travel mode are sent to our authenticated Cloud Functions (fetchDirections, fetchSegmentDirections), which call Google Directions. Optional server-side route caching may store polylines under a tour document for up to about 24 hours.
• Google Maps and Places: Map display, place search, and place details use Google Maps Platform services subject to Google’s Privacy Policy.

3.4 AI Guide (Gemini via Firebase AI)

• Chat messages: Text you send to the AI guide and the model’s replies.
• Context sent with each turn: Local date/time; approximate location (city/region and coordinates rounded to three decimal places in the text context block when available); whether you are a guest or signed-in user and your public username (not your email); running tour stop context; nearby tour titles and IDs; and focused tour context when applicable. Separately, when Maps grounding is enabled, we may send precise coordinates (or a tour stop coordinate if GPS is unavailable) to Google’s Maps grounding service through Gemini. When Search grounding is enabled, your message may be processed by Google Search through Gemini.
• Grounding tools: Depending on configuration (Firebase Remote Config), Gemini requests may include Google Maps and/or Google Search tools. Those services process your prompt and tool-related location under Google’s policies, in addition to Firebase AI / Gemini processing.
• Usage limits: We track daily AI usage counts locally and in app logic to enforce guest, signed-in, and premium limits.
• What we try not to log in crash reports: AI error reporting is designed to avoid attaching full chat transcripts to crash analytics.

AI processing is provided through Google Firebase AI / Gemini. Google’s terms and privacy policy apply to that processing.

3.5 Purchases and premium

• RevenueCat and Google Play Billing (Android): When the in-app purchase stack is enabled, RevenueCat receives your Firebase Auth user ID, purchase history, and entitlement status. Premium status may be reflected in Firebase Auth custom claims. RevenueCat’s privacy policy applies.
• On web and in some test builds, the purchase stack is disabled; premium paywalls may not be available.

3.6 Notifications

• Firebase Cloud Messaging (FCM): If you allow notifications, we store device push tokens under users/{uid}/fcm_tokens/ to send tour invite and related push messages. Tokens are removed when you sign out (for the current device token).

3.7 Analytics, diagnostics, and security

• Firebase Analytics (Google): Events such as sign-in method, onboarding steps, location opt-in outcomes, tour content selections, and custom auth/navigation/AI events. Important: if you submit the optional guest form, the app currently logs your guest name, email, and company to Analytics as event parameters on guest login. We treat correcting or removing that logging as a product priority; you may still avoid entering those fields if you do not want them stored in Analytics.
• Firebase Crashlytics (mobile, release/profile): Crash stacks, breadcrumbs, and diagnostic keys (for example auth phase, location source, AI error types). We set Crashlytics user identifiers to your Firebase UID when signed in. Crashlytics is disabled on web and during emulator test runs.
• Firebase Remote Config: Fetches feature flags and configuration (for example AI model settings) without identifying you by name in the config payload.
• Firebase App Check: Helps protect backend APIs from abuse using attestation providers appropriate to each platform.
• Web App Check: On web, App Check may use Google reCAPTCHA v3, which collects signals Google uses for abuse prevention under Google’s Privacy Policy.

3.8 Email

• When you create a registered user profile, a welcome email may be queued through our backend email pipeline.
• We may send transactional emails related to reports, moderation, or tour activity, subject to your email subscription preferences where applicable.
• Unsubscribe links may update your emailSubscriptionsDisabled preferences via a Cloud Function.

We do not send marketing SMS. We do not run affiliate tracking networks in the app.

3.9 Local storage on your device

On mobile (not on web), the app uses local storage to improve performance and offline use:

• Hive databases: Cached tour lists, offline downloaded tours and metadata, cached direction polylines, and (with encryption when available) AI chat threads and messages.
• Flutter Secure Storage: Encryption key material for chat storage on supported platforms.
• Shared preferences: Onboarding flags, offline action queues (for example bookmarks/ratings to sync later), and web chat fallback storage.

Local chat history persists across sign-out so you can continue a conversation when you sign back in on the same device. Account deletion clears local chat data on the device as part of the deletion flow.

3.10 Advertising

The Android app manifest includes a Google AdMob application ID, and ad-related code exists but is currently commented out and not initialized in production app startup. We do not show AdMob ads in the current app build. If we enable ads in a future version, we will update this Policy and applicable store disclosures.

4. How we use information

We use information to:

• Provide authentication, profiles, tour discovery, creation, editing, running, and navigation;
• Operate friends, tour sessions, invites, comments, ratings, and reporting;
• Power the AI guide and enforce usage limits;
• Process purchases and premium entitlements where enabled;
• Send push notifications and transactional email you expect from the Service;
• Secure the Service (App Check, abuse prevention, moderation workflows);
• Measure feature usage and fix crashes;
• Comply with law and enforce our Terms of Service and Community Guidelines.

We do not use your information for third-party behavioral advertising in the current app version.

5. How we share information

We share information only as described below:

• Service providers: Google (Firebase, Maps, Geocoding, Directions, Sign-In, Analytics, Crashlytics, Cloud Messaging, AI/Gemini, reCAPTCHA, and AI grounding tools), RevenueCat, and email delivery infrastructure used by our Cloud Functions. Maps and Search may also process data when used for AI grounding (see Section 3.4). They process data under their own terms and privacy policies.
• Other users: Usernames, public tours, comments, ratings, and live session location (for participants in the same active tour session) are visible to other users according to tour visibility and session membership.
• Legal and safety: When required by law or to protect users, the public, or our rights.

We do not sell personal information.

6. International transfers

We and our service providers (including Google Cloud and Firebase, typically in the United States and other countries) may process and store information outside Canada. Where required, we rely on appropriate contractual and organizational measures offered by those providers. By using the Service, you understand that your information may be transferred internationally.

7. Retention

We keep information for as long as needed to provide the Service, resolve disputes, enforce agreements, and meet legal obligations. Examples:

• Account and profile data: until you delete your Firebase Authentication account or we delete it after a verified request, subject to the gaps in Section 8.
• Tour content and comments: until deleted by you or removed through moderation; backups and logs may persist for a limited time.
• Tour session locations: while a session is active and for a short period thereafter; stale location documents may stop displaying after a few minutes of inactivity.
• Directions cache on server: about 24 hours when tour-scoped caching is used.
• Analytics and crash data: according to Google’s default retention settings for Firebase projects unless we configure shorter periods.
• Guest lead records (guests/): until removed through a support request; the app does not offer self-serve deletion of guest documents.

8. Access, correction, and deletion

Depending on where you live, you may have rights to access, correct, or delete personal information we hold about you, or to withdraw consent where processing is consent-based. Contact us at contact@tourguide.rmichels.com. We may need to verify your identity.

8.1 In-app account deletion (registered Google users)

Registered users can delete their Firebase Authentication account from Profile → Delete Account (typing “DELETE” to confirm). That flow:

• Deletes your Firebase Authentication user when the operation succeeds (recent sign-in may be required);
• Clears local AI chat storage on the device;
• Disconnects Google Sign-In on the device.

The in-app screen states that your tours and ratings will be removed. In the current app version, account deletion does not automatically delete all Firestore or Storage data tied to your user ID (for example your users/{uid} document, tours you authored, comments, ratings, friend graphs, FCM tokens, RevenueCat customer history, or optional guests/{uid} records from earlier anonymous use). Some of that data may become unreachable to you after Auth deletion but may remain until we complete backend cleanup or you request deletion by email. We are working to align backend deletion with user expectations.

Anonymous accounts can use the Service without the guest form; optional guest contact fields are the main additional personal data tied to anonymous IDs.

9. Security

We use industry-standard measures appropriate to the Service, including HTTPS, Firebase security rules, App Check on backend calls, and encrypted local chat storage when the device supports it. No method of transmission or storage is completely secure.

10. Third-party links

The Service may link to third-party sites (for example Google policies or map content). We are not responsible for their privacy practices.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL and change the “Last updated” date. Material changes may also be communicated in the app or by email where appropriate.

12. Contact

Questions or requests about privacy: contact@tourguide.rmichels.com