Privacy notice

Last updated: 15. September 2026

1. Who is responsible

The controller of the data you give the topia app — the one who decides why and how it is used — is:

topia

admin@6x7.gr

2. In short

An account only needs your email address. Everything else is optional, and you can browse every destination without an account too.
One account works across every destination — Samos, Lesbos, Copenhagen and the rest are one app, not separate sign-ups.
There are no ads, we do not sell data, and we use no analytics or tracking cookies.
We only send offer emails if you ask for them, and every one has a one-click unsubscribe link.
If you submit a place or event, its content and — to stop abuse — the address you submitted from go to our moderation process, which may include an AI review pass.
To build a day plan or answer a question, your trip preferences and what you type in the chat go to an AI provider — not your name or email address.

3. What we process and why

Account and profile: Email address (required); name, language, home country, phone number, interests and a home destination (all optional); your role in the app (visitor, editor or admin, if you have been given one); and when the account was created and last changed. We use them to run your account, suggest things that suit you, talk to you in your language, and — for editors and admins — to control what you may publish.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).
Signing in: Sign-in runs on Supabase Auth: your email address, your password if you set one (stored only in hashed form), sign-in times, and technical details such as IP address and browser, kept for security. If you sign in with Google, Google gives us your name, email address and a link to your profile picture.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).
Trips and plans: What you tell us about a trip to one destination: dates, number of adults and children and the children’s ages, pace, budget, how you get around, interests, things to avoid, where you are staying and your own notes. Also the day-by-day plan the AI builds for you.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).

4. The AI features

When you ask for a day plan, we send an AI provider your trip details (as listed above, including your notes) together with a list of places in that destination and a short description of the destination itself.
In the chat and the on-page assistant we send what you type, the details of the trip you picked, and the content of the page you are on.
When you submit a place or event, its text may be sent to an AI provider as part of moderation — to judge whether the description looks genuine, spam, or wrongly categorised. This never decides on its own: our code checks the location and looks for duplicates first, a low-confidence or unclear result is always sent to a human, and a contribution is never auto-rejected just because a provider was unreachable.
We do not send your name, email address or phone number to any AI provider. Please do not write sensitive personal details (health, for example) in your notes, a submission or the chat.
Chat messages are not saved in our database — unless, while signed in, you choose to save a conversation to your account in the on-page assistant; day plans are saved to your account. Under their own terms the providers may keep requests for a limited time, for example to prevent abuse.
The AI only makes suggestions or advises a human moderator. We make no automated decisions that have legal or similarly significant effects on you — a submission is only ever auto-published when a deterministic, code-only check has already passed and the AI’s confidence clears a threshold; anything else goes to a human.

5. Emails and notifications

Sign-in and confirmation emails are sent by the sign-in service (Supabase) and are needed for your account.
Offers and news from topia only come if you tick the box for them at sign-up or in your account. Stop them with one click from any such email, or in your account.
A tick made at sign-up is only ever applied once you actually sign in on that same device — a magic-link sign-up can be requested for any address, so ticking the box does not by itself opt in a mailbox you do not own.
Push notifications only come if you allow them. They travel, encrypted, through the push service of your browser’s maker (for example Google, Apple or Mozilla). Turn them off in your account or your browser.

6. Who receives data

We use the providers below. Each one receives only what it needs for its job:

Supabase: Database, sign-in and photo storage, for every destination alike.
Vercel: Hosts the app. It handles every request (IP address, page address, browser details) and may process them outside the EU.
Resend: Email delivery. Receives your email address and the message.
OpenRouter, Groq: AI. They receive trip preferences, chat text, and — during moderation — the text of a submitted place or event. OpenRouter passes the request on to the provider of the model it routes to (for example OpenAI or Google); Groq is the fallback.
Google: Only if you sign in with Google: it confirms who you are and sends us your name, email address and profile picture. Google’s own privacy policy also applies.
OpenStreetMap: Map tiles load straight from OpenStreetMap’s servers, which see your IP address and which part of the map you are looking at.
Photo sources: Photos are downloaded once and stored with us; your browser never talks to the original site to see one. Where a photo came from an outside source such as Wikimedia Commons, that source and its licence are credited under the photo.

7. On your device

Sign-in cookies, to keep you signed in — strictly necessary.
A destination and a language cookie, so the app remembers where you left off and which language you read for a year.
An offline copy of pages (service worker), so the app keeps working on a weak signal. It is cleared automatically when you sign out.
The on-page assistant keeps its conversations and a usage tally in your device’s local storage. Only if, while signed in, you choose to save a conversation to your account are the conversations stored in our database, linked to your account, so you see them on any device; only you can read them, and you can delete them at any time from the assistant’s settings.
You can remove all of this by signing out and clearing this site’s data in your browser.

8. How long we keep it

Account details, trips, plans, favourites, submissions and inbox: for as long as you have an account. You can remove favourites at any time, and a new plan replaces the old one.
Push subscriptions: until you turn notifications off, or the push service tells us they have expired — we then delete them.
The date you agreed to offer emails: for as long as the account exists, including after you withdraw, as evidence that earlier emails were sent with consent.
The IP address on a submission: kept with the submission for abuse handling and not routinely removed, since it is what lets us tell a genuine wave of new contributions from a spam attempt after the fact.
AI usage records: for as long as the account exists; after that they are deleted or no longer linked to you.
Technical logs at our hosting and sign-in providers: for a short period, under their own terms.

9. Your rights

Access: find out what data we hold about you and get a copy.
Correction: you can change most of it yourself in your account.
Erasure: have your account and your data deleted.
Restriction and portability: have processing limited, or get your data in a machine-readable format.
Objection: to processing based on legitimate interests, such as the AI usage records or the IP address on a submission.
Withdrawing consent: any time — with the link in an email, in your account or in your browser. This does not affect what was done lawfully before.

You also have the right to complain to the data protection authority in the EU country where you live. If that is Greece, the authority is the Hellenic Data Protection Authority: www.dpa.gr. If that is Denmark, it is Datatilsynet: www.datatilsynet.dk.

10. How to ask

Write to the address below and tell us what you would like (a copy, a correction, deletion and so on).

admin@6x7.gr

We may ask you to confirm it is you, for example by writing from your account’s email address. We answer free of charge within one month; if a request is complex the law allows up to two more months, and we will tell you if so.

11. Do you have to give us data?

No. You can explore every destination without an account. An account needs only your email address — without it we cannot sign you in. Everything else is optional.

12. Children

If you tell us the ages of children travelling with you, we use them only to make the plan fit. We ask for nothing else about children.

13. Security

All traffic is encrypted (HTTPS). Access rules in the database let each account see only its own trips, plans, favourites, submissions and messages, and let an editor manage only the destinations they have been given rights over. Significant admin actions — publishing, editing or removing a place or event, sending a broadcast, granting or revoking access — are recorded in an audit log so they can be traced back to the person who made them.

14. Changes

If anything in this notice changes, we will update this page and the date at the top. For significant changes we will let you know in the app.

My account

Privacy notice

Last updated: 15. September 2026

1. Who is responsible

The controller of the data you give the topia app — the one who decides why and how it is used — is:

topia

admin@6x7.gr

2. In short

An account only needs your email address. Everything else is optional, and you can browse every destination without an account too.
One account works across every destination — Samos, Lesbos, Copenhagen and the rest are one app, not separate sign-ups.
There are no ads, we do not sell data, and we use no analytics or tracking cookies.
We only send offer emails if you ask for them, and every one has a one-click unsubscribe link.
If you submit a place or event, its content and — to stop abuse — the address you submitted from go to our moderation process, which may include an AI review pass.
To build a day plan or answer a question, your trip preferences and what you type in the chat go to an AI provider — not your name or email address.

3. What we process and why

Account and profile: Email address (required); name, language, home country, phone number, interests and a home destination (all optional); your role in the app (visitor, editor or admin, if you have been given one); and when the account was created and last changed. We use them to run your account, suggest things that suit you, talk to you in your language, and — for editors and admins — to control what you may publish.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).
Signing in: Sign-in runs on Supabase Auth: your email address, your password if you set one (stored only in hashed form), sign-in times, and technical details such as IP address and browser, kept for security. If you sign in with Google, Google gives us your name, email address and a link to your profile picture.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).
Trips and plans: What you tell us about a trip to one destination: dates, number of adults and children and the children’s ages, pace, budget, how you get around, interests, things to avoid, where you are staying and your own notes. Also the day-by-day plan the AI builds for you.; Legal basis: contract — providing the service you signed up for (GDPR Art. 6(1)(b)).

4. The AI features

When you ask for a day plan, we send an AI provider your trip details (as listed above, including your notes) together with a list of places in that destination and a short description of the destination itself.
In the chat and the on-page assistant we send what you type, the details of the trip you picked, and the content of the page you are on.
When you submit a place or event, its text may be sent to an AI provider as part of moderation — to judge whether the description looks genuine, spam, or wrongly categorised. This never decides on its own: our code checks the location and looks for duplicates first, a low-confidence or unclear result is always sent to a human, and a contribution is never auto-rejected just because a provider was unreachable.
We do not send your name, email address or phone number to any AI provider. Please do not write sensitive personal details (health, for example) in your notes, a submission or the chat.
Chat messages are not saved in our database — unless, while signed in, you choose to save a conversation to your account in the on-page assistant; day plans are saved to your account. Under their own terms the providers may keep requests for a limited time, for example to prevent abuse.
The AI only makes suggestions or advises a human moderator. We make no automated decisions that have legal or similarly significant effects on you — a submission is only ever auto-published when a deterministic, code-only check has already passed and the AI’s confidence clears a threshold; anything else goes to a human.

5. Emails and notifications

Sign-in and confirmation emails are sent by the sign-in service (Supabase) and are needed for your account.
Offers and news from topia only come if you tick the box for them at sign-up or in your account. Stop them with one click from any such email, or in your account.
A tick made at sign-up is only ever applied once you actually sign in on that same device — a magic-link sign-up can be requested for any address, so ticking the box does not by itself opt in a mailbox you do not own.
Push notifications only come if you allow them. They travel, encrypted, through the push service of your browser’s maker (for example Google, Apple or Mozilla). Turn them off in your account or your browser.

6. Who receives data

We use the providers below. Each one receives only what it needs for its job:

Supabase: Database, sign-in and photo storage, for every destination alike.
Vercel: Hosts the app. It handles every request (IP address, page address, browser details) and may process them outside the EU.
Resend: Email delivery. Receives your email address and the message.
OpenRouter, Groq: AI. They receive trip preferences, chat text, and — during moderation — the text of a submitted place or event. OpenRouter passes the request on to the provider of the model it routes to (for example OpenAI or Google); Groq is the fallback.
Google: Only if you sign in with Google: it confirms who you are and sends us your name, email address and profile picture. Google’s own privacy policy also applies.
OpenStreetMap: Map tiles load straight from OpenStreetMap’s servers, which see your IP address and which part of the map you are looking at.
Photo sources: Photos are downloaded once and stored with us; your browser never talks to the original site to see one. Where a photo came from an outside source such as Wikimedia Commons, that source and its licence are credited under the photo.

7. On your device

Sign-in cookies, to keep you signed in — strictly necessary.
A destination and a language cookie, so the app remembers where you left off and which language you read for a year.
An offline copy of pages (service worker), so the app keeps working on a weak signal. It is cleared automatically when you sign out.
The on-page assistant keeps its conversations and a usage tally in your device’s local storage. Only if, while signed in, you choose to save a conversation to your account are the conversations stored in our database, linked to your account, so you see them on any device; only you can read them, and you can delete them at any time from the assistant’s settings.
You can remove all of this by signing out and clearing this site’s data in your browser.

8. How long we keep it

Account details, trips, plans, favourites, submissions and inbox: for as long as you have an account. You can remove favourites at any time, and a new plan replaces the old one.
Push subscriptions: until you turn notifications off, or the push service tells us they have expired — we then delete them.
The date you agreed to offer emails: for as long as the account exists, including after you withdraw, as evidence that earlier emails were sent with consent.
The IP address on a submission: kept with the submission for abuse handling and not routinely removed, since it is what lets us tell a genuine wave of new contributions from a spam attempt after the fact.
AI usage records: for as long as the account exists; after that they are deleted or no longer linked to you.
Technical logs at our hosting and sign-in providers: for a short period, under their own terms.

9. Your rights

Access: find out what data we hold about you and get a copy.
Correction: you can change most of it yourself in your account.
Erasure: have your account and your data deleted.
Restriction and portability: have processing limited, or get your data in a machine-readable format.
Objection: to processing based on legitimate interests, such as the AI usage records or the IP address on a submission.
Withdrawing consent: any time — with the link in an email, in your account or in your browser. This does not affect what was done lawfully before.

10. How to ask

Write to the address below and tell us what you would like (a copy, a correction, deletion and so on).

admin@6x7.gr

11. Do you have to give us data?

No. You can explore every destination without an account. An account needs only your email address — without it we cannot sign you in. Everything else is optional.

12. Children

If you tell us the ages of children travelling with you, we use them only to make the plan fit. We ask for nothing else about children.

13. Security

14. Changes

If anything in this notice changes, we will update this page and the date at the top. For significant changes we will let you know in the app.

My account