Privacy Policy

Official legal information for ProntoExpat. The text here matches what you accept in the app.

Policy version date: October 20, 2026 (Other languages are available using the language menu above.)

1. Data Controller, Who We Are

ProntoExpat is operated by Paolo Ghidoni, Via Trento 15/D, 25128 Brescia, Italy, who is the data controller. For privacy requests, contact us at ordinaedev@gmail.com or +39 375 686 1669. ProntoExpat is an independent private project: it is not affiliated with, endorsed by or acting on behalf of the Italian government or any public authority.

2. Information We Collect

We collect only the data necessary to provide the service:

• Profile and account data: name, email, optional username, profile picture (from Google Sign-In if used) and password-related flags when you set a password.
• Optional comune in Italy: if you choose it during onboarding or in Profile, we store your selected municipality to tailor guidance (ISTAT code and official place name).
• Triage quiz data: nationality, legal basis, entry status, family situation, housing situation and optional Italy entry date (if you choose to provide it) used to generate your personalised roadmap and, when notifications are enabled, working-day deadline reminders (Sundays and estimated national public holidays excluded; Saturdays count; local patron feast days and comune-specific closures not included; not a substitute for official dates).
• Roadmap progress: task completion stored with your profile.
• Saved resources (Premium): guides and articles you bookmark, stored with your account for your Saved list.
• Premium purchases: if you buy Premium, we store your subscription tier on your profile and link your account to our billing provider using your account user ID (a technical identifier). Apple App Store or Google Play (depending on your device) processes the payment; RevenueCat helps us validate purchases and unlock Premium. We do not receive or store your full payment card details.
• Notifications (Premium, when available and enabled): notification preferences (push on/off), in-app inbox message history and if you opt in to push alerts, your Expo push token, device platform and optional device identifier.
• Technical data: device platform (iOS, Android or web), app version, build number, your device locale region (not GPS) and, on first account setup, an approximate country from your connection (country code only, not your IP address) stored with your profile for operations and support. If the app crashes or encounters an unhandled error, our crash-monitoring provider may receive diagnostic data (stack traces, device OS, app version and your account user ID if you are signed in; this is a technical identifier that does not by itself identify you personally). We do not send your name, email, triage answers or other information that directly identifies you in crash reports. The app may download a public Italian municipalities reference list from our storage to power the comune picker. Our hosting providers (e.g. Supabase) may process connection metadata such as IP addresses in server logs when you use the service.
• Local data on your device: session tokens, preferences and cached content (see Local Storage below).

If you use Google Sign-In, we receive your name, email address and profile picture from Google.

3. How We Use Your Data

We process your data to:

• Generate your personalised roadmap (lawful basis: contractual necessity).
• Maintain account security and prevent misuse (legitimate interest).
• Communicate critical updates relevant to your pathway (contractual necessity).
• Store guides and articles you save (Premium users only).
• Deliver Premium in-app notifications and, if you opt in, push alerts about your roadmap and administrative deadlines (consent for push; contractual necessity for the inbox feature).
• Improve our logic using anonymised, aggregated data (legitimate interest).
• Diagnose crashes and unhandled errors to keep the app stable (legitimate interest).
• If you opt in, understand how the app is used (consent): screen views and key in-app actions to improve the product.

We do not sell your personal data. We do not use third-party advertising trackers. Optional product analytics (PostHog) runs only if you turn it on on the post-sign-in privacy screen or enable it in Profile → Privacy; you can turn it off there anytime. Crash and error diagnostics (Sentry) are on by default and can be turned off in the same places. PostHog does not use session replay or screen recording and does not receive your name, email or triage answers. Sentry is separate from product analytics and is not used for advertising. We do not use notifications for advertising.

4. Local Storage and Session Data

The mobile app stores data on your device in several layers:

• Sign-in session: authentication tokens are held in encrypted secure storage (iOS Keychain or Android Keystore), accessible only to this app.
• Your roadmap: the triage answers you submitted (nationality, legal basis, entry status, family situation, housing situation and optional entry date) and the roadmap generated from them are cached in app storage so Home and Tasks load immediately when you reopen the app. This cache expires after 24 hours and is cleared when you sign out or delete your account.
• Your profile is not written to device storage. Your name, profile picture, subscription status and task progress are fetched from our servers when you open the app and kept in memory only.
• App preferences: language, theme, whether you completed onboarding and, if you selected one during onboarding, your destination comune. These stay on the device if you sign out. Terms acceptance and your privacy choices (analytics and crash reporting) are cleared on voluntary sign-out for shared-device safety and restored from your account when you sign in again. Everything is removed when you delete your account.
• Push registration: if you turn on push notifications, a randomly generated device identifier is stored in secure storage.
• Temporary caches: downloaded reference content such as the Italian municipalities list and a short-lived flag used during password reset.

None of this data is used for advertising.

We do not show a cookie banner in the mobile app. Optional product analytics is described in section 3 and runs only if you opt in after sign-in.

5. Third-Party Processors

We use processors bound to GDPR-standard terms, including:

• Supabase, database, authentication, backend services and server logs (EU/USA; Standard Contractual Clauses).
• Google, OAuth sign-in, Firebase Cloud Messaging (FCM) for Android push delivery when you opt in and Google Play billing when you purchase Premium on Android (USA; SCCs).
• Apple, Apple Push Notification service (APNs) for iOS push delivery when you opt in and App Store billing when you purchase Premium on iOS (USA; SCCs).
• RevenueCat, in-app purchase validation and entitlement management for Premium. We send your account user ID (a technical identifier) so purchases can be linked to your profile. RevenueCat receives purchase and device data from Apple or Google under their own terms (see revenuecat.com/privacy).
• Expo, Expo Push Notification service, which routes messages to APNs/FCM when you opt in (USA; SCCs).
• Sentry, crash and error monitoring for app stability (EU/USA; Standard Contractual Clauses; see Sentry Data Processing Agreement). Receives stack traces, device OS, app version, platform and your account user ID when you are signed in (a technical identifier that does not by itself identify you personally).
• PostHog (hosted in the European Union), optional product analytics when you opt in (Standard Contractual Clauses; see PostHog Data Processing Agreement). Receives allowlisted screen views, key in-app events, device platform, app version and your account user ID after consent. We do not use PostHog GeoIP for product geography (we use your profile location and network country hints instead). No email, name, triage answers, session replay or screen recording.
• Discord (private team webhook), internal operations notifications when accounts are created or subscriptions change (legitimate interest). Messages include a pseudonymous user reference (not your full account id), sign-in provider, app platform and version and, when available, your selected comune or location hints. There is no user-facing opt-out for these internal alerts.

6. International Data Transfers

Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission and additional safeguards as required.

7. Data Retention

• Active account data: for the duration of active use.
• Account deletion: from Profile you can permanently delete your account at any time. We anonymize personal data on our servers, remove your sign-in credentials, delete your push tokens and in-app notification inbox history and the app clears all locally stored data on your device (session, preferences and cached content). Premium subscription metadata and device platform are reset on deletion. A minimal pseudonymous tombstone (stable internal account id, account creation date, anonymized task completion counts only) may be retained for up to 90 days for fraud prevention and legal compliance, then automatically purged. We do not call third-party product-analytics deletion APIs on your behalf; optional PostHog data is governed by your in-app analytics choice and PostHog retention settings and crash diagnostics in Sentry are cleared on this device when you delete your account while separate server-side Sentry retention may still apply for a limited period.
• Inactive accounts: we may introduce automated deletion of accounts with no access for an extended period. We will update this policy and notify users before that process is activated. Today, voluntary account deletion and the 90-day tombstone purge above are what apply.
• Payment records: if you purchase Premium when available, records may be kept for up to 10 years where Italian tax law requires.

8. Your Rights

Under GDPR you may access, correct, delete, port, restrict or object to processing and withdraw consent.

Delete your whole account: open Profile → Delete account in the app (permanent; erases server-side personal data and clears local app data on this device). If you cannot use the app, use the account deletion page on our public website.

Delete some data without deleting your account: use our public data deletion requests page (steps, data types, retention) at ordinae.github.io/prontoexpat/data-deletion-request.html, or email ordinaedev@gmail.com from your account email with "Data deletion request" in the subject line.

For other privacy requests (access, correction, portability), contact ordinaedev@gmail.com; we respond within 30 days.

You may complain to the Garante per la Protezione dei Dati Personali: garanteprivacy.it

Your right to object: where we rely on legitimate interests (security, improving our logic with aggregated data and crash diagnostics); you can object at any time. Email ordinaedev@gmail.com with "Objection" in the subject line and we will stop that processing unless we have compelling legitimate grounds to continue.

Data deletion requests page (steps, what we delete or keep, retention)

9. Data Breach Notification

If a breach is likely to risk your rights and freedoms, we will notify the Garante within 72 hours of becoming aware and will notify you without undue delay when the risk is high.

10. Automated Roadmaps

Your personalised roadmap is generated by rule-based software that matches your triage answers to predefined pathways and tasks. It is not an in-app AI chatbot and we do not send your triage answers to a generative AI provider to build your plan. Editorial guides and articles may be drafted, translated or revised with AI-assisted tools and are human-reviewed before publication; they may also include stock or illustrative images and are not official documents. Outputs are informational only and do not make legally binding decisions. You remain responsible for your administrative choices.

11. Notifications (In-App and Push)

Premium users may receive reminders about their roadmap and save guides and articles to a personal Saved list. The notification feature includes:

• In-app inbox: a notification history inside the app (no device permission required).
• Optional push alerts: short lock-screen messages only if you enable Push in Profile → Notifications and grant permission in your device settings.

Push notifications are off by default. You can turn push off at any time in Profile → Notifications. Your device OS settings control whether banners appear on your lock screen.

Deadline reminders are calculated by rule-based software from your triage answers (including an optional entry date). Working-day counts exclude Sundays and national public holidays where we can estimate them (Saturdays count); local patron feast days and comune-specific closures are not included. Always confirm dates with the competent authority. They are informational only, not legal advice. We do not use notifications for advertising.

When you delete your account, we remove your push tokens and inbox history from our servers.

12. Future Features

We may add new product features from time to time (for example optional web access). When we do, we will update this Privacy Policy, describe what data is collected, identify processors and obtain consent where required by law before those features are enabled. Optional product analytics (PostHog) is described in this policy, requires your opt-in, does not use session replay and can be turned off anytime in Profile → Analytics. Crash and error diagnostics via Sentry are separate and described above. We do not use your personal data to train public AI models.