Privacy Policy

Vanlifer (distributed on the App Store and Google Play as the Vanlifer app by blisscards) is a free vanlife community that helps travellers find spots to park and sleep and meet other vanlifers on the road. This page explains, in plain English, what data we collect from users of the Vanlifer website and the Vanlifer mobile app, what we do with it, and what rights you have. We don't sell your data and we don't run advertising in the product.

1. Who runs this service

The Vanlifer website and the Vanlifer mobile app (App Store & Google Play developer account: blisscards) are operated as a single independent project. The Vanlifer iOS and Android app is a mobile wrapper around the Vanlifer service — both surfaces share the same accounts, data, and privacy practices described in this policy. For any privacy question, account-deletion request, or data-export request, write to palmies@pm.me. That address is the developer/data-controller contact for both Vanlifer and Vanlifer, and is the same support email shown on the Vanlifer Google Play listing.

2. Information we collect

Account & profile

When you sign up, we store your username, email and a one-way hash of your password (we never see the plaintext). On your profile you can optionally add: real name, age, gender, city, country, languages, occupation, education, interests, "about me" text, travel status (on the road / parked up / home base), van or vehicle type, social handles (Instagram, Telegram, website), profile photo, cover photo and additional gallery photos.

Location

If you choose to drop a pin (the "Pin me here" button) or grant the "use my location" permission, we store your latitude/longitude in your profile so other travellers can find you on the map. You can blur, change or remove your location at any time from Edit profile. The map page only ever shows vanlifers who have explicitly opted in by saving a location. Travellers' coordinates are jittered ±4 km on the map so the marker shows an area, not an address.

Communications & activity

We store: the messages you send and receive, meet-up requests you create or respond to, reviews you write or receive, follows, travel-buddy connections, RSVPs to events you make or organise, status posts you publish to the local feed, profile visits, and notifications generated as a result. These records are retained until you or the other party delete them, or until the account is removed.

Spots you add to the map

When you add a spot (a place to park, sleep, get water, etc.) we store its title, description, category, coordinates, place name, price type, services, any photos you upload and the reviews or saves it receives. Spots are public: they appear on the map, on a public spot page and on your profile ("Spots added by @you"). You can edit or remove your spots at any time; they are deleted with your account.

Technical & security data

For each account we keep timestamps for created-at and last-active, plus session/auth tokens used to keep you logged in. Web-server logs may retain your IP address temporarily for abuse prevention and debugging.

3. Cookies & local storage

• Session cookie (cs_token): keeps you logged in on the website for up to ~10 years unless you log out.
• Mobile auth token (fcs_app_token, in localStorage): keeps you logged in inside the Vanlifer mobile app. We use a token in storage instead of a cookie because mobile WebViews handle cookies unreliably.
• Referral cookie (fcs_ref): if you arrive via a friend's invite link (?ref=…) we set a 30-day cookie so we can credit your friend on the leaderboard if you sign up.
• Banner dismissal (tg_banner_dismissed, fcs_invite_dismissed): remembers that you closed a banner so we don't show it again.
• We do not use advertising cookies, cross-site tracking pixels, or analytics that profile you across other websites.

4. How we use your data

• To run the core community features: showing vanlifers and spots on the map, surfacing nearby travellers, routing messages and meet-up requests, displaying reviews and ratings, and powering the activity feed.
• To send you transactional email — for example, when someone messages you, requests a meet-up, accepts/declines a request, or follows you. You can unsubscribe from non-essential mails by adjusting your settings or replying with "unsubscribe".
• To compute the Top Inviters leaderboard — only invitees with a fully-completed profile (photo + about-me + city) are counted, and only public usernames and counts are shown.
• To moderate and protect the community (spam, abuse, fraud, safety reports).

5. Sharing with third parties

We share the minimum necessary data with these service providers, and only to deliver the service:

• OpenStreetMap (tile rendering) and Nominatim (reverse geocoding for "Pin me here" and status posts). When you load the map or pin yourself, your browser fetches map tiles from tile.openstreetmap.org and a one-shot reverse-geocode request from nominatim.openstreetmap.org.
• LocationIQ (forward geocoding for the search box, when configured).
• Appilix (push-notification SDK for the iOS/Android wrapper). Your username is passed to Appilix as a "push identity" so notifications can target your device. You can dismiss/disable notifications in your OS settings.
• Email delivery (transactional mail sent on behalf of Vanlifer / Vanlifer). Standard SMTP envelope information (your email address) is processed by the outbound mail server.
• jQuery, Bootstrap, Font Awesome and Leaflet are loaded from public CDNs. Loading these resources exposes your IP address to the CDN. We don't share any other data with them.

We never sell your personal data. We never share your data with advertisers.

6. Public vs private

The following are visible to anyone who can see the site (or any signed-in member, where relevant): your username, profile photo, cover photo, about-me, city/country, age, gender, languages, occupation, interests, availability status, photos you upload to your gallery, status posts you publish, reviews you receive, your follower/following lists, and your aggregated stats. Your email address, password hash, and direct messages are not public. Meet-up request details are visible only to you and the other member involved.

7. Your rights

Wherever you live, you have the right to:

• Access the data we hold about you. Most of it is visible right inside your profile and settings; for a complete export, email palmies@pm.me.
• Correct any inaccurate data using Edit profile.
• Delete your account — deletion is immediate and removes your profile, photos, status posts, messages, follow relationships, travel-buddy connections, RSVPs, reviews you wrote and reviews about you, and notifications. Quoted text inside other members' messages may persist briefly — we'll purge it on request.
• Object to specific processing or withdraw consent (e.g. by removing your location, changing your availability status, or unsubscribing from non-essential email).
• Lodge a complaint with your local data-protection authority.

8. Children

Vanlifer and the Vanlifer app are not directed at children under 16. If you become aware that a child has shared personal data with us, please contact palmies@pm.me and we will delete the account.

9. Security

Passwords are stored as one-way bcrypt hashes; we never see them. Sensitive site traffic is served over HTTPS. We hash auth tokens server-side. No system is perfect — please use a unique, strong password, don't reuse credentials, and report any suspected compromise.

10. International transfers

Vanlifer is a small project; servers and email infrastructure may be located outside your country. By using the service you consent to the transfer of your information to those locations.

11. Changes to this policy

If we make material changes we'll update the date at the top and, where appropriate, notify members in-product or by email. Continued use of the service after a change means you accept the updated policy.

12. Contact

Privacy questions, data-export requests, account-deletion requests, or anything else relating to Vanlifer or the Vanlifer app (App Store & Google Play developer: blisscards): palmies@pm.me.

By signing up, you confirm that you've read and understood this policy.