Privacy policy

The controller of your data is Jose Ángel Fernández Ortiz, a natural person developing LeaveMore as a validation project (not a commercial activity yet). For any request related to your data, write to contacto@leavemore.es.

We only collect the data we need for the app to work:

• Email and password (the password is stored hashed with bcrypt; we can never see it).
• Nickname and vehicle type, if you provide them.
• Receipts you upload: amount, merchant, date, category, location (latitude/longitude) and the image you scan.
• Minimal technical data in logs (IP address and user-agent) for up to 30 days for debugging and abuse prevention.

We use your data to:

• Authenticate you.
• Compute and show your personal impact (what you leave at local businesses).
• Build public aggregated territorial stats (impact map, totals by area) applying minimum privacy thresholds: nothing is published if an area has fewer than 5 users or fewer than 10 different receipts.
• Detect and prevent duplicates or fraud (the same receipt uploaded twice is flagged).

The legal basis is your explicit consent at account creation time (GDPR art. 6.1.a). We record the exact timestamp when you accepted this policy and the terms of use, in case we need to prove it.

For push notifications and the approximate location that makes them possible, the legal basis is likewise your consent (Article 6(1)(a)): they only exist if you turn them on, you can withdraw them at any time from your profile —per channel or entirely— and withdrawing them does not affect the lawfulness of earlier processing.

We keep your data as long as you keep the account. If you delete it, your personal information is removed immediately, except for minimal technical logs that we keep for up to 30 days after deletion.

The last approximate location we use for notifications is kept for a maximum of 24 hours and deleted automatically. We also delete it immediately as soon as you turn off notifications or the channels that depend on your area.

We use the following providers:

• Hostinger (EU) for hosting the app and database.
• OpenStreetMap / Nominatim for maps and reverse geocoding (only the coordinates of your receipt are sent; your identity is not).
• Let's Encrypt to issue the HTTPS certificate (no personal data).
• Your own browser's push notification service (Google, Mozilla or Apple, depending on which you use), only if you turn notifications on. It receives the encrypted message and a technical delivery address; we do not send it your identity or location.

We do not sell or share your data with third parties for commercial purposes.

Push notifications are **optional**: you only get them if you turn them on in your profile and grant the browser permission. You can switch them off at any time, per channel or entirely.

If you turn them on, we store **your last approximate location** so we can tell you what is happening near you. How it works:

• **No background tracking.** We only record it at moments when you are already using the app and sharing your position: opening the Radar or uploading a ticket. Panning the map to look at another area does not count as your location.
• **It is approximate.** We round it to a cell of roughly 2 km. We never store the exact coordinate.
• **We do not store your route.** There is a single record per person and it is overwritten: reconstructing where you have been is technically impossible.
• **It expires after 24 hours** and is deleted automatically.
• If you turn notifications off, or the channels that depend on your area, **we delete that record immediately**.

We never share your location with third parties and never use it for personalised advertising. Delivering the notification involves your browser's own push service (Google, Mozilla or Apple, depending on which you use), which receives it encrypted.

You can exercise at any time the rights of access, rectification, erasure, objection, restriction of processing and portability. To do so, email us at contacto@leavemore.es. We will respond within one month.

If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minimum age: you must be at least 14 years old to use LeaveMore (Spanish LOPDGDD art. 7).

If we make substantial changes, we will let you know at sign-in and ask you to accept them again when needed. The date of the latest update appears at the top of this page.