Skip to content
Privacy Policy

Privacy Policy

Last updated: 6 October 2026

This policy covers everything called Neywo: this website (neywo.com), the web app (app.neywo.com) and the Neywo apps for iOS and Android. It says what we know about you, what leaves your device, where it goes and why.

In one paragraph: you can read this website and listen to the guides without an account and without telling us who you are. Your location is used on your device to start each stop's story when you get there; it is not kept on our servers. If you create an account, we store what you put in it and the record of the walks you take, and you can delete all of it from the app at any time. We show no ads, run no analytics or tracking software, and never sell or rent your data.

1. Who is responsible

The data controller is:

Marcos Rodríguez Regueira, trading as Neywo
Calle Valle de el Paular 50, 28850 Torrejón de Ardoz (Madrid), Spain
privacy@neywo.com

Write to that address for anything in this policy, including the rights described in section 10.

2. This website

You do not need to give us any personal data to use neywo.com. There is no account, no contact form, and no analytics, advertising or social-media code on it.

Hosting and server logs

The website and the web app are hosted by Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA), which delivers them through its global network. To serve each page, Netlify's servers necessarily process your IP address and record technical data in server logs: browser type and version, operating system, referring page, the page requested and the time of the request. This data is not combined with any other source. The legal basis is our legitimate interest in delivering the website securely and without errors (Art. 6(1)(f) GDPR).

Photographs of places

The photographs on the city pages are served for us by Amazon Web Services EMEA SARL through its CloudFront network. Like any web request, fetching a picture sends it your IP address and the file requested. Nothing else is sent, no cookie is set, and the requests are not combined with any other source. The legal basis is the same legitimate interest as the hosting above (Art. 6(1)(f) GDPR).

Cookies and local storage

This website uses no tracking, analytics or advertising cookies, and no third party sets cookies through it. It stores only the following on your device, all of it strictly necessary for the site to work or a display preference you chose (exempt from consent under Art. 22.2 of Spanish Law 34/2002, LSSI-CE, which transposes Art. 5(3) of the ePrivacy Directive):

  • nf_lang (cookie, 1 year) — set only when you explicitly pick a language in the language menu, so the start page opens in that language on your next visit.
  • neywo_cc (cookie, 1 year) — records that you dismissed the cookie notice so it is not shown again.
  • user-theme (local storage) — your light or dark theme. It is written only when you use the theme switch; until then nothing is stored and the site follows your browser's own light/dark setting.

None of this identifies you and none of it is shared with anyone. The local storage entry never leaves your browser. The two cookies, like all cookies, are sent to our host with each request: nf_lang is read there to open the start page in the language you chose, while neywo_cc is only read by this site in your browser. You can delete all of it through your browser settings; the website keeps working without it.

Emails you send us

If you write to us, we keep your message and address to answer you, on the basis of our legitimate interest in handling your request (Art. 6(1)(f) GDPR) or, where it concerns your account, to provide the service (Art. 6(1)(b) GDPR). We delete it once the matter is closed, unless the law requires us to keep it.

3. The app and the web app

Location

Neywo has several ways to guide you, and they differ only in how much location they use.

  • Full guide uses no location at all. Every stop plays in order, wherever you are.
  • Live tour and Roam use your location while the app is open on screen, to show where you are on the route, point you to the next stop and start a story when you reach it.
  • Pocket mode (iOS and Android apps only) also uses your location while the screen is off, so stories keep starting with the phone locked in your pocket. The app asks for "Always" (iOS) or "Allow all the time" (Android) only from the Pocket mode screen, after explaining why. Location is followed only while a tour or a roam is open, and it stops when you end it.

Your position is used on your device. It is sent to our server in exactly one case: in Roam, to answer "which narrated places are near me"; the query is answered and not stored. A position rounded to one decimal place (about 11 km) is used to show the weather and the name of the town you are in: it goes to MET Norway, the Norwegian Meteorological Institute, for the weather, and for the town name to your phone's own geocoding service (Apple or Google) in the apps, or to OpenStreetMap's Nominatim in the web app. None of them receives anything that identifies you.

We never build a history of where you have been. What your account keeps from a walk is which stops you heard, how far you walked and for how long — not the path.

Location access is your choice (Art. 6(1)(a) GDPR). You can withdraw it at any time in your device or browser settings; the Full guide keeps working without it.

What we store, and when

Nothing below exists unless you do the thing it describes.

  • When you create an account: your email address, a hash of your password (never the password itself), a user id and the language of the app at sign-up, so that sign-in emails reach you in your language.
  • When you fill in your profile (optional): display name, avatar image link, a short bio and your home city. They are shown to you on your account screen. Your display name is also shown to the people who join a group walk you host; the rest of your profile is never shown to anyone else.
  • When you change a setting: guide language, units, light or dark theme, autoplay and notification preferences, so the app behaves the same on your next device.
  • When you walk a tour or roam while signed in: the tour or city, when you started and finished, which stops you heard, the distance walked and the minutes listened — your walk history, and what lets you resume an unfinished walk.
  • When you save a walk: the tour's id, so your favourites follow you across devices.
  • When you build your own walk: the stops you chose and the route between them.
  • When you host or join a group walk: the host, the tour and the joining code. While the walk runs, the group's devices share which stop is playing and the playback position — never anyone's location. The group record is deleted automatically after 7 days.
  • When you answer a quest riddle: the answer you typed, to check it.
  • When you send a bug report or idea: your message, an optional reply email address, and the context the app shows you before you send it — app version and build, platform, operating system version, device model, and the screen, tour and stop you were on. Reports can be sent without an account.

The app also keeps a few things only on your device: your sign-in session, language and theme, saved walks while signed out, a cached weather forecast, an unfinished walk so it can be resumed, and any bug report it could not send yet. In the web app this is your browser's local storage, which also records that you dismissed the cookie notice, and the web app sets no cookies; like the website's storage above, it is strictly necessary for what you asked for and needs no consent. Signing out, clearing your browser data or uninstalling the app removes it.

4. What we do not do

  • No advertising and no advertising identifiers.
  • No analytics or tracking software of any kind, in the website, the web app or the apps.
  • No access to your contacts, photos, camera or microphone. The app cannot record audio.
  • No sale, rental or exchange of personal data, ever.
  • The motion sensor is read for one thing only: shaking the phone to open the bug-report form. Nothing from it leaves the device.

5. Who else receives data

Providers that run part of the service on our behalf. Supabase, Amazon Web Services and Netlify do so under the data processing agreement that is part of their terms:

  • Supabase, Inc. — database, sign-in and group walks. Everything in section 3 that is stored in an account, plus your IP address on each request. Your account data is hosted on Amazon Web Services in Ireland (EU).
  • Amazon Web Services EMEA SARL — stores the audio narration and the photographs of places shown on the website and in the apps in Paris (EU), and serves them through its CloudFront network, which receives your IP address and the file requested (see section 2 for the website); and sends the sign-in emails (address confirmation and password reset), which requires your email address, and forwards bug reports to our inbox. Email is sent from its servers in the United States, under the safeguards in section 6.
  • Netlify, Inc. — hosts this website and the web app (see section 2).
  • Expo (650 Industries, Inc.) — delivers fixes to the apps without a store update. It receives your IP address, the app's platform and version, and a random identifier for the installation that is not linked to you. Expo does not learn who you are and processes this under its own privacy policy and the EU–US Data Privacy Framework.

Services the app calls directly, which by the nature of a web request see your IP address and what was asked for:

  • VersaTiles (map tiles) — the map areas you look at.
  • FOSSGIS e.V. / OSRM (walking routes) — the coordinates of a tour's stops, not your position.
  • MET Norway (weather) — a position rounded to about 11 km.
  • Apple or Google (town name, apps) and OpenStreetMap Nominatim (town name, web app) — the same rounded position.
  • Wikimedia Commons (photos of places) — which photo was requested.

The iOS and Android apps are distributed through Apple's App Store and Google Play, which process your data under their own privacy policies when you download them.

6. Transfers outside the EU

Some of these companies are based in the United States or route traffic through servers worldwide. Where personal data leaves the European Economic Area, it does so under the safeguards the GDPR provides: the EU–US Data Privacy Framework, for companies certified under it, or the European Commission's standard contractual clauses. Your account data itself is stored in Ireland.

7. Legal bases

Under the GDPR we process your data because it is necessary to provide what you asked for (Art. 6(1)(b): an account, a walk, a saved favourite, a group walk, a riddle checked); because we have a legitimate interest in keeping the website and the app working and secure (Art. 6(1)(f): server logs, bug reports and the context attached to them, update delivery, answering your emails); or because you chose to (Art. 6(1)(a): granting location access, which you can withdraw at any time).

8. How long we keep it

  • Account data: until you delete the account. Deleting it removes it immediately.
  • Group walks: deleted automatically 7 days after they are created.
  • Bug reports: until the problem is dealt with and the report is no longer needed, or earlier if you ask us to delete it. A report sent while signed in loses its link to you the moment you delete your account.
  • Emails you send us: until the matter is closed.
  • Data on your device: until you sign out, clear it or uninstall the app.

Where the law requires us to keep something for longer, we keep it only for that purpose and delete it afterwards.

9. Deleting your account

In the app or the web app: Account → Delete account. It removes your account, profile, settings, walk history, favourites, the walks you built and the group walks you host, at once. Without the app, email privacy@neywo.com from the address on the account. Everything is explained step by step on the account deletion page.

10. Your rights

You can ask to access the data we hold about you, correct it, have it deleted, receive a copy of it in a portable format, restrict how we use it, or object to processing based on our legitimate interest. Where processing is based on your consent, you can withdraw it at any time without affecting what was done before. Write to privacy@neywo.com; we answer within one month.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority where you live.

11. Children

Neywo is not directed at children. You must be at least 14 to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has created an account, tell us and we will delete it.

12. Security

Everything travels over HTTPS. Passwords are stored only as hashes. Every table in our database enforces row-level rules, so an account can only ever read its own data.

13. Changes

If this policy changes, the date at the top will change with it. If a change affects how we use the data in your account, we will tell you by email before it takes effect. Earlier versions are available on request.