Privacy policy

Last updated: 26 September 2026

This policy explains how the DoVe app (iOS and Android) and the dovevenezia.com website process personal data, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

In short. DoVe requires no sign-up, builds no profiles, shows no ads, does not track you across other companies' apps or websites and does not sell data. Little data leaves your phone, and only when a feature you are using needs it or, in pseudonymous form that you can switch off, to learn which sections of the app are used.

1. Data controller

Andrea Toffanello, who publishes the app and the website under the name "DoVe Venezia". Email: info@dovevenezia.com

No data protection officer (DPO) has been appointed: one is not required for this kind of processing (Art. 37 GDPR). Use the address above for any request.

2. What happens on your device

The app stores on your device your preferences (language, theme, favourite stops), a copy of public data (house numbers, timetables, pharmacies) so it works offline and, if usage statistics are on, the statistics queue waiting to be sent (section 6). This data stays on your device and is deleted when you uninstall the app.

3. Content updates

The app periodically downloads updated public data and content (timetables, pharmacies, events, images) from our servers and those of the providers listed in section 9. These requests contain nothing that identifies you; as with any Internet connection, the responding server receives your IP address and technical information (device type, app version), which providers may record in their technical logs for security and operation.

• Purpose: delivering up-to-date content; infrastructure security.
• Legal basis: legitimate interest in providing and protecting the service (Art. 6(1)(f) GDPR).
• Retention: in providers' technical logs, for the periods they set for security; nothing is kept in our databases.

4. Location

The app accesses your device's location only if you grant permission, which you can refuse or withdraw at any time in the system settings: DoVe works without it.

• On the device: location is used to show you on the map and to measure distances to stops, pharmacies and places. This use never leaves the phone.
• Trip planner: if you choose "Your location" as the starting point, your precise coordinates are sent to our route-planning server together with the destination, solely to compute the route you asked for. The names of places and addresses you type into the planner's search go to the same server.
• Search: see section 8.
• Retention: coordinates and search text are used only to answer the request and are not recorded: they are not stored in any database or in the server logs, and they are not linked to any identifier. The server's technical request log, used to diagnose faults, contains no coordinates, no search text and not your IP address. To answer identical requests faster, the server keeps the response in memory for at most 15 minutes, with nothing that identifies you.
• Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR); access to the device's location is based on your system permission (Art. 122 of the Italian Privacy Code).

Location is never used for usage statistics, advertising or profiling.

5. Push notifications

If you allow notifications, the app registers on our server a technical device identifier (notification token) issued by Apple or Google, together with the platform. The token is used only to send you alerts about timetables, on-duty pharmacies and other service information.

• Legal basis: your consent, given through the system permission (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time by turning notifications off in your device settings.
• Retention: while the token is valid; when Apple or Google report it as no longer active (for example after the app is uninstalled), we delete it at the next send.
• The token is not linked to your identity and is not used for advertising.

6. Anonymous usage statistics

To understand which sections and features are actually useful (for example how often the Tide section is opened or the trip planner is used), DoVe collects minimal usage statistics. We call them "anonymous" because we do not know, and do not want to know, who you are; technically, the random identifier described below is pseudonymous data, so we handle it with every safeguard that applies to personal data.

What we collect

• Names of the screens and features used, with counts, platform, app and system version, and language. Never the text you type in Search, never the origin or destination of a trip.
• A random identifier created by the app the first time it sends statistics. It is not the device identifier, not an account, not the notification token, and it is not linked to any other information about you.
• The day and hour (time slot), never an exact timestamp.
• In a separate request that carries no identifier at all, daily counts of the stops, lines, pharmacies, films and places opened most often, so the sequence "this installation opened this stop" exists nowhere.

This flow never collects your location, your search text or your IP address: the IP is not stored in the statistics database; it may appear briefly in the hosting provider's technical logs, for security only.

Purpose and legal basis. Measuring how sections are used so we can improve them and decide where to invest, based on our legitimate interest (Art. 6(1)(f) GDPR). We have balanced it against your rights: minimal pseudonymous data, no profiles, no combination with other data, no disclosure to third parties, short retention, and a one-tap switch to turn it all off. For the same reasons, the identifier stored on the device falls within the first-party statistical tools that the Italian Data Protection Authority's Guidelines on cookies and other tracking tools (10 June 2021) treat like technical tools, which need no prior consent.

Retention

• Raw data (screens and features with the identifier): 7 days, then deleted.
• "Active on this day" marker for the identifier: 45 days.
• Identifier with its first and last active day and app version: up to about 13 months (400 days) after the last activity, then deleted.
• Everything else (how many people use each section, how many come back) exists only in aggregate form, which cannot be traced back to a single installation and is not personal data.

The data is stored on servers in the European Union (Frankfurt).

How to object. In Settings → "Anonymous usage statistics" you can turn collection off at any time (right to object, Art. 21 GDPR): the app deletes the identifier and the queue from your device and sends nothing more; the server copy expires on the schedule above. Collection is active in the app versions that show this switch.

7. Event submissions

If you use the "Suggest an event" form (on the website, including when you open it from the app), the data you enter is sent to our servers so we can review and publish the submission.

• Data: the event details you write (title, date, place, description, links); any attachments you choose to upload (posters, programmes); name and email, optional, only to contact you if something is unclear; a technical identifier of the request origin, irreversibly encrypted, used only to limit automated submissions.
• Legal basis: for the submission and contact details, carrying out the request you make to us (Art. 6(1)(b) GDPR); for the anti-abuse identifier, our legitimate interest in protecting the form (Art. 6(1)(f)).
• Retention: while the submission is under review and, if published, to trace the source of the information. Contact details never enter a mailing list and are not used for marketing or disclosed to third parties.
• If you are under 14, do not enter your name and email.

By uploading an attachment you confirm you have the right to share it. You can ask for your submission and contact details to be deleted by writing to the address in section 1.

8. Search

Search answers the questions you type or dictate ("open pharmacy near me", "tide tomorrow", "line 2 from Rialto"). Questions are processed by DoVe's Search server (cerca.dovevenezia.com), on Hetzner servers in the European Union, reached through Cloudflare's network over an encrypted connection.

• Question text: for each question the app sends the server the text, a structured summary of the previous questions in the same conversation (to understand follow-ups such as "and tomorrow?"), the language, the platform and the app's active sections. The server uses them in memory to answer and does not store them: no archive of questions, no text in logs, no identifier attached. The conversation stays on your phone.
• Questions DoVe's rules do not understand (about one in three): the question text and the conversation summary are also passed to Google, through the Gemini API, to be interpreted. Google receives only the text: never your location, never identifiers, never your device's IP address, because the request comes from our server. Google acts as our processor under the paid Gemini API terms, which in the European Union apply to all use: it does not use the questions to train or improve its products and keeps them for 55 days solely to detect violations of its usage policies, after which it deletes them.
• Location: leaves your phone only for questions that use it ("near me", "the closest", "from where I am") and only if you have granted location permission. In that case the app sends your precise coordinates in a second request; the server uses them in memory to compute distances and ordering and then discards them: it does not store them, write them to logs or send them to Google. Questions such as "tide tomorrow" or "Cannaregio 1234" never send your location. Without permission Search still works and, for proximity questions, offers to turn it on.
• IP address: the server uses it only to limit abuse (too many requests), in memory, encrypted with a key that changes at every restart, for at most 10 minutes; it does not appear in logs. Cloudflare processes it to route and protect the connection.
• Counters: the server keeps only aggregate counts (questions per day by language and platform, outcomes, response times, costs), with no text, locations, IP addresses or identifiers, kept for 400 days. They cannot be traced to anyone and are not personal data. The app's usage statistics (section 6) record only that Search was used and the type of answer, never the text.
• Log of misunderstood questions: the server provides for a log of the text of only those questions that even the model does not understand, to improve Search's rules (digits masked, no location, IP or time, kept 30 days). It is switched off; we will update this policy before switching it on.
• Legal basis: for text and location, performance of the service you request (Art. 6(1)(b) GDPR); for the IP used against abuse, our legitimate interest in protecting the service (Art. 6(1)(f)). Search asks for no additional consent: it uses the location permission the app already requests. The first time you open it, an information sheet sums up these rules.

9. Recipients and providers

Data is not sold or disclosed to third parties for their own purposes. The following providers process it on our behalf under written agreements (Art. 28 GDPR):

We also use platform services that process data under their own policies: Apple (MapKit maps and APNs notifications on iOS, policy), Google (Firebase Cloud Messaging notifications on Android, policy) and OpenFreeMap (map tiles on Android, an open-source project that only receives requests for the map areas to display).

10. Transfers outside the European Union

Our servers and databases are in the European Union. Some providers belong to groups headquartered in the United States and may access data from there (for example for technical support or security). In those cases the transfer is covered by the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (10 July 2023), for certified providers, and in any case by the Commission's standard contractual clauses (Decision 2021/914) included in their data processing agreements.

For the Gemini API, Google also processes question text outside the European Union: the transfer relies on Google LLC's participation in the EU-U.S. Data Privacy Framework and on the standard contractual clauses in its data processing agreement.

11. No profiling

We make no automated decisions about you, build no profiles, do not use data for advertising and do not combine it with other sources.

12. Your rights

You can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR); you can withdraw the consent given through system permissions at any time, without affecting processing already carried out. Write to info@dovevenezia.com: we reply within one month.

By design we do not know who you are: the statistics identifier is neither shown nor linked to you, so in many cases we cannot match a request to your data (Art. 11 GDPR). The fastest route is in your hands: the statistics switch in Settings, and the location and notification permissions in your system settings.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

13. Children

Anyone can use DoVe, including children, and it needs no data to work. The event submission form is the only place where contact details can be entered: see section 7.

14. Changes to this policy

We will update this page when the way we process data changes, before the change takes effect, and show the date at the top. Since we do not collect email addresses, we do not send direct notices.

15. Contact

For any privacy question: Email: info@dovevenezia.com