Privacy

Avanture is a small project about food walks in Varaždin. This page says plainly what the site stores about you and what you can do about it.

Before the site opens to the public we will add the name and contact address of the person behind it, and the exact retention periods below. Until then this page describes what the software does, which we would rather tell you than invent.

Last updated: 22 October 2026

What we store

Your account

Your email address, the display name you chose, and a hash of your password. We never store the password itself and can never show it to you or to anyone else. We keep the date you joined and whether you are a member, a moderator or an administrator.

Your ratings

The number of stars, your comment if you wrote one, when you rated, and when you last changed it. Your display name is shown next to the rating, and your email address is not.

Your photos

The picture you uploaded, the alt text and attribution you wrote with it, and the date. The server re-encodes every picture, strips the metadata (including location data) and keeps the original file out of reach of the web.

Your session

When you sign in, the server keeps a session: a random identifier, the time it was created, when it was last used and when it expires. The password is never part of it.

Guest ratings

If you rate a stop without an account, the site keeps a random guest identifier in a cookie so your ratings are not lost and can be claimed later. It is not linked to your email address and it does not identify you as a person.

Security token

After signing in, the site keeps a short-lived security token in that browser tab, so that other pages cannot pretend to be you. It is not a password and it cannot sign you in.

Cookies

Three cookies, none of which the site can work without:

• avanture_session — keeps you signed in. It is marked HttpOnly, so scripts cannot read it, and it is only sent over an encrypted connection. It holds a random identifier, not your details.
• avanture_guest — remembers the ratings you made as a guest, so they are still there when you come back and so you can claim them after you sign up. It holds a random identifier too.
• avanture_csrf — a security token the page sends back with every change it makes, so another site cannot pretend to be you. It holds nothing about you.

There are no advertising cookies, no analytics cookies and no third-party cookies. The site loads no trackers at all. Signing out deletes the session cookie; clearing your cookies removes the guest one too, along with the guest ratings it was holding.

How long we keep things

• Your photos stay until you remove them yourself or delete your account.
• Your ratings stay until you remove them yourself. Deleting your account takes your name off them but keeps them.
• Your account stays until you delete it.
• A session ends when you sign out, or when the server expires it.
• Guest identifiers and the ratings tied to them expire by themselves after a while.

The exact periods for sessions and guest identifiers are set by the server configuration and will be published here before the site opens.

What you can do

• Change or delete your ratings and photosat any time, from your account page.
• Export your data as a JSON file with your account details, your ratings and your photos.
• Delete your account. Deleting it removes your account details and your photos. Your ratings stay on the stops with your name removed.
• Ask us to change your email address or password, or to remove something you would rather not keep. There is no self-service button for those yet, so write to us.

Who else sees your data

We do not sell your data, and we do not share it with advertisers, data brokers or anybody else who wants to advertise to you. Two parties handle it in order to run the site: the company that rents us the server the API runs on, and the network provider that carries the traffic between your browser and that server. Both handle it only to deliver the site.

Children

This is a site about restaurants, not aimed at children. We do not knowingly collect data from children. If you believe a child has an account here, write to us and we will remove it.

Changes

If we change what we store or how long we keep it, we will update this page and change the date at the top. This is a working document for a small project, so it may still be incomplete — we would rather say that than make promises we have not built yet.