Last updated: 28 September 2026
Terrivo is operated by OutlandWeb (Payroux, France). Contact for any privacy question: marissa@terrivo.app.
You can use most of Terrivo without an account. If you create one, we store your email address, display name, a securely hashed password (or your Google sign-in identity) and your account activity. Signing in sets a strictly necessary session cookie plus a small non-secret flag that tells the app a session exists.
When you are signed in you can save events, places and stays as favorites. We store the combination of your account, the type of item and its ID, so your list stays the same after signing out, on another device and after a reload. Tapping a heart while signed out saves nothing: we only show a note asking you to sign in first.
Discovery needs a starting point, and you choose it: either you explicitly share your device location once, or you search and pick a town yourself. Your manual choice takes priority. Your last chosen or shared position is stored on THIS DEVICE (browser localStorage, key `tv_last_pos`) for up to 7 days so the app can show your surroundings after a reload; it is never sent to your account. You can clear it any time with “Clear saved location” next to the location picker, or by clearing your browser storage. Shared coordinates are used to calculate the list around you (car: up to 30 km, walking: up to 5 km) and are not saved to your account, not linked to a profile and not used to follow you. Terrivo never tracks your location in the background and keeps no location history.
If you photograph or upload a poster, the image is sent to our servers and processed by an AI extraction service (Anthropic Claude models through the Emergent platform gateway) to read title, date, time, place and description. You confirm you may use the image. The image and extracted draft are stored with your submission so a moderator can check it before the event goes public; rejected or unused submissions are removed during normal cleanup.
Places, stays, events, reviews and photos you submit are stored with your account (or as an anonymous submission) and reviewed before publication. Uploaded images are held in our object storage (Emergent-managed) and are public once the item is published. Do not upload photos you do not have the rights to.
Place and event pages may include data from OpenStreetMap, DATAtourisme, OpenAgenda, Opendatasoft, other public event sources, optional Google Places enrichment, Wikimedia photos and owner submissions — including website, phone, opening hours and any email published as a public contact. Owners can request a correction at any time.
The LocalSite preview is anonymous: no account, no email address and no payment are needed to generate and view it. We store the business details, texts, photos and logo you provide, your design and language configuration, uploaded media and your own event submissions. If you buy a LocalSite, Stripe handles the payment, a Terrivo account is created for the email you used, and we send transactional email through Resend. We keep a change history of your site and record when an administrator assisted you. Visitor statistics of a customer site are aggregated and only collected from visitors who accepted analytics.
A Local Guide contains content owned by the accommodation: practical guest information, its own programme, recommendations and nearby events. Guests open the guide through a QR code or link without signing in — we do not create guest accounts and we do not build guest profiles. Usage is measured only as aggregated counts (guide opened, which section, which language) and only from visitors who accepted analytics.
Payments run through Stripe Checkout. We never see or store card details. We keep the invoicing details you enter, the Stripe identifiers of your session/subscription and the payment status, because we need them for accounting and support.
We send transactional email (purchase confirmation, activation link, expiry reminders, support replies) through Resend. We do not send marketing email without a separate request.
Terrivo runs its own analytics in our own database: no Google Analytics and no third-party analytics platform. Advertising measurement is a separate category, described in the next section. Nothing is measured until you press Accept in the privacy panel: with no choice, or after Decline, no analytics request is sent at all. When you accept, we count page views, search terms, app installs and product usage (a LocalSite or Local Guide being opened, which section, which language, CTA clicks) with an opaque random visitor ID stored in your browser. We do not store your IP address, we filter bots server-side, we honour Do-Not-Track / Global Privacy Control, and analytics records are deleted automatically after 90 days.
Terrivo itself shows no third-party advertising: there are no ad slots in the app, on a LocalSite or in a Local Guide, and nobody pays us to rank higher. We do advertise Terrivo on other platforms, and to see whether that advertising works we use two measurement tools — only on the basis of your consent (GDPR Article 6(1)(a)): the Meta Pixel, which measures page views on terrivo.app, and the Google tag for Google Ads conversion measurement (GT-MRLRR9JH, Google Ads account AW-18478727100). Google Consent Mode v2 is active: advertising and analytics storage are set to "denied" before you make a choice, so no advertising cookie is written or read until you accept, and when your browser sends Do-Not-Track or Global Privacy Control the Google tag is not loaded at all. When a LocalSite purchase is completed and confirmed by Stripe, we report one conversion to Google Ads consisting of the amount paid in euros and a pseudonymous payment reference. We send no name, no e-mail address, no address, no card data and nothing you typed into a form. Test payments, previews, unpaid, cancelled, failed or expired payments are never reported, and one real payment is reported once. You can refuse in the privacy panel and withdraw your consent later via the privacy shield; measurement then stops. We never sell your data.
Your interface language, your chosen Discovery starting point and travel mode, and whether you have already seen the privacy panel are stored in your own browser, not in your account.
Stripe (payments), Resend (transactional email), the Emergent platform (hosting, object storage for uploads and the AI gateway to Anthropic Claude models), Google (sign-in with Google and, where enabled, Places data/photos), OpenStreetMap Nominatim (geocoding for manual place search), Meta (advertising measurement, only after consent), Google Ads (conversion measurement of our own campaigns, only after consent), and the public data sources listed above. We never sell your data. Meta and Google Ads are the only advertising partners involved, they are used purely to measure our own campaigns, and they are never used to show advertising inside Terrivo.
Administrator actions on paid products (for example assisting a LocalSite or activating a Local Guide) are recorded with the administrator involved, and our servers keep standard technical logs for security and troubleshooting.
You can request access, correction, export or deletion of your data at any time via marissa@terrivo.app. We answer within 30 days, as required by the GDPR. You can withdraw analytics consent at any time in the privacy panel.
Account data is kept while your account exists. Analytics records are deleted after 90 days. Product data (LocalSite, Local Guide) is kept for the contract period plus the retention window described in the contract, after which it is removed.
Terrivo is not directed at children under 16.
If we materially change this policy we will say so in the app and, where required, ask for your consent again.
Privacy-friendly analytics
Anonymous in-house analytics. Advertising measurement (Meta, Google Ads) only if you accept. Read more