Privacy policy

Who runs this site

Barefoot Nomad is a personal portfolio project built and operated by Raymond Mwaura. It is not a company, and it is not a commercial service. It exists to demonstrate the application publicly.

For any question about your data, or to have it deleted, email raymwauradev@gmail.com.

What is collected

Only what the application needs to function:

• Account details you enter: first and last name, email address, and optionally phone number, department and profile picture.
• Your password, stored only as an argon2id hash. The plain password is never stored and cannot be recovered.
• If you sign in with Google: your name, email address and profile picture. Nothing else is requested, and no access to your Google account beyond identifying you.
• Content you create in the app: trip requests, bookings, comments, ratings and feedback.
• Technical records: server logs and error reports, which may include your IP address and browser type.

Google sign-in

Signing in with Google is optional — email and password works equally well. If you use it, the app requests three standard scopes only: openid, email and profile.

These identify you and populate your profile. The app cannot read your Gmail, Drive, Calendar, contacts or any other Google service, and it does not request offline access or store Google tokens beyond the sign-in session.

How the data is used

To create and authenticate your account, show you the parts of the application your role permits, and send transactional email such as address verification and password resets.

Your data is not sold, rented or shared with advertisers. There is no advertising, profiling or tracking on this site.

Cookies

Strictly necessary cookies only. A session cookie keeps you signed in, and a CSRF token cookie protects sign-in forms against cross-site request forgery.

There are no analytics, advertising or third-party tracking cookies, so there is nothing to opt out of.

Where the data is stored

Application data lives in a PostgreSQL database hosted by Neon in Frankfurt, Germany, and the application runs on Vercel with its server functions in the same region.

These providers process data on the app's behalf:

• Vercel — Application hosting and server logs. Functions in Frankfurt (fra1).
• Neon — PostgreSQL database storing all application data. EU — Frankfurt (eu-central-1).
• Google — Optional sign-in, if you choose to use it. Global.
• Resend — Transactional email — verification and password reset. Global.

How long it is kept

Demo accounts and the sample data attached to them are deleted and recreated automatically every night, so anything entered while exploring a demo account is short-lived by design.

If you register a real account, your data is kept until you ask for it to be deleted. Because this is a portfolio demonstration rather than a service, the database may also be reset at any time without notice.

Your rights

You can ask for a copy of your data, ask for it to be corrected, or ask for it to be erased. Email raymwauradev@gmail.com and it will be actioned — realistically within a few days, as this is a personal project.

Because data is stored in the EU, the GDPR framework applies. You also have the right to complain to a data protection authority.

Security

Passwords are hashed with argon2id. All traffic is served over HTTPS. Session tokens are signed, and access to each part of the application is checked on the server against your role.

No system is perfectly secure, and this one is a demonstration project maintained by one person. Please do not enter real, confidential or sensitive personal information into it.

Children

This site is not intended for anyone under 16, and accounts should not be created by them.

Changes

If this policy changes, the date at the top of this page changes with it. Material changes will be noted here.