Privacy policy

Effective October 15, 2026.

Ukraine by locals is a service for tours, adventure trails, events, hospitality places, points of interest and stories that locals and travellers create and edit together. You can use it on ukrainebylocals.guide and through our bot in Facebook Messenger and Instagram. This page explains what data we collect, why, and how you control it.

In short

  • We only use data you give us yourself and data the service can't work without.
  • We don't sell your personal data or share it with anyone for advertising or marketing. There are no ads, third-party analytics or trackers on the site.
  • Materials you publish for everyone (tours, places, stories and so on) are edited together by other members, so they stay on the site after you delete your profile, signed with your nickname.
  • You can delete your profile at any time, and the bot's data about you with a single command. See Data deletion.

What we collect

  • Profile: email, nickname, name (optional), interface language, password (stored only as a cryptographic hash), notification settings, profile links you add.
  • Your contributions: materials, their edits and change history, photos, reviews, stories, community posts, role applications.
  • Messages and bookings: private messages, tour bookings, travel mate requests and responses. Private message texts, booking notes and reports are stored encrypted in the database.
  • Technical data: IP address and browser details for each sign-in session (so you can see your sessions and we can protect accounts), a hash of the IP address in error reports, server logs.
  • Cookies: only those needed to work: your sign-in session, chosen language, and a temporary ID for proposals made before signing up. No advertising or analytics cookies.
  • Messengers: when you write to our bot in Facebook Messenger or Instagram, Meta gives us an ID issued specifically for our page, your profile name if Meta provides it, and the text of your messages to the bot. We store that ID, the name, your chosen language, the link to your website account (if you made one) and the bot message log. The log is deleted automatically after 30 days.

We don't collect payment cards, ID documents, biometrics or other special categories of data. Please don't send them in messages.

Why we use it

  • to let you sign in, create and edit materials, book tours, talk to people and find travel mates;
  • to send notifications you turned on: by email, on the site or in a messenger;
  • so the messenger bot can answer your requests and, if you linked your account, act on your behalf;
  • for safety: protection from bots and spam, moderation, handling reports, fixing errors.

The legal basis is providing the service you asked for, your consent (for example, to messenger notifications, which you can withdraw) and our legitimate interest in keeping the service safe.

What others see

Other members see your nickname, your name (if you set one), published materials, reviews, community posts and approved profile links. Nobody but you sees your email. Private messages are visible only to the people in the conversation. Hospitality contacts that an owner publishes in a material are visible to everyone.

Who data may reach

We don't share data with third parties except technical providers the service needs to run, and only as much as needed:

  • Hostinger — the server running the site and database (Netherlands, EU);
  • Google (Google Workspace) — sending emails: email confirmation, password reset, notifications;
  • Meta — delivering messages if you talk to the bot in Facebook Messenger or Instagram; Meta processes them under its own policy;
  • OpenStreetMap — your browser loads map tiles from OpenStreetMap servers, which see your IP address.

We disclose data only when the law requires it, in response to a lawful request from authorities.

How long we keep data

  • Your profile — as long as you use it. Once you ask to delete it, it becomes inactive immediately and is permanently erased after 30 days.
  • The bot message log — 30 days. Everything the bot stores about you is deleted at once with the command “forget yes”.
  • Sign-in sessions — until you sign out or delete your profile.
  • Database backups — 14 days, then deleted automatically.
  • Published materials and their history — as long as the service exists, since they are shared work of the community.

Your rights

You can view and correct your data in your profile, unlink a messenger, turn off notifications, and delete your profile or the bot's data. You can also ask for a copy of your data, restriction of processing or deletion of specific data by writing to support@ukrainebylocals.guide. We reply within 30 days. If you believe your rights were violated, you can complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your country.

Security

The site works only over HTTPS, passwords are stored as hashes, private messages and notes are encrypted in the database, messages from Meta are checked by cryptographic signature, and only administrators can access the server, using keys.

Children

The service is not intended for people under 16, and we don't knowingly collect their data. If you think a child has signed up, write to us and we'll delete the profile.

Changes

We'll announce significant changes on the site or by email. The effective date is shown at the top of this page.

Contact

Questions about data and requests: support@ukrainebylocals.guide.