Privacy Policy

1. Who we are

Road to 100 is developed and operated by Zawa Studio. If you have any questions about this Privacy Policy, contact us at zawastudio2026@gmail.com.

2. What data we collect

We collect only what is necessary to provide the service:

• Email address — when you create an account. Used solely for authentication (magic link sign-in or Google OAuth).
• Visited countries list — the list of countries you mark as visited. This is the core data of the app.
• Personal travel plan — routes you add to your personal Road to 100 plan.

We do not collect your name, location, device identifiers, or any payment information. We do not use analytics trackers or advertising SDKs.

Guest users (no account): all data stays on your device in localStorage. Nothing is sent to our servers.

3. How we use your data

• To sync your visited countries across devices when you are signed in.
• To authenticate you when you sign in.
• To allow you to delete your account and all associated data on request.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-party services

We use Supabase (Supabase Inc.) as our database and authentication provider. Your email address and visited countries list are stored on Supabase's servers. Supabase is GDPR-compliant and processes data under a Data Processing Agreement. For details, see the Supabase Privacy Policy.

If you sign in with Google, authentication is handled by Google LLC under their Privacy Policy.

5. Data retention

Your data is retained for as long as your account exists. You can delete your account at any time from the Account page — this permanently deletes your email address and all visited countries data from our servers within 30 days.

6. Your rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right of access — request a copy of your data.
• Right to rectification — update incorrect data.
• Right to erasure — delete your account and all data via the Account page, or by emailing us.
• Right to data portability — request your data in a machine-readable format.
• Right to object — object to processing of your personal data.

To exercise any of these rights, contact us at zawastudio2026@gmail.com.

7. For California residents (CCPA)

We do not sell personal information. California residents may request disclosure of the categories and specific pieces of personal information we have collected by contacting us at zawastudio2026@gmail.com.

8. Children's privacy

Road to 100 is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.

9. Security

We use industry-standard security measures including HTTPS encryption, Supabase Row Level Security (each user can only access their own data), and HTTP security headers (HSTS, CSP, X-Frame-Options).

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the effective date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact

Zawa Studio
zawastudio2026@gmail.com