Privacy notice
Effective from 7 October 2026
1. Controller
The controller of your personal data is GE-KO, Maja Dolžan s.p., Cesta Toneta Tomšiča 71, 4270 Jesenice, Slovenia, registration number 8732043000, VAT ID SI33880263. For any privacy question or to exercise your rights, write to info@worldstamped.com.
We process data in line with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, username, display name, a hash of your password (we never know the password itself) | Registration, sign-in, confirming your email address, resetting your password | Performance of a contract (Art. 6(1)(b) GDPR) |
| Profile, visibility settings, countries and places with your status, visits and dates, memory texts, photos | Your personal map, storing your content and the sharing you choose | Performance of a contract (Art. 6(1)(b) GDPR) |
| IP address, time and type of request, limits on repeated attempts, security events | Protection against abuse, security and fixing errors | Legitimate interest in providing a secure service (Art. 6(1)(f) GDPR) |
| Visit statistics: the path of the page visited, the page type, language, the website you came from, campaign tags (UTM), device, browser and operating system type, the country you are visiting from, a visitor code that changes every day | Understanding which pages are used and improving the service | Legitimate interest (Art. 6(1)(f) GDPR) |
| The content of your messages and reports | Answering questions, handling reports, complaints and requests to exercise your rights | Performance of a contract or a legal obligation (Art. 6(1)(b) and (c) GDPR) |
Without account data you cannot use the features that need signing in. Texts, photos, exact dates and sharing are optional. We do not use your email address for advertising and do not pass it on to third parties for marketing.
The service does not track your location. If you choose “my location” and allow it in your browser, the position is used only in your browser to move the map. It is not sent to our server and is not stored.
3. Who can access the data
Anyone can see a public profile and public content, even without signing in. A private profile also limits the content under it. Copies others make of public posts are no longer under our control.
The provider accesses data only as far as needed to run and support the service. As a processor we use the hosting provider G-SERVER d.o.o., Slovenia, whose server in a data centre in Slovenia runs the application, the database, photo storage, the service’s outgoing email and backups.
The map, place data and fonts are served from our own server, so using the app does not send your data to outside map, analytics or advertising providers. We may disclose data to competent authorities where the law requires it.
4. Transfers outside the EEA
We do not transfer your personal data to countries outside the European Economic Area.
5. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, entries, memories and photos | As long as you have an account. When you delete your account they are hidden straight away and permanently deleted after seven days. A deletion request by email is carried out within one month at the latest. |
| The file with a copy of your data | It can be downloaded for 10 minutes after it is prepared; we then delete it during the regular clean-up, usually within an hour. |
| Photos you delete | Taken out of use straight away; the files are removed during the regular storage clean-up. |
| Sign-in session | Until you sign out or close the browser; session data on the server is deleted automatically after a period of inactivity. |
| Security and server logs | Only as long as needed for security and fixing errors, then deleted during the regular log rotation. |
| Messages, reports and complaints | Until they are resolved and as long as needed to show how we handled them, at most 24 months. |
| Visit statistics | Detailed records for at most six months. The digest used to confirm that a person opened the page, at most one hour. Daily totals (numbers only, nothing about individual visits) without a time limit. |
| Backups | At most 90 days. They are used only to restore the service; after a restore we repeat any deletions made after the backup was taken. |
6. Photos and security
When you upload photos, we resize them and prepare display versions. We do not keep the untouched original. We remove unnecessary metadata from stored images, including GPS data from the camera. A place or date you type into a memory yourself stays part of your entry.
We use encrypted HTTPS connections, permission checks on every access, secure password storage, private storage for photos and limits on repeated attempts. Nobody can guarantee complete security; if a personal data breach occurs, we act according to our legal obligations.
7. Cookies and storage on your device
We use cookies and on-device storage only where they are strictly necessary for the service; we use no analytics or advertising cookies. Under Article 225(2) of the Slovenian Electronic Communications Act (ZEKom-2), strictly necessary technologies do not require consent.
| Name | Purpose | Duration |
|---|---|---|
worldstamped_session (cookie) | Signing in and protecting forms against abuse | Until you close the browser or sign out |
ws_stats_off (cookie) | Only for the operator of the service: leaves their own browser out of the visit statistics; it is never set for visitors | Two years or until counting is switched back on |
ws:last-tap, ws:dock-announce, ws:map-lit (browser session storage) | Smooth transitions between screens, a navigation announcement for screen readers and a one-time map animation; they contain no personal data | Until you close the tab |
| App cache (service worker) | Faster loading and an offline notice; it stores only the app’s static files, not your profiles, memories or photos | Until the next app update or until you clear the site’s data in your browser |
We use no cookies for visit statistics and store nothing on your device. When you open a page, we record its path; when you interact with the page or keep it open for three seconds, your browser sends only the page path, which confirms the view as a person's. From your IP address and browser details we calculate a visitor code that changes every day; we do not store the IP address. If your browser sends Do Not Track or Global Privacy Control, we do not store the visitor code. We look up the country of your IP address in a database on our own server (IP geolocation by DB-IP, licensed under CC BY 4.0) while the page is served, and keep only the country; if the database has no answer, we estimate the country from the language setting of your browser. Views under the same daily code that follow each other within 30 minutes count as one visit. The statistics are only for us; we do not share them with third parties or link them to accounts.
Viewing the home page and destination pages without signing in does not create a session cookie. It is created only when you sign in, register or use another form.
8. Your rights
Under the conditions of the GDPR you can ask for access to your data and a copy of it, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest. You can also download a copy of your data and delete your account yourself in your account’s security settings. Send other requests to info@worldstamped.com. We verify your identity proportionately, usually through your account’s email address, and reply within one month at the latest.
You can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
9. Children and automated decisions
The service is intended for people aged at least 16. If we learn that a younger person has created an account, we delete it.
We do not profile you for advertising and do not make decisions based solely on automated processing. Limits on repeated attempts are only a technical protection against abuse.
10. Changes
We publish any new version of this notice on this page. We tell you about material changes by email before they take effect. The terms of use are on a separate page.