Privacy Policy

The controller of personal data is the owner of backpack.travel. For any question about how data is handled, write to hello@backpack.travel.

This policy follows Federal Law No. 152-FZ "On Personal Data" and applies to every service on the site.

You give us yourself:

• your email address and password (the password is stored only as a hash, never in plain text);
• name, avatar, profile description, date of birth, gender and country — if you filled them in;
• the content of the photographs and texts you upload, including the capture metadata inside the files: date, camera model and coordinates, unless you stripped them;
• the content of your private messages;
• interface language and colour theme.

External services pass on when you sign in through them:

• Google — account identifier, name, email address;
• Telegram — identifier, name, username, link to a photo.

Collected automatically:

• your IP address and User-Agent at the moment you accept the terms of service — as evidence of consent;
• web server records of requests: address, time, page;
• cookies and browser local storage (clause 7).

• creating an account, signing in and restoring access;
• publishing your content and crediting you as its author;
• running private messages and notifications;
• personalisation: language, theme, saved places and routes;
• payment and accounting for paid features;
• protecting the service against automated scraping, spam and abuse;
• proving that the terms of service were accepted and handling notices from rights holders;
• service emails about how the site works.

Data is not used for profiling with legal consequences and is not sold to third parties.

Processing rests on your consent, given during registration by ticking the corresponding box, and on performance of the terms of service to which you are a party.

Providing data is voluntary, but an account cannot be created without an email address and a password.

We share data only with those without whom the service cannot run, and only as far as needed:

• the hosting provider whose servers hold the site and the database;
• the mail service — to deliver messages;
• payment services — when paid features are purchased (card details bypass us entirely; we neither receive nor store them);
• Google and Telegram — as far as needed to sign in through those services, under their own policies.

Data may also be disclosed to government authorities on a substantiated request in the cases the law provides for.

Profile data and published content are kept for as long as the account exists. After an account is deleted they are erased or anonymised within 30 days.

Only records the law requires live longer: evidence of accepting the terms and correspondence about rights holders' notices are kept for three years — the general limitation period. Server technical logs are kept up to 12 months.

We use cookies and browser localStorage to keep you signed in, remember your language and theme, and save drafts. Without them the site will not work: you would be signed out on every page reload.

There are no advertising or tracking cookies from third-party ad networks on the site. You can disable cookies in your browser settings — sign-in will then be unavailable.

You have the right to:

• find out which of your data we process;
• correct inaccurate data — most fields can be changed in your profile;
• withdraw consent and demand deletion of your account together with its data;
• demand that processing stop if it is carried out unlawfully;
• complain about our actions to Roskomnadzor or in court.

Send your request to hello@backpack.travel from the address registered to the account. We reply within 30 days.

Withdrawing consent means deleting the account: without processing your data the services that require sign-in cannot be used. Content you published is deleted with the account, except edits to the shared articles about countries and cities — those stay in the wiki with authorship removed, as in any collaborative encyclopaedia.

The connection to the site is encrypted with HTTPS, passwords are stored as irreversible hashes, and only the project administrators have access to the database. No protection is absolute — do not publish anything you are not prepared for anyone to see.

The service is not intended for anyone under 14. If we learn that an account was created by a child below that age without parental consent, the account will be deleted.

The version in force is always available on this page and its date is shown in the header. For material changes we will ask you to accept the new version at your next sign-in.