Legal
Privacy Policy
Last updated
This policy explains what personal data Working Holiday Connect collects, why, who it is shared with and the rights you have. We collect as little as we can: no advertising, no tracking cookies and no selling of data.
1. Who is responsible for your data
The data controller is Dawid Siwek, Poland. For anything about your data, email whconnectteam@gmail.com.
2. What we collect
When you browse without an account
- Your search. The passport and destination you pick appear in the page address (for example
?from=PL&to=JP) so the link can be shared. They are not linked to you. - Device storage. Your light/dark theme and, if you are not signed in, your to-do list ticks are kept in your browser's local storage. They never leave your device. See the Cookie Policy.
- Technical data. Like every website, our servers receive your IP address, browser type and the pages requested. We use it to deliver the site, keep it secure and limit abuse (for example rate limits on posting).
- Anonymous statistics. We use Cloudflare Web Analytics to count visits and page views (for example which pages are viewed, the referring site, country and device type). It sets no cookies, stores nothing on your device and does not identify you or follow you across other websites.
When you create an account
- Account details: your email address, a display name and your password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
- What you post: threads, comments and replies, with the route and topic you choose.
- Your activity: likes you give, threads you save, content you report, your to-do list progress and whether you asked to be emailed about new comments on a thread.
- Your travel status: if you choose one, whether you are planning to go to, have been to or are currently in each destination.
3. Google user data (“Continue with Google”)
Signing in with Google is optional. If you choose it, Google asks for your permission and then shares only these basic profile details with us (the openid, email and profile scopes):
- your name;
- your email address;
- your profile picture;
- your Google account ID, so we can recognise you the next time you sign in.
How we use it. Only to create your account, sign you in and show your name and picture on your profile and posts. We use your email address to contact you about your account and, if you ask for it, to tell you about new comments on your threads. We do not access your contacts, Gmail, Drive, calendar or any other Google data.
How we store and protect it. The data is stored in our database hosted by Supabase, encrypted in transit (HTTPS) and protected by access rules so only your account can change it.
Sharing. We do not sell Google user data, use it for advertising, or use it to train AI models. We do not share it with anyone except the service providers listed in section 6, who process it only to run the site, or when the law requires it. Your email address is never shown to other users.
Keeping and deleting it. We keep it for as long as your account exists. Delete your account (or email whconnectteam@gmail.com) and it is deleted, as described in section 7. You can also remove our access at any time in your Google Account at myaccount.google.com/permissions.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. What other people can see
The community is public. Anyone, signed in or not, can see your display name, your profile picture (if any), the travel statuses you choose, everything you post and which posts your account has liked. Please don't share passport numbers, addresses, phone numbers or other private details in posts. Your email address, saved threads, reports and to-do list are never shown to other users.
5. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, publishing your posts and travel status, keeping your saved threads, syncing your to-do list | Performance of our agreement with you (Art. 6(1)(b)) |
| Emailing you about new comments on your thread | Your consent, which you give by ticking the option and can withdraw at any time (Art. 6(1)(a)) |
| Security, preventing spam and abuse, handling reports and moderation | Our legitimate interest in keeping the service safe (Art. 6(1)(f)) |
| Anonymous, aggregated usage statistics | Our legitimate interest in understanding which pages are useful (Art. 6(1)(f)) |
| Complying with the law and answering lawful requests | Legal obligation (Art. 6(1)(c)) |
We do not sell your data, use it for advertising or make automated decisions that affect you.
6. Service providers
We use a small number of providers who process data on our behalf under data processing agreements:
| Provider | What it does | Data involved |
|---|---|---|
| Supabase | Database and sign-in | Account details, posts, likes, saved threads, travel statuses, reports, to-do progress |
| Cloudflare | Website hosting, content delivery and anonymous analytics | Technical data (IP address, browser, pages requested) |
| Resend | Sending emails | Your email address and the notification content |
| Sign-in, only if you choose “Continue with Google” | Data Google shares when you approve the sign-in |
Some providers are based in, or use servers in, the United States. Where data leaves the European Economic Area it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep it
- Account data, posts and activity: for as long as your account exists.
- When you delete your account, your profile, posts, comments, likes, saved threads, travel statuses, reports and to-do progress are deleted with it. Copies in backups are overwritten within 30 days.
- Server logs and rate-limit records: kept only briefly, normally no longer than 30 days.
- Data on your device: until you clear it in your browser.
8. Your rights
Under the GDPR and similar laws you can ask us to:
- give you a copy of your data (access and portability);
- correct data that is wrong;
- delete your account and data;
- restrict or object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting what happened before.
Email whconnectteam@gmail.com from the address on your account and we will reply within one month. You also have the right to complain to a data protection authority, in particular the one in the EU or EEA country where you live or work.
9. Age limit
You must be at least 16 to create an account. If you believe a younger person has given us their data, contact us and we will delete it.
10. Security
Connections are encrypted (HTTPS), passwords are hashed, and database rules ensure each account can only change its own data. No system is perfectly secure, so please use a unique password.
11. Links to other websites
We link to official government websites and may link to partner offers such as insurance or eSIM providers (marked “Affiliate link”). Those sites have their own privacy policies; we don't control what they collect once you leave our site.
12. Changes to this policy
If we change how we use your data, we will update this page and the date at the top. For important changes we will also tell signed-in users by email or on the site.