Time Travel Tours

Privacy policy

Last updated: 14 October 2026

This is a translation of our Dutch privacy policy. If the two differ, the Dutch text applies. Lees het privacybeleid in het Nederlands

Time Travel Tours is a trade name of March & Spit v.o.f., Prof. R. Casimirstraat 68, 1068 SK Amsterdam, the Netherlands, Chamber of Commerce 42100212. We are responsible for the data in this policy. It covers the app, our website and the newsletter. You do not need an account for the app, and we do not ask for your name or email address.

Questions? Email info@marchandspit.com.

What data we process and why

1. Location (GPS). The app uses your location to start audio and video automatically as soon as you reach a place on the route, and to show your position on the map. This also works with the screen off, so the tour carries on while your phone is in your pocket. We only use your location to make the tour work, not to track you for advertising or to build a profile of you. Your location stays on your device: we do not send it to our server.

2. Camera. We use the camera for two things: scanning the QR code that opens a tour, and the Augmented Reality mode, which shows historical objects in 3D over your live camera image at the place where you are standing. The camera image is processed only on your device to make these features work. No photos or videos are stored, sent or shared.

3. Maps. The map in the app loads map tiles and walking routes from Mapbox. Mapbox processes your IP address and sees which part of the map the app requests. If you choose an old map on a tour, those tiles come from Allmaps; your IP address is processed there as well.

4. Device ID. When you first start the app, it signs in anonymously with Firebase Authentication from Google. This gives your device a random ID. That ID is on your device and on our server. On Android, the ID is included in your Google backup: if you restore that backup on a new phone, it gets the same ID and a redeemed code works there too. We link to it: the tours you have opened with a code or with a purchase in the app, your rating of a tour, your progress in a tour (point 5), a group you take part in (point 9), and a count if you reach the end of the free preview without a code: which tour, iOS or Android, and whether you found the app through a link, the Play Store or by yourself. Your name or email address is not part of it. If you have redeemed a code that was bought, the ID can be linked to the email address of the order through that code. If you delete the app, the ID stays on our server. We delete it on request; see Having your data deleted.

5. Progress in a tour. When you start or finish a stop, the app reports this to our server: which tour, which stop, whether you started or finished it, and the time on your device. Without a connection, the app keeps the report for a while and sends it later. The report is linked to the device ID from point 4, and through your code to your order. We use it to answer your questions about a tour, and, if you ask for a refund, to see whether the tour started for you and how far you got.

6. Crash reports. If the app freezes or something goes wrong, it sends a crash report to Firebase Crashlytics (Google). Such a report contains the model of your device, the operating system and its version, the version of the app, the moment of the error, the error message and the place in the code where it went wrong. It also contains technical details of your device, such as the free memory and free storage at that moment, and a random installation number that Crashlytics uses to count how many installations have the same error. Your name or email address is not included. We only use crash reports to find and fix errors. Google keeps a crash report for 90 days and then deletes it.

7. Codes and purchases. You buy a tour on our website, timetraveltours.nl. Payment is handled by Mollie; we never see your card or bank details. With an order we keep your email address, the tour, the amount, the language, the status of the payment with the Mollie payment number, your code, any refunds, and when and with which version you accepted the terms and conditions. We use this to deliver your code, to send it again if you lose it, for questions and refunds, and for our accounts. We send the email with your code through Resend. When you redeem the code, we link it to the device ID from point 4, so the tour opens on that device. A code works on one device, and on Android also on a new phone where you restore your Google backup (point 4). To prevent codes from being guessed, we count wrong attempts per IP address and per device; we keep that count for 24 hours. To prevent abuse of the checkout and of the Lost your code form, we count the requests there per IP address; we keep that count for 24 hours as well.

If you buy a tour in the app on an iPhone or an Android phone, Apple or Google handles the payment. Through RevenueCat, which processes this for us, we only learn which tour you bought, when, the transaction number and your anonymous app ID. We do not receive your name, your email address or your payment details.

8. Giving a tour as a gift. If you give a tour as a gift, we also keep the recipient's email address and your message. We only use them to deliver the code, and to send it again if the recipient loses it. If you received a tour as a gift, we have your email address from the giver, and this policy applies to you too.

9. Walking in a group. If you start a group, or walk along with one, that group is stored on our server: the group code, the tour, the devices taking part with their device ID, when they joined and were last active, and where the group is in the tour. With your device ID we also record which group you are in, so you may follow your tour guide’s tour without a code of your own. A group runs for 8 hours at most. Your name and your location are not part of it.

10. Newsletter. If you sign up, we keep your email address, your language, when you signed up and the text with which you gave your consent: the button and the line below it, as you saw them. The list is kept by us and by Resend, which sends the welcome email and the newsletter. We only email news about Time Travel Tours. You can unsubscribe at any time through the link at the bottom of every email; that withdraws your consent. To prevent abuse of the form, we count sign-ups per IP address; we keep that count for 24 hours. We do not add buyers to the list.

11. Contacting us. If you email us (for example with feedback), we process your email address and message so that we can reply.

12. The website. When you visit, Google (Firebase Hosting, Cloud Functions and Storage) processes your IP address and browser details to deliver the website. Those server logs are kept for 30 days. The site sets no cookies and uses no advertising or analytics services; it only remembers your choice of language in your browser. Fonts and scripts are on our own server: the site loads nothing from Google Fonts or other parties.

Why we may do this

To perform our contract with you: making the tour work (location, camera, maps, device ID, codes and groups) and delivering your purchase or gift.
Because the law requires it: the financial details of an order, for our accounts and the Dutch tax authority.
Based on our legitimate interest: crash reports, your progress in a tour, the count at the free preview, ratings, server logs and preventing abuse. You can always object to this.
With your consent: the newsletter.

Who we share data with

We do not sell your data. We work with these parties:

Mollie (payments; the Netherlands). Mollie is responsible for the payment itself: privacy policy
Google Firebase (hosting, server functions, database, signing in your device, storage of tour material, crash reports): privacy policy
Resend (email: your code, the gift email and the newsletter; United States): privacy policy
RevenueCat (purchases in the app on an iPhone or an Android phone; United States): privacy policy
Mapbox (map tiles and walking routes; United States): privacy policy
Allmaps (old maps on a tour)

Google, Resend, Mapbox and RevenueCat are American companies, so your data may be processed in the United States. This happens on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

How long we keep data

We do not keep data longer than necessary. A daily clean-up task carries out most of these periods. Google deletes server logs and crash reports itself, and we clear email to us by hand.

Order: we keep the order number, date, tour, amount with VAT, the Mollie payment number and refunds for 10 years, for our accounts. The law requires at least 7 years.
Email address on an order, recipient address and gift message: 2 years after the purchase. After that we can no longer find your code by your email address; email us with the order number on your receipt instead.
Gift message: 30 days after delivery of the gift email.
Order that was not paid: we delete your email address after 30 days; we keep the rest without an email address, for our figures.
Email with your code: we delete the content as soon as it has been sent. We only record whether and when it was sent.
Code, redeemed code and access to a tour: as long as the tour is in the app.
Purchase in the app: as long as the tour is in the app.
Device ID: as long as the app uses it. We delete it on request.
Progress in a tour: 2 years.
Count at the free preview: 12 months.
Rating: as long as the tour exists.
Group: within a day after the group has ended, together with the record at your device ID.
Newsletter: until you unsubscribe. After that we delete your address within 30 days, with us and with Resend. We only keep a value derived from your address and the date, as proof that you unsubscribed. Notifications from Resend about unsubscribing are kept for 90 days.
IP addresses in the counters against abuse (newsletter, checkout and codes): 24 hours.
Server logs: 30 days.
Google keeps crash reports for 90 days.
Email to us: 2 years after the last contact.

Your rights

You have the right to access, correct and delete your data, to restrict what we do with it and to data portability. You can also object to what we do based on our legitimate interest. If you gave consent, for the newsletter, you can withdraw it at any time. For questions or requests: info@marchandspit.com. You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Having your data deleted

Time Travel Tours (an app by March & Spit) works without an account, so there is no "delete account" button. This is how you ask us to delete your data:

Steps:

Send an email to info@marchandspit.com with the subject "Delete my data".
Include the email address of your order or your subscription, and your code if you have one. Without a code or email address we cannot link data from the app to you.
We confirm by email within 30 days what we have deleted.

What is deleted and what is kept:

Order: we delete your contact details: your email address, the recipient's address, the gift message and the content of the email with your code. We keep the order number, date, amount and payment number for 10 years for our accounts. Your code and your access stay in place, so the tour keeps working.
Device ID: with your code we find your device. If you ask us to delete that too, we delete your device's sign-in, with your ratings, your progress, the count at the free preview and your access. Then the tour stops on that device.
Newsletter: we delete your address with us and with Resend.
Email correspondence (if you emailed us): we delete it from our mailbox.
Crash reports (Firebase Crashlytics): these are not linked to a name, email address or account, so we cannot look them up or delete them per person. Google deletes them after 90 days.
Payment details at Mollie: you can request or delete those at Mollie.

Children

The tours are suitable from age 13. For a purchase and the newsletter you need to be 16 or older, or have permission from a parent or guardian.

Changes

We may change this privacy policy. The date at the top shows the latest change.

← Back to the homepage

Homepage · How we make it · March & Spit · info@marchandspit.com