cucarachasPRIVACY NOTICE / LAST UPDATED 6 OCTOBER 2026
Your Cucarachas.
Your privacy.
Cucarachas is a community for Cucarachas: people who travel. It only works if you can trust it, so we collect as little as possible, we never sell or share your personal data, and everything is hosted in the Netherlands. This notice explains in plain language what happens with your data. It applies to the website cucarachas.app and the Cucarachas web app.
1. Who is responsible
Cucarachas is run by Dreams Still Survive, which is the controller of your personal data under the General Data Protection Regulation (GDPR). For anything about privacy, write to privacy@cucarachas.app.
2. What we collect and why
| Where | Data | Why | Legal basis |
|---|---|---|---|
| Your account | Name, email address, password (stored only as a secure hash). | To create and secure your account. | Performing the service you asked for (art. 6(1)(b) GDPR). |
| Your profile | What you choose to add: photo, short bio, places you live, visited or plan to visit, WhatsApp number, Instagram name, and whether to share your email. | To show your profile to the Cucarachas you are connected with. | Performing the service, and your consent for optional details (art. 6(1)(a)). |
| Connections | Who you are connected with or have blocked, and short-lived QR codes. | To let you keep in touch with Cucarachas you really met. | Performing the service (art. 6(1)(b)). |
| Location check-ins (optional) | Only when you tap "Check in here": the position from your phone's GPS, its accuracy and the time. | To keep your private trail and, if you allow it, show your latest check-in to Cucarachas you are connected with. | Your explicit consent (art. 6(1)(a)). Turning check-ins off deletes your whole trail. |
| Security and operation | IP address and technical details in server logs, rate-limit counters. | To keep the service secure, stop abuse and fix errors. | Legitimate interest (art. 6(1)(f)). |
| Notices to the operator | Name and email address of each new registration. | So the operator knows who joined and can answer questions. | Legitimate interest (art. 6(1)(f)). |
We do not collect special categories of personal data on purpose, so please do not put sensitive information in your bio or photo. Photos are cropped square and shrunk to at most 512 x 512 pixels, and this removes hidden camera data such as the GPS position stored inside many phone photos.
3. Who gets to see your data
- Other Cucarachas: only Cucarachas you are connected with can see your profile and contact details, and only what you filled in. A request shows your display name only. There is no public search for Cucarachas.
- Your location: your trail of check-ins is visible to you alone. If you switch it on, the Cucarachas you are connected with see only your latest check-in, rounded to about 1 km, and only for 30 days after it was made. The admin area never shows locations.
- Our hosting provider in the Netherlands: stores the website, database and email on its servers and acts as our processor. It may only process data on our instructions.
- Email: we send our emails from our own server. By the nature of email, your own email provider receives the messages sent to you.
- Nobody else. We do not sell, rent or share personal data with advertisers, data brokers, social networks, analytics companies or any other third party.
When you tap a WhatsApp, Instagram or email link on a Cucaracha's profile, you leave Cucarachas and that other service's own rules apply. Our pages load no outside fonts, scripts, maps, trackers or content delivery networks. The world map in the app is a picture we host ourselves. We do not transfer personal data outside the European Economic Area.
4. Emails we send
We only send emails that belong to something you did: a welcome email when you register and a password reset when you ask for it. There are no newsletters and no promotions. Each registration also sends a short notice with your name and email address to the operator's own mailbox.
5. How long we keep it
- Account and profile: until you delete your account. Deleting it removes your profile, photo, check-ins and connections straight away.
- Location trail: until you delete it, turn check-ins off, or delete your account.
- QR codes: valid for about 10 seconds and deleted automatically. After a scan, the encounter stays in the scanner's session for up to 10 minutes so they can finish. Unanswered connection requests are deleted after 7 days.
- Password reset links: valid for 60 minutes.
- Server logs: kept only for a limited period for security and troubleshooting.
6. Cookies and similar technology
This website and this page set no cookies at all. The app uses two cookies, and both are strictly necessary: a session cookie (cucarachas-session) that keeps you signed in and a security cookie (XSRF-TOKEN) that protects forms against forgery. They are not used for tracking or advertising. Because they are strictly necessary, the law does not require your consent and so we show no cookie banner. If you add Cucarachas to your home screen, your device stores copies of our public pages and images so the app opens quickly. This contains no personal data.
7. Camera and location on your phone
When you tap "Scan a code", your browser asks permission to use the camera. The camera image is processed only on your own device to read a QR code. It is never recorded, stored or uploaded. Location is requested only when you tap "Check in here", never in the background. You can withdraw both permissions in your browser or phone settings at any time.
8. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive a copy in a common format, and withdraw your consent at any time without giving a reason. Inside the app you can edit your profile, delete check-ins and delete your account yourself. For everything else, write to privacy@cucarachas.app. We reply within one month. If you are not happy with our answer, you can complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or to the authority in your own country.
9. How we protect your data
All traffic is encrypted with HTTPS. Passwords are stored as hashes, never in plain text. Profile photos are stored privately on the server, not in a public folder, and are only shown to Cucarachas you are connected with. QR codes change every few seconds, forms are protected against forgery and abuse, and access to the admin area is restricted to the operator. No system is perfect, so please use a strong, unique password.
10. Age
Cucarachas is for people aged 16 and older. Please do not register if you are younger.
11. Changes
If we change how we use personal data, we will update this notice and, where required, ask for your consent again. The date at the top shows the latest version.