Privacy policy

1. Controller

The controller within the meaning of the GDPR is the provider named in the legal notice:

Henrik Heil
Westendstraße 100, 60325 Frankfurt am Main, Germany
contact@henrikheil.net

We are not required to appoint a data protection officer; enquiries are answered at the address above.

2. Which data we process

Account

• Email address and password. We store the password only as a hash (argon2id); it exists in plain text nowhere.
• Display name. At registration we suggest it from the part before the @ in your email address; you can change it in your profile at any time.
• Profile picture, if you upload one, along with how much of your storage quota is used and your role (account or administration).
• Invitation code you registered with; it stays linked to the invitation for as long as that exists.
• Invitations you pass on. If you create an invitation link in your account settings, we store it with the first name you type for it (optional). Whoever opens the link sees your display name and that first name on the sign-up page. Once the person joins, your list shows their first name, or their profile name if their profile is public. If you joined through such an invitation yourself, the person who invited you sees that you joined. Administrators can also see who invited whom.
• Signed-in devices. For every sign-in we store the identifier of your browser (user agent), the time of the sign-in and of the last use, as well as the first two blocks of your IP address (for example "84.119.x.x"); not the full address. This serves the single purpose of letting you see and end, in your account settings, which devices currently have access to your account. Signing a device out deletes these details.

Tours

• GPS recording: coordinates, elevations and timestamps along your route; the type of tour you choose when starting in the app or uploading in the Studio, or that a connected sports tracker reports as the sport (such as hike or bike tour); for app recordings also the detected mode of travel and, for each point, how precisely your phone could determine it and the speed it measured at the time. This lets us recognise measurement errors, such as a single point far off the route. We remove such points from the route that is played back and note with the tour which ones they were; the uploaded data itself stays unchanged. Locations your phone could only determine imprecisely (on a train, for example) are not added to the route by the app, but are sent along with their accuracy. We use them only to fill gaps in a train journey along the tracks.
• Photos and videos including the metadata in the file (time taken, place taken, camera and lens details). What we serve are downscaled versions; we discard the original after processing.
• Your edits: title, description, captions, camera and weather settings, chosen music and audio files you upload yourself.

Waiting list

• Email address, so that we can send you an invitation code, and, if you like, your voluntary note about what you would like to record.
• Time and IP address of your entry and of your confirmation. They evidence the consent (Art. 7 (1) GDPR) and protect against someone entering other people's addresses.

An entry is only created once you click the link in the confirmation email. If you do not click, we delete the address by ourselves after 14 days.

Newsletter

If you tick the box during registration or flip the switch in your account settings, we send you news about Maptale a few times a year. The box is not pre-ticked, and registration works regardless of it.

• Email address and name of your account; that is where the message goes.
• Time, state, origin (registration, account settings or unsubscribe link) and the version of the consent text you agreed to. They evidence the consent (Art. 7 (1) GDPR). We do not store an IP address for this.

As long as your email address is unconfirmed, nothing goes out; after an address change, sending rests until the new address is confirmed. You can unsubscribe at any time in your account settings or through the link in each of these emails, which works without signing in.

Technical data on access

Calling up the website and the API produces the technically necessary access data: IP address, time, requested resource, status code and amount of data transferred. They serve delivery, troubleshooting and abuse prevention. We do not use advertising tracking or cross-device recognition.

Audience measurement

To see which pages are used at all, we run a lean audience measurement with Umami. It runs on our own server in Germany; no data flows to an analytics provider.

Recorded per page view:

• the address called up and the page you came from,
• browser, operating system, device type and screen size,
• country and approximate region, derived from the IP address,
• the time of the call.

We also count how often individual buttons are used, such as "Join the waiting list", and whether a waiting list entry was submitted and confirmed. Only the name of the event is stored, never anything you typed and never your email address. We do not record the part of an address after the #.

Your IP address is not stored. It only feeds into a check value that is also built from a random value that changes daily and serves to group the calls of one day into one visit. Because the random value changes daily, the same visit cannot be recognised beyond that day; the IP address cannot be calculated back from the check value. No profiles arise from this, and we do not combine these data with any account.

The legal basis is our legitimate interest in designing the website to meet demand, Art. 6 (1) (f) GDPR. You can object to the measurement at any time (see Your rights); technically, any common blocking extension is enough.

Connected services (sports trackers). In your account settings you can connect your Maptale account to a sports tracker, currently Polar. We then fetch new recordings from there automatically as a tour: the GPS route, start time, duration and the sport, nothing more. We do not request training values such as heart rate, calories or training load. For access we store an access token from the provider (encrypted), the identifier you are held under there, and a log of the fetches (time, result, and in case of failure the reason). The connection only comes about if you confirm it at the provider itself, and you can disconnect it in your account settings at any time; the tokens are then deleted and the authorisation at the provider is revoked. Tours already imported stay with you, they belong to you and not to the connection.

Feedback. Through the feedback button or the page send feedback you can report a bug, send an idea or ask a question. What is stored is your text, plus what it is about (question, idea or bug), and, if you enter one, an email address for follow-up questions or our reply. If you are signed in, the identifier of your account is attached so that we can ask back; feedback without signing in is equally possible. Every piece of feedback is also sent to us by email, with everything you include, so that we can read it right away and reply to you.

Reports about content. Through the ⋯ menu on a public tour, in the player menu and on another person's profile you can tell us that something does not belong there. What is stored is what it is about (type and identifier of the item, plus its title or name at the moment of the report), the reason you picked, your free text, the time and the language you reported in, so that our answer reaches you in the same one. If you are signed in, the identifier of your account is attached; without signing in you may leave an email address voluntarily so that we can answer you. It also works without one, and then you get no answer.

Every report is looked at by a person; there is no automatic blocking and no counting by number of reports. If we decide to block something, we write to the person affected and name the reason, including for an account suspension. As the reporter you are told that we took care of it or found nothing to act on; what exactly was decided you are not told, that concerns another person. A block is not a deletion: the content stays in its owner's account, it is merely no longer visible to others. The legal basis is our legitimate interest in an offering free of unlawful content, Art. 6 (1) (f) GDPR.

We only send the technical details (page called up without additions, Maptale version, browser, operating system, window size, language setting) if the checkbox is ticked. It is only offered when you report a bug; with a question or idea none of it is sent. What exactly is transmitted can be unfolded in the form before you send it; if you untick the box, none of it is stored. The server does not accept other details. The legal basis is our legitimate interest in improvement and troubleshooting, Art. 6 (1) (f) GDPR.

3. Purposes and legal bases

• Account and tour processing, performance of the usage contract, Art. 6 (1) (b) GDPR.
• Confirmation and password emails, also (b); they are part of signing up.
• Connected sports trackers, also (b): the fetch is exactly the service you asked for by connecting. It begins only with your confirmation at the provider and ends when you disconnect.
• Notifications from the app, your consent, Art. 6 (1) (a) GDPR, given with the permission for notifications and revocable at any time in the Android settings. This route carries exclusively what belongs to your own tours; advertising would need its own consent. More in section 7.
• Access logs, rate limits, invitation requirement, legitimate interest in secure operation free of abuse, Art. 6 (1) (f) GDPR.
• Invitations from members: your name on the sign-up page is part of the feature you use, Art. 6 (1) (b) GDPR. We process the invited person’s first name and who invited whom based on legitimate interest, Art. 6 (1) (f) GDPR: so that you can tell your invitations apart, and to trace abuse through chains of invitations.
• Audience measurement, legitimate interest in designing the website to meet demand, Art. 6 (1) (f) GDPR. More in section 2.
• Publishing a tour, your decision, Art. 6 (1) (a) GDPR. It is revocable at any time by setting the tour back to private.
• Translating shared tours, our legitimate interest in visitors being able to read a shared tour in their language, Art. 6 (1) (f) GDPR. Details in section 5.
• Waiting list, your consent, Art. 6 (1) (a) GDPR. We use the address solely to send you an invitation code: no advertising, no passing on. You can revoke it at any time with effect for the future through the unsubscribe link in each of our emails; your address is deleted immediately.
• Newsletter, your consent, Art. 6 (1) (a) GDPR. It is independent of registration and revocable at any time with effect for the future: through the switch in your account settings or the unsubscribe link in each of these emails. We keep the evidence of consent under Art. 7 (1) GDPR.

If your photos or tracks contain special categories of personal data (health or religious references, for instance), we process them solely because you uploaded them yourself, and in case of publication on the basis of your consent under Art. 9 (2) (a) GDPR.

4. What happens when a tour is processed

After the upload, the server enriches the tour. In doing so it queries a few external services. What is transmitted for this are coordinates and times of your route, never your email address, your name or an account identifier:

• Place names: OpenStreetMap/Nominatim receives individual coordinates in order to name places and regions.
• Weather: Open-Meteo receives coordinates and times in order to reconstruct the weather at the time.
• Mode of transport: to detect trams, trains and ferries and to lay a train journey onto the course of the tracks, also across recording gaps, we query the OpenStreetMap Overpass API for the course of rails and ferry lines. For this it receives the bounding rectangle of your route, the simplified course of your journeys by vehicle and the area around the gaps, each without times.
• Preview image: For the image shown behind the title when a tour opens, until the map has loaded, the server loads terrain heights (Terrain Tiles on Amazon Web Services, USA) and water areas (OpenFreeMap) for the area around your route. These services only receive the requested tile coordinates, without any times.

Image analysis. To correct the reconstructed weather, we transmit a version of the photos from your tour downscaled to 480 pixels, each one once and without metadata, to Scaleway (Scaleway SAS, Paris, France). An image model evaluates them there in data centres in Paris. The only question asked is about the weather in the sky; the result is a brief classification ("overcast", "rain"). Only the image and this question are sent, no account or location data. Scaleway neither stores the image nor the answer and does not use them for training; only if misuse is suspected or a request disrupts the service may Scaleway keep it for up to two weeks to find the cause. This processing is part of creating the tour (Art. 6 (1) (b) GDPR); if you do not want it, do not upload photos.

5. Who sees your tours

Every tour is private at first and visible only to you. If you set it to public in the studio, it appears under Discover and on your profile page. The tour itself and your profile page are open to everyone, including people without an account; browsing under Discover is reserved for signed-in members.

In search engines only what you have set to public appears, and for your profile only if you allow it explicitly:

• Tours: "public" means listed in the gallery (which is open to signed-in members) and released to search engines — the tour itself is reachable without an account. Tours set to "unlisted" stay out; they can only be reached through their link, and that is exactly what this level is for.
• Profile page: even as a public profile it stays out of search results until you switch on "Appear in search engines" in your account settings. The switch is off by default. Being reachable through the link is something other than being findable under your own name. That is why it is a decision of its own.

If you share a link in a messenger, a preview card with title and image is created there in every case, including for unlisted tours. The respective service generates it when sending, and it has nothing to do with search engines.

Public are then: the route, photos and videos, titles, descriptions, times as well as your display name and your profile picture. A route often starts at your own front door; check before publishing whether that is intended. Setting it back to private takes effect immediately for new access; links already shared, copies and search engine caches are beyond our reach.

Translation. When you set a tour to public or unlisted, we have its texts translated automatically into German and English, so that visitors can read them in their language. For this, the title, description, overline, the destination name, the titles of your photos and the place names of the tour are sent to Scaleway (Scaleway SAS, Paris, France), where a language model translates them in data centres in Paris. Photos, videos and the route are not sent. From your account, only the language of your interface goes along, as a hint to which language the texts are probably written in; your name, your email address and all other details of your account stay with us. Scaleway does not store the texts and does not use them for training; only if misuse is suspected or a request disrupts the service may Scaleway keep them for up to two weeks to find the cause. Your own text stays unchanged; the translation is kept separately on our server. The legal basis is our legitimate interest in a shared tour being readable by people who do not speak your language (Art. 6 (1) (f) GDPR); at that point the texts can be read by anyone with the link anyway. You can object to this (see Your rights). The direct way is to set the tour back to private: we then delete its translations and nothing more is sent.

6. Maps, terrain and fonts

The camera flight is created in the browser. Your device therefore loads the map and terrain data directly from the respective providers; they receive your IP address and the requested tile coordinates in the process:

• Satellite imagery from Esri (ArcGIS Location Platform, Esri Inc., USA)
• Terrain elevations from the Terrain Tiles on Amazon Web Services (USA)
• Glyphs for the map labels from OpenFreeMap

The typeface of the interface (Outfit) is served from our own server; no third-party service is contacted for it.

For the satellite imagery, your device first fetches an access key from Esri via our server, valid for at most twelve hours, and sends it along with every tile request to Esri. It contains no information about you. Our server only counts how many such keys it has issued and does not store to whom; it keeps your IP address only in memory to slow down repeated requests and discards it after about an hour.

The basis is our legitimate interest in a functioning, presentable display (Art. 6 (1) (f) GDPR).

The product film on the home page is a YouTube video (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). It is only loaded when you start it; before that there is no connection to YouTube. It is embedded through the address youtube-nocookie.com, where YouTube states that it stores data only once playback begins. When you start it, Google receives your IP address and may also process data in the USA. The basis is our legitimate interest in showing the film (Art. 6 (1) (f) GDPR); if you do not start it, nothing is transferred.

7. Android app

The recording app records your route and needs the permission for location for that, including in the background, because a tour keeps running while the display is off, as well as access to the camera and media if you take photos along the way.

Recordings stay on the device at first. Only when you upload do they go to our server; until then you can delete them on the device. The app contains no advertising SDKs, transmits no device identifiers for advertising purposes and talks exclusively to our own server.

Map while recording. During a recording the app shows a map with your location. It loads map sections and fonts from our server, not from a map service; we do not store which sections you look at. A section our server does not have yet is fetched once from OpenFreeMap (Hyperknot Software Kft., Hungary) and kept from then on. OpenFreeMap only learns the tile coordinates, neither your IP address nor who requested them.

One exception concerns playback: the app shows tours by loading our player as a web page. The same audience measurement as on the website applies there (section 2), with the same data, the same legal basis and the same right to object. Recording, managing and uploading tours is not measured.

Photos for a tour from a connected tracker

If a tour comes from a connected sports watch, it has only the route; the photos are on your phone. The app can add them and looks in your gallery for that. Reading happens exclusively within the period of the tour, from its start to its end, and only in camera folders. Screenshots, downloads and images from messenger apps stay out.

None of this happens without you. Access needs the Android permission for images, and beyond that either your approval in the individual case ("3 photos found from this time, add them?") or the switch "Add photos automatically" in your profile. This switch is off by default, applies only to the device on which you set it, and can be switched off again at any time. Only what you have confirmed, or what falls within the period, is uploaded; a photo that was added can be deleted from the tour for good, and the image along with every version produced from it is then gone.

If a photo contains GPS details, we use them to show it at the right place on the route. Android only releases the location with a permission of its own; without it we place the image by the time it was taken.

Notifications (push)

So that you find out when a tour from a connected sports tracker has arrived, the app can show a notification. It is delivered through Firebase Cloud Messaging by Google. For this, your device receives an installation identifier from Google that we store together with your account; it is the address a message goes to.

The message itself contains no content: it consists of the occasion ("a tour is ready") and the identifier of the tour. Title, place and images are then fetched by the app directly from us. Nothing that reveals where you have been lies on the route through Google.

The transmission only begins with your approval. As long as you have not allowed the notification, the app registers nothing with Google; the corresponding Firebase function is switched off until you agree. You can withdraw the permission at any time in the Android settings; on signing out and on deleting your account the identifier is removed. Without push the app stays fully usable: it then asks at intervals by itself whether something has arrived.

This route carries exclusively messages about your own tours, no advertising and no product news. The newsletter exists for that, and it requires a consent of its own.

Getting the app through Google Play

The app is available through the Google Play Store and as a file directly from our website. Which route you choose decides whether Google is involved.

If you download through Play, Google Ireland Ltd. processes that under its own responsibility. This covers your Google account, your device and the fact that you install or update this app. We have no influence on it; Google's privacy policy applies to it.

From Play we receive aggregated error and usage reports (Play Console, "Android Vitals"): how often the app crashed or stopped responding, broken down by device model and Android version, along with the technical sequence at the moment of the fault. These reports do not name you, and we cannot work out from them who you are. Whether your device sends them at all is your decision in the Android settings.

If you download the file from our website instead, Google does not appear on that route. There are then no automatic updates either.

The route you choose changes nothing about the audience measurement: it applies only when a tour is played, because the app loads our player as a web page for that. Installing, recording and uploading are not measured.

8. Cookies and local storage

We set three technically necessary cookies, all without any analytics or advertising purpose:

• maptale_session, keeps you signed in. HttpOnly, lifetime 30 days.
• maptale_returning, merely remembers that a session exists, so that the header does not briefly show "Sign in" although you are signed in. It contains no identifier.
• maptale_lang, remembers the language you chose in the page footer, so that it still applies on your next visit. It contains only the language code (de or en), no identifier. Lifetime one year; it disappears as soon as you choose "Automatic" in your account settings. If you are signed in, the same choice is additionally held in your account.

In addition, the player stores settings (sound, music, weather display, view) and the last position reached in a tour in the local storage of your browser. These values do not leave your device and can be deleted through the browser settings. The access key for the satellite imagery from section 6 is kept there as well until it expires, so that not every reload needs a new one; it is only sent to Esri. It is not a setting you make, but it is strictly necessary for the map you open to appear. No consent is required for any of this (§ 25 (2) TDDDG, the German act on data protection in telecommunications and telemedia), which is why Maptale manages without a cookie banner: the three cookies store exclusively a setting you made yourself and are strictly necessary in order to provide you the service the way you requested it.

The audience measurement from section 2 also manages without a cookie: Umami stores nothing on your device and reads nothing that is stored there. In our assessment § 25 (1) TDDDG therefore does not apply.

9. Recipients and processors

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Accounts, tours and media are held on servers in the EU. The audience measurement also runs there on our own server; no analytics provider is added as a recipient.
• Email delivery: Resend (Plus Five Five, Inc., USA) for confirmation and password reset emails, the two waiting list emails and the newsletter. What is transmitted are the email address, the salutation and the link. For the message to us about a piece of feedback, additionally its text, type, the technical details and any address you entered.
• Image analysis: Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France; processed in Paris, no transfer to a third country takes place, see section 4.
• Translation of shared tours: Scaleway SAS (address as for image analysis); processed in Paris, no transfer to a third country takes place, see section 5.
• Map and weather services: Esri, Amazon Web Services, OpenFreeMap, OpenStreetMap Foundation, Open-Meteo, see sections 4 and 6.
• Product film on the home page: Google Ireland Ltd. (YouTube), also processed in the USA, and only if you start the film, see section 6.
• Notifications from the app: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Firebase Cloud Messaging), also processed in the USA. What is transmitted is the installation identifier of your device, its IP address and the occasion of the message, not its content. Only if you have allowed notifications. See section 7.
• Delivery of the app: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google Play), also processed in the USA. When you get the app through the Play Store, Google processes your Play account and details about your device under its own responsibility; what we receive from there is exclusively aggregated error and usage reports with no link to a person. See section 7.
• Connected sports trackers: Polar Electro Oy, Professorintie 5, 90440 Kempele, Finland, and only if you establish the connection yourself. The provider is based in the EU; no transfer to a third country takes place in this. We receive your recordings from there; what is transmitted when connecting is merely the identifier you are held under at Polar, back to Polar, with no address and no name from us. See section 2.

Contracts under Art. 28 GDPR exist with processors. Where data goes to services in the USA, we base this on the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR) or on certification under the EU-US Data Privacy Framework. Despite these safeguards, access by US authorities cannot be entirely ruled out.

10. Retention

• Account and tours: until you delete them. Deleting the account in the studio removes your user account and all tours belonging to it, including media, irreversibly. You can also delete individual captures: if you remove a capture in the studio and save, the image file and every version produced from it are deleted and the storage space used is freed again. All that remains is its number within the tour and, if the app added it from your gallery, the gallery's identifier for the photo. The number prevents a deleted capture from reappearing under its old address, the identifier prevents the app from uploading it again at the next sync. Location, time taken, caption and file name go with the capture.
• Sessions (including browser identifier and shortened IP): 30 days from sign-in, immediately on signing out, including when signing out an individual device in your account settings.
• Connected sports trackers: access token, provider identifier and the fetch log (which recording was fetched when) until you disconnect, then deleted immediately, likewise with the account. The tours produced from them stay with you.
• Notification identifier of the device: until you sign out, withdraw the permission or sign the device out in your account settings, then deleted immediately, likewise with the account. If Google reports the identifier as invalid (app uninstalled), we delete it at the next send.
• Confirmation and reset links: only until they expire or are redeemed.
• Access logs: deleted or anonymised after a short period.
• Reports about content: decided ones one year from the decision, open ones at most eighteen months from arrival; after that they are deleted automatically. Longer than for feedback, because a block is a decision about someone else's content and the person affected may ask why. If you delete your account, the reference to you falls away; the reported matter stays on anonymously so that the case remains traceable.
• Feedback: handled items 6 months, open items at most 18 months from sending; after that they are deleted automatically. If you delete your account, the reference to you falls away; the reported matter stays on anonymously, because troubleshooting hangs on it.
• Translations of shared tours: as long as the tour is public or unlisted. If you set it to private, or it is blocked or deleted, we delete its translations at once. When a text changes, we delete the old translation and create a new one; the old one does not stay even if translating again fails.
• Audience measurement: 12 months from the call.
• Invitations from members: a link that is not accepted, once it expires (30 days) or as soon as you withdraw it, including the first name. An accepted invitation stays as long as both accounts exist; if the invited person deletes their account, the first name goes with it.
• Waiting list: unconfirmed entries after 14 days, confirmed ones after a year without an invitation, invited ones 90 days after the code was sent. Earlier is possible at any time through the unsubscribe link.
• Newsletter consent: the evidence (time, state, origin, text version) stays for three years after you unsubscribe, which is how long someone can hold it against us that we wrote without consent. If you delete your account, it goes immediately with it.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent you have given, such as publishing a tour, can be revoked at any time with effect for the future.

Access and portability work without a detour: in your account settings, under "Export all data", you request a ZIP with all tours, photos, videos, sounds and account details, in machine-readable form (JSON) along with an explanatory text. The build runs in the background; you get the link by email and it is valid for 48 hours. After that the archive is deleted, not merely made unreachable; you can request a new one at any time. Access credentials (password, sessions, app tokens) are not included; they are keys, not information.

Deleting your account

You can delete your account yourself at any time. You need neither the app nor an installation of any kind for it:

• In the browser: in your account settings, under "Delete account". You confirm with your password.
• In the Android app: in your profile, under "Delete account", with your password as well.
• Without access to either: write to contact@henrikheil.net from the address you are registered with.

What is deleted is your user account and all tours belonging to it, including photos, videos and sounds, irreversibly. What remains is only what no longer has any link to you: feedback you sent us stays on anonymously, because tracking down a fault depends on it. The periods for this are in section 10.

For everything else, get in touch at contact@henrikheil.net. You also have the right to lodge a complaint with a data protection supervisory authority; the one responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information.

12. Changes to this policy

As Maptale develops, we adapt this policy. The version published here applies in each case; the date above states when it was last revised.