Privacy at SchnitzeljagdAI

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

SchnitzeljagdAI uses artificial intelligence to create a treasure hunt for a place of your choice. You need an account for that (sign-in with Google or Apple). Your input goes to an AI from Google, place searches go to open map services, payments go to Stripe.

The site sets no advertising or analytics cookies, contains no tracking script and loads fonts from its own server. There is no profiling and no automated decision with legal effect.

When you open the page

The site is hosted by Netlify. When you open it, Netlify processes the technically necessary data so it can be delivered: IP address, date and time, requested address, referrer and browser identifier. I do not analyse these logs myself.

The legal basis is Art. 6(1)(f) GDPR (delivering the site securely and reliably). How long Netlify keeps its logs is governed by Netlify’s own terms.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Account and saved hunts

You sign in with Google or Apple. They provide your name, email address and, if available, a profile picture. The account and everything you create in it is stored at Supabase: your profile data, your credit balance, the hunts you created with their inputs (place, theme, age, duration, settings), saved presets and a counter that limits place lookups per hour.

The same Supabase project is also used by Wandercheck, another application of mine. Both use the same account; the applications keep their data in separate areas.

The legal basis is Art. 6(1)(b) GDPR, because I cannot create and keep hunts for you without an account. The data stays until you delete your account; you can delete single hunts in the library at any time. There is no button to delete the account: write to me at the address above and I will delete your account and all data belonging to it.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Artificial intelligence (Google Gemini)

When you have a hunt created, my server (a Supabase function) sends your input to Google’s Gemini API: place, theme, age group, duration and other settings from the form, and for a route also the planned stations. The model uses Google Search for the place lookup and the riddles. If you enable images, an image model receives a description of the scene; I explicitly do not request people or faces. No photos of you or anyone else go to the AI, because the app has no photo upload.

The legal basis is Art. 6(1)(b) GDPR. Under the Gemini API terms, users in the EEA, Switzerland and the United Kingdom get the rules of the paid tier; Google does not use input there to train its models. Google keeps requests for a limited time under its own rules, for example to detect abuse.

Google LLC

1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

A child’s first name

In the form you can optionally enter a child’s first name so the riddles address the child personally. Like the rest of your input, this name goes to Google’s AI and is stored with the hunt in your account. Enter the first name only, no surname, no address, no photo. The app is aimed at adults; whoever enters a child’s name does so as a parent or guardian.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by entering the name. Leave the field empty if you do not want that; the hunt works just the same. You can withdraw by deleting the hunt.

Google LLC

1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Maps and routes

When you type in the place field, your browser sends the search text (from three characters) directly to Nominatim, the search service of the OpenStreetMap Foundation. The Foundation sees your IP address in the process. This only happens when you type in the place field.

If you create a route, my server fetches waypoints and paths for you: from Overpass (operated by FOSSGIS e.V.) the objects around the route, from OpenRouteService (HeiGIT gGmbH) the route between start and destination. Coordinates go there, not your IP address and no account name. A GPX file you upload is read in the browser; only the route continues.

The legal basis is Art. 6(1)(b) GDPR. The services keep requests under their own rules.

OpenStreetMap Foundation

St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom

An adequacy decision of the European Commission applies to this country (Art. 45 GDPR).

Provider’s privacy policy

FOSSGIS e.V.

Bundesallee 23, 10717 Berlin, Germany

Provider’s privacy policy

HeiGIT gGmbH

Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg, Germany

Provider’s privacy policy

Buying credits

When you buy credits, you are redirected to Stripe Checkout. Stripe collects the payment details itself; they do not pass through my server. I give Stripe your email address, your account ID and the chosen package. I receive the confirmation. In your account I store package, credits, amount, currency, Stripe session ID and time.

The legal basis is Art. 6(1)(b) GDPR. Statutory retention duties for bookkeeping data remain unaffected. Stripe keeps payment data for its own periods.

Stripe Payments Europe, Ltd.

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Device storage and location

The app stores in your browser your choice between light and dark design and the Supabase sign-in so that you stay signed in. The app does not work properly without them; the legal basis is therefore Section 25(2) no. 2 TDDDG, and for the processing that follows Art. 6(1)(b) GDPR. The entries stay until you clear browser storage or sign out. I set no cookies.

The app reads your device’s location only after you tap the unlock button at a station and your browser has agreed. The position stays on the device and is only used to calculate distance.

How long

Account, hunts, presets and purchase data stay until you have your account deleted. Then I delete them. Logs kept at a provider follow that provider’s periods; see its privacy policy.

Links to other sites

Map and source links, for example to OpenStreetMap, are ordinary links. Only when you click one does your browser connect to the destination; its privacy policy applies there.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.