Privacy at Wandercheck

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Wandercheck analyses your GPX file in your browser. I run no server of my own for that, and the file does not leave your device. There is no tracking, no advertising and no analytics. Fonts and code come from the same server as the page.

For paths, weather and, if you ask for it, terrain, your browser queries map services directly and sends coordinates of your route and your IP address with the request. An account is optional; you need one only to save tours.

There is no automated decision-making and no profiling. The family rating is computed by the page from your route using fixed rules.

When you open the page

When you open the page, your browser sends the details needed to deliver it: IP address, date and time, the address requested, the previous page (referrer) and the browser identifier. The page is hosted by Netlify.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is delivering the page securely and reliably. How long Netlify keeps its logs is set by its own terms.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Analysing your tour

When you analyse a GPX file, your browser itself queries these services: an Overpass server for paths, surface, forest, places to eat and stops from OpenStreetMap (overpass-api.de first, overpass.kumi.systems in addition after a few seconds without an answer) and Open-Meteo for the weather forecast at the middle of the route. Coordinates of your route and, for technical reasons, your IP address go there. The file itself, your name or an account do not.

Route coordinates can reveal where you are, for example when the tour starts at your front door. Trim the GPX file at start and finish beforehand in that case.

The legal basis is Art. 6(1)(b) GDPR: without map data there is no analysis. If you do not run the analysis, nothing is transmitted.

FOSSGIS e.V.

Bundesallee 23, 10717 Berlin, Germany

Provider’s privacy policy

Private.coffee – Verein zur Förderung von Privatsphäre und digitaler Souveränität

Brandhofgasse 7/1, 8010 Graz, Austria

Provider’s privacy policy

OpenMeteo GmbH

Hintere Schilligmatte 6, 6463 Bürglen, Switzerland

An adequacy decision of the European Commission applies to this country (Art. 45 GDPR).

Provider’s privacy policy

Terrain in the 3D view

Only when you click “Load terrain” in the 3D view does your browser fetch elevations for a grid around the route from Open-Meteo. The grid coordinates and your IP address go there, straight from your browser. I do not route them through a server of my own, so the route does not pass through further hands. Without the click, nothing leaves your device for this.

The legal basis is Art. 6(1)(b) GDPR.

OpenMeteo GmbH

Hintere Schilligmatte 6, 6463 Bürglen, Switzerland

An adequacy decision of the European Commission applies to this country (Art. 45 GDPR).

Provider’s privacy policy

Account

An account is optional and not needed for the analysis. It runs on Supabase. You sign in with an email link or with Google; there is no password. I store your email address; with Google I receive address and name, but no password. If you choose Google, the page sends you to Google, which learns your IP address and that you are signing in here. The email link avoids that.

I share the Supabase project with SchnitzeljagdAI, another app of mine. Accounts are shared in it: if you sign in there with the same address, it is the same account. This app’s tours sit in a separate area of the database.

The legal basis is Art. 6(1)(b) GDPR, for Google additionally your choice of that route (point (a)). There is no button to delete the account. Write to me at the address above and I will delete your account and all related data.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Saved tours

You have to save explicitly. Only then does the GPX file go to Supabase, together with the analysis (result, the child’s age you entered, start time, terrain) and a note if you write one. Without saving nothing is uploaded, even when signed in. The age is the only detail about a child; I collect no name. The database’s access rules let only your account read your tours.

You delete single tours in the app yourself. The legal basis is Art. 6(1)(b) GDPR. The data stays until you delete the tour or your account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Storage on your device

Wandercheck stores in your browser (localStorage) the theme you chose, the map view (flat or 3D), the chart layers you selected and, when signed in, your sign-in. This is necessary for the function you asked for (§ 25(2) no. 2 TDDDG). I process the sign-in on the basis of Art. 6(1)(b) GDPR. There are no cookies for advertising or analytics. The values stay until you sign out or clear the site data.

How long

Without an account I store nothing about you. With an account, your email address and saved tours stay until you delete them or the account. The providers delete their logs on their own schedules.

Links to other sites

Links to OpenStreetMap and other sites are ordinary links. Your browser connects to the target only when you click one; the target’s own privacy policy applies there. Path data comes from the OpenStreetMap contributors (ODbL), weather and elevation from Open-Meteo (CC BY 4.0).

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.