Privacy Policy

This privacy policy describes how we handle your personal data when you use our app or website.

1. Controller

Joel Domke

19joeld97@gmail.com

2. General information on data processing

We only process personal data if this is necessary for the provision of our app and website as well as our content and services.

Legal bases:

Art. 6 Abs. 1 lit. a DSGVO (consent)

Art. 6 Abs. 1 lit. b DSGVO (performance of a contract)

Art. 6 Abs. 1 lit. f DSGVO (legitimate interest)

3. Use of Urban Canvas (website and app)

3.1 Server logs

When you access the website or the app sends requests to our servers, the following information is collected automatically:

  • IP address
  • Date/time
  • Browser type/version
  • Operating system
  • Referrer URL

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (operation and security of the website and app).

3.2 Hosting and security - Cloudflare

Our website and the app's server endpoints are provided by the provider Cloudflare. Cloudflare acts as a content delivery network (CDN) and security service (e.g. DDoS protection). The following data is processed:

  • IP address
  • Date/time
  • Accessed content
  • Technical information about browser and operating system

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the secure and efficient provision of our website and app).

Provider: Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA

Privacy policy: https://www.cloudflare.com/privacypolicy/

3.3 No cookies, but local storage for login and settings

We do not use cookies or tracking tools. When you sign in, your session is stored in the local storage (localStorage) of your browser or the app on your device so that you stay logged in. This storage is technically necessary to provide the functionality you requested (login) and therefore does not require separate consent.

Your chosen appearance (light or dark) and language are also kept in local storage so that they are remembered on your next visit. These settings stay on your device and are not sent to us. This storage, too, only serves to provide the functionality you requested.

3.4 Registration & Authentication

For the use of certain functions, registration is required.

For this, we use Supabase Authentication.

The following data is processed: Email address, password (encrypted) and other optional information.

Provider: Supabase Inc., San Francisco, USA.

Privacy policy: https://supabase.com/privacy

3.5 Database storage

User accounts and activity data are stored in Supabase databases. This may result in data transmission to the USA.

3.6 Location data

To record your activities (walked streets), we process your current location.

Location data is only collected with your explicit consent (Art. 6 Abs. 1 lit. a DSGVO).

They are stored to display your progress.

3.7 Approximate location from IP address

To show a relevant initial map view, we derive an approximate (city-level) location from your IP address via Cloudflare's edge network when you open the map. This location is not stored, not linked to your account, and used only to set the map's initial position - you can pan and zoom away from it immediately afterwards.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in providing a useful default view without requiring a device permission prompt).

3.8 Map tiles

To display the map, we use map tiles from Stadiamaps. When those tiles are accessed, Stadiamaps receives the following data:

  • IP address
  • Date/time
  • Accessed content
  • Technical information about browser and operating system

Provider: Stadiamaps, East Lansing, MI, USA.

Privacy policy: https://stadiamaps.com/privacy

3.9 Leaderboard

There is a leaderboard that compares the progress of users in completing streets in a given area (e.g. country, state, city, municipality, district or custom area). By default, only anonymized percentage values are displayed that cannot be assigned to a specific user.

Users have the option to voluntarily agree that their self-selected name is displayed in the leaderboard. The legal basis is Art. 6 Abs. 1 lit. a DSGVO (consent). The consent can be withdrawn at any time for the future in the account settings. No display of further activities or detailed location data of other users takes place.

3.10 Alpha waitlist

If you sign up for our alpha waitlist, we process the email address you provide to contact you once access to the alpha version becomes available.

The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO), which you give by submitting the form.

The data is stored with Supabase Inc. (see 3.4) and deleted once the purpose no longer applies or you withdraw your consent.

You can withdraw your consent at any time for the future by sending us an email.

3.11 Children and young people

Urban Canvas is not intended for persons under the age of 16 or under the age of 13 (USA). We ask these to refrain from providing personal data to us. To ensure that the age limits are observed, this age limit must be confirmed when creating an account.

If we become aware that we have collected personal data of a child under the age of 16 or 13 (USA), we will delete this immediately.

4. Rights of the user

You have the right at any time to:

  • Access: You can request confirmation from us that personal data relating to you are being processed. If so, you will receive a copy of this data as well as further information in accordance with Art. 15 DSGVO.
  • Correction: If stored data is incorrect or incomplete, you can request immediate correction (Art. 16 DSGVO).
  • Deletion: You can request the deletion of your personal data, provided that no legal retention requirements exist or the processing is not required for other legal reasons (Art. 17 DSGVO).
  • Restriction of processing: Under the conditions of Art. 18 DSGVO, you can request that we only process your data to a limited extent (e.g. during a check of your objections).
  • Data portability: You have the right to receive the personal data relating to you in a structured, common and machine-readable format or to request their transmission to another controller (Art. 20 DSGVO).
  • Withdrawal of consent granted: A once granted consent to process personal data can be withdrawn at any time for the future with future effect (Art. 7 Abs. 3 DSGVO).
  • Objection to processing: You can object to the processing of your personal data, which is based on a legitimate interest, at any time for reasons arising from your particular situation (Art. 21 DSGVO). Thereafter, we only process your data for strictly necessary purposes.
  • Complaint to a supervisory authority: If you believe that the processing of your data violates the GDPR, you can file a complaint with a supervisory authority (Art. 77 DSGVO). The supervisory authority at your usual place of residence or place of work is particularly competent.

5. Data transmission to third countries

Since Supabase and possibly the provider of Stadiamaps are located in the USA, data transmission to third countries outside the EU may occur.

6. Changes

We reserve the right to amend this privacy policy if the app or legal requirements change.