Privacy Policy

This policy explains which personal data we process in the GeoWunder app, when you join a game in the browser (play.geowunder.com) and on geowunder.com — pursuant to Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). California residents will find a CCPA / CPRA addendum at the end.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

GeoWunder GmbH
Represented by the managing directors: Damir Orec, Martin Albers, Ulrich Koj
Kirschgartenstr. 6/4, 69126 Heidelberg, Germany
Email: info@geowunder.com

Data-protection inquiries about the GeoWunder app and geowunder.com should be sent to info@geowunder.com.

We are not legally required to appoint a data protection officer.

2. At a glance

The table below summarises which data we process for which purpose. Details follow below.

Data Purpose Legal basis Retention
User ID, optional email, sign-in provider Account, login Art. 6(1)(b) GDPR until account deletion
Location data (GPS) during an active rallye Navigation, waypoint detection, party mode Art. 6(1)(b) GDPR Solo: until rallye is deleted; party: until pin expires (max. ~24h)
Uploaded photos and videos Solving tasks, proof media Art. 6(1)(b) GDPR until rallye or account is deleted
Photo data for AI verification Automated task verification Art. 6(1)(b) GDPR not stored by us or by Google Gemini (passed through only); if OpenAI checks it as a fallback: kept there usually for up to 30 days for abuse monitoring (Section 7.1)
Input for AI tour generation, answers you type in (riddles and free-text tasks) Tour generation, automated answer checks Art. 6(1)(b) GDPR at OpenAI usually up to 30 days for abuse monitoring (Section 7.1); generation log (Section 7); checked answers with result kept by us for 30 days, without your user identifier (Section 6)
Topic scan when creating a rallye (on-device text recognition) Deriving the topic from your own material Art. 6(1)(b) GDPR photo: none — never leaves your device; recognised text: part of the generation request, kept in the generation log for up to 180 days (Section 7)
Feed posts in group sessions (photos, sentences assembled from preset building blocks, reactions) — only in sessions set up as "13 and older" Shared session feed, photo/story relays, award ceremony Art. 6(1)(b) GDPR until pin expires (max. ~24h)
Player name (picked from a fixed list of names), game state including battery level, chat messages from a fixed catalogue in party mode Multiplayer gameplay Art. 6(1)(b) GDPR until pin expires (max. ~24h)
Device info, crash reports, usage statistics Stability, product improvement Art. 6(1)(a) GDPR (consent) max. 14 months
Email address for sign-in links Magic-link login Art. 6(1)(b) GDPR transactional, not archived
IP address and requested map area when loading maps and offline map packages Map display in the app Art. 6(1)(b) and (f) GDPR access logs of our map servers: limited by size and continuously overwritten (Section 8)
Purchase receipt for in-app purchases, coin balance and ledger Crediting purchased AI coins Art. 6(1)(b) GDPR until account deletion
Device identifier and IP address, each only as a hash value Protecting the welcome credit against repeated redemption (Section 14) Art. 6(1)(f) GDPR IP hash: 24 hours; device hash: permanent, without any link to your account after account deletion

3. Account and sign-in

You can use GeoWunder anonymously at first — on first launch an anonymous account with a technical Firebase identifier is created automatically. We store your game state in our database under this identifier (Section 4) so that you can resume a rallye. If you sign in, depending on the chosen provider we process:

Processor: Firebase Authentication (Google Ireland Limited / Google LLC).
Legal basis: Art. 6(1)(b) GDPR (contract performance).
Retention: until you delete your account.

4. Location data (GPS)

The core function of GeoWunder is to use your location to guide you between stations of a rallye and automatically detect that you have reached a waypoint.

During an active session the app writes your game state to our database: current position, timestamp, progress (solved and skipped tasks, hints used), play time, distance walked and your device's battery level. This happens on progress and roughly every 30 metres or 30 seconds; in solo play the game state lives in your own user area. Outside a session the app uses your location only once and only when you trigger it — for example for the nearby search in "Discover" or as the starting point when creating a rallye; the coordinates are then sent to our backend (Sections 7 and 8). If you type into the place search while no map is shown, your position is sent along, rounded to about 1 km — only if you have already granted location permission (Section 8).

4.1 Location permission and background use (iOS and Android)

On iOS and Android the app only requests the "While Using the App" location permission; it does not request "Always". On Android the app does not use background location. On iOS the app can keep receiving your location while a rallye is running even when the screen is locked, so that the Live Activity on the lock screen can show distance and direction to the next station; these values are computed on your device. You can revoke the permission anytime in your system settings.

4.2 Sharing location in party mode

When you join a group rallye ("party mode"), your current game progress — including your position on the route — is shared with the other participants of the same session. This data lives in a temporary session (pin) and is automatically deleted at the latest about 24 hours after the session ends.

In addition to your position, the session game state includes your progress, the distance walked and your device's battery level; the host sees the teams on a map. Players who join in the browser (Section 15) do not transmit a GPS position.

Legal basis: Art. 6(1)(b) GDPR (contract performance); for party mode additionally Art. 6(1)(a) GDPR (consent by joining the session).

5. Uploaded photos and videos

Two distinct types of media can appear when you build and play rallyes — we treat them differently:

5.1 Media uploaded by tour creators

When you build your own rallye, you can upload intro videos, reference images for image tasks, and video task material. These files are stored in our encrypted cloud-storage (Firebase Storage). They are visible only to you and — in group sessions — to fellow players in the same session.

Storage location: Google Cloud Storage, region europe-west6 (Zurich, Switzerland).
Processor: Google Ireland Limited / Google LLC.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete the rallye or your account (server-side account deletion automatically removes these files as well).

5.2 Photo proofs captured while playing (photo missions)

For pure verification photo tasks while playing, you take a picture with the camera or pick one from your library. This image is not stored in our cloud. Together with the task text it is passed through our backend to the AI service for verification only (details in Section 6) and discarded after the analysis. We only store the verification result (solved / not solved) next to your progress, never the image itself. So that the same picture does not have to be checked repeatedly, we keep a non-reversible check value (hash) of the image together with the result for 30 days — the image cannot be reconstructed from it. If you have no connection on the way, the app keeps up to ten pictures locally on your device and verifies them once you are back online.

Legal basis: Art. 6(1)(b) GDPR.
Retention: image: none — it is discarded once the AI has returned its answer. If OpenAI checks the image as a fallback, OpenAI may keep it for abuse monitoring, usually for up to 30 days (Section 7.1). Check value (hash) and result: 30 days.

5.3 Posts in the shared group feed (photos and building-block sentences)

Certain group game modes — for example team competitions across multiple routes — include a shared session feed as well as photo and story relays where one team's post becomes another team's task. There is no free-typed text: you assemble text posts from preset building blocks or a fixed selection, and only the identifier of your selection is transmitted. Photos you post there are — unlike the verification photos in Section 5.2 — stored in our cloud storage and shown to the other participants of the same session. This applies only to sessions the host has set up as "13 and older"; for youth mode see Section 22.

Before publication, every photo is automatically reviewed by an AI (content safety and, where applicable, task relevance — details in Sections 6 and 24). Without approval the post is not shown; if the review fails for technical reasons, the post is likewise not published as a precaution. At the end of a session, post sentences, game statistics and up to three photos may be sent to the AI service again for a playful "award ceremony" (Section 6); player names are not sent to the AI service. There is no award ceremony in youth mode.

Storage location: Google Cloud Storage, region europe-west6 (Zurich, Switzerland); fellow players access photos via time-limited access links.
Processor: Google Ireland Limited / Google LLC.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until the session ends, at the latest about 24 hours — posts and photos are deleted automatically together with the session.

5.4 Topic scan when creating a rallye (on-device text recognition)

When creating a rallye, you can optionally photograph your own material (e.g. a worksheet or book page) with the camera, or pick an image from your library, to derive the topic from it. Text recognition (OCR) runs entirely locally on your device (Google ML Kit, on-device processing): the photo is neither stored nor transmitted to us or third parties and is discarded immediately after recognition.

Only the recognised text — which you can fully review, edit and delete before use — is sent to our backend as part of your generation request, just like a topic you typed yourself, and is passed on to the AI service for rallye creation there (Section 7). It is stored briefly in your user area together with the generation job and deleted automatically; as part of the generation request it may also appear in the generation log (Section 7).

Legal basis: Art. 6(1)(b) GDPR.
Retention of the photo: none — it never leaves your device.

6. AI image and content review

To automatically verify photo tasks, to check answers you type in for riddles and free-text tasks, to review group-feed posts before publication (Section 5.3), and for the award ceremony at the end of a group session, we send the respective content (photo and task text; for typed answers the riddle or task text, your answer and the expected solution; for awards post sentences, game statistics and individual photos — no player names) to an AI service. We use two providers for this: Google Gemini via Vertex AI (EU) and OpenAI (processing also in the US, Section 7.1). Which provider receives a request depends on the task:

The providers use the content to answer the respective request; OpenAI also checks it for abuse (Section 7.1). Use for training the AI models is contractually excluded with both providers. At Gemini the content is discarded after processing. OpenAI keeps requests and responses for abuse monitoring, usually for up to 30 days (Section 7.1).

So that the same answer does not have to be checked again, for typed answers we store your answer, the beginning of the riddle or task text, the expected solution and the result with a short reason for 30 days — without your user identifier.

Recipients: Google Ireland Limited (via Vertex AI) and OpenAI Ireland Ltd. (Section 7.1).
Processing region: Gemini: EU — Vertex AI via the EU endpoint eu (processing in data centres within EU member states). OpenAI: also the US, safeguarded by the EU Standard Contractual Clauses (Section 7.1).
Legal basis: Art. 6(1)(b) GDPR.

7. AI tour generation

When you request an AI-generated tour, we send your input (start and, where applicable, destination as coordinates, a given or imported route, theme, target group, difficulty, language and, where applicable, the text from the theme scan, Section 5.4) to our backend and from there to an AI service: primarily OpenAI (Section 7.1); if OpenAI fails or returns no usable response, Google Gemini via Vertex AI. Some steps always run via Gemini, for example translating the generated tasks and analysing place photos. The same applies when you have a single task regenerated in the tour editor; then the previous task and a keyword you enter for it are sent as well. The AI proposes stations, descriptions and tasks. You must not enter personal data of third parties.

The AI's response is stored in your personal rallye library and is visible only to you until you actively share it (e.g. by starting a group session).

To back place descriptions with facts, our backend additionally queries Wikipedia, Wikidata and Wikimedia Commons for the public places of a tour. What is transmitted are place names, coordinates of the tour area and the language — no account data and not your IP address. We no longer use Google Search for this.

Generation log: For every generation we store the request parameters (start, destination and anchor coordinates, theme, target group, duration, language) and the provenance of the station data — without your user identifier, but linked to the generated rallye via an identifier. During the beta we additionally store the source material we gathered (e.g. Wikipedia and OpenStreetMap data) as well as the requests sent to the AI and its answers for up to 180 days in order to analyse tour quality. These logs contain neither your user identifier nor your position during play nor images.

Recipients: OpenAI Ireland Ltd. (primarily, Section 7.1) and Google Ireland Limited (via Vertex AI, as a fallback for OpenAI and for individual steps).
Processing region: OpenAI: also the US, safeguarded by the EU Standard Contractual Clauses (Section 7.1). Gemini: EU — Vertex AI via the EU endpoint eu (processing within EU member states).
Legal basis: Art. 6(1)(b) GDPR.

7.1 AI provider OpenAI

Since September 2026 we primarily use OpenAI's language models for text. This covers tour generation (Section 7), description texts about public places, checking answers you type in (riddles and free-text tasks), and the award ceremony without photos (Section 6). If OpenAI fails or returns no usable response, Google Gemini takes over. For photos it is the other way round: Gemini checks first, OpenAI only as a fallback and only in the cases listed in Section 6. Speech output (read-aloud audio) stays with Google.

Only the content of the respective request goes to OpenAI. We do not send your user identifier, your name or your email address; OpenAI does not learn your IP address because the request comes from our backend. We have switched off storage of responses at OpenAI for later retrieval. Under the contract, OpenAI does not use the data to train or improve its models.

Recipient (processor): OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
Processing region and third-country transfer: OpenAI also processes the data in the US, among others through OpenAI OpCo, LLC. We do not use OpenAI's EU data residency. OpenAI Ireland Ltd. passes the data on to affiliates and third parties outside the EEA, including OpenAI OpCo, LLC in the US, only on the basis of agreements containing the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision of the European Commission (Art. 45 GDPR) (Section 4.1 of the data processing agreement with OpenAI).
Retention at the provider: OpenAI keeps requests and responses for up to 30 days to detect abuse. It keeps them longer only if the law requires it or if this is reasonably necessary to protect OpenAI's services or third parties from harm. OpenAI automatically scans images on receipt for child sexual abuse material; if this scan flags an image, OpenAI keeps it for manual review.
Legal basis: Art. 6(1)(b) GDPR.
More information: OpenAI enterprise privacy and how OpenAI handles API data.

8. Maps and place data

Map display in the app

The map in the app no longer comes from Google Maps. The app renders the map itself (open-source library MapLibre) from OpenStreetMap data, which it loads as map tiles from our own map server tiles.geowunder.com. The server is hosted at Hetzner Online GmbH in Falkenstein (Germany); no content delivery network sits in between. When tiles are requested, the server necessarily processes your IP address, information about the app or device (user agent) and the requested map area. These requests are recorded in an access log that is limited to a fixed size and continuously overwritten. The map's fonts and icons are bundled with the app and are not downloaded.

Offline map packages

So that the map also works without a connection during a tour, the app can download a map package for the tour area. For this our backend issues a short-lived, signed download link; the download runs directly from your device to Hetzner Object Storage (location Falkenstein, Germany). Your IP address is processed by Hetzner in the process. We keep a daily counter of issued links per account; it is deleted after two days at the latest. The map package is then stored locally on your device.

Routes and places (our own OpenStreetMap servers)

We compute walking and cycling routes exclusively on our own servers running OpenStreetMap data (worldwide coverage), and we also search for places along a tour there first. The servers are hosted at Hetzner in Falkenstein (Germany) and Helsinki (Finland). The requests are made by our backend, not by your device; they contain only coordinates, search radius or route points and no account data. The backend also looks up the place name for a coordinate on these servers of our own.

Place search (our own dataset)

For place search (suggestions while you type a start or destination) our backend uses a dataset of our own built from OpenStreetMap and Wikidata data. It is stored in our Firestore database in the region europe-west6 (Zurich, Switzerland). What is sent is your search text, the language and — so that places near you appear first — optionally a reference point: the centre of the map currently shown or, if no map is shown, your device position rounded to 0.01° (about 1 km). Your device position is only sent if you have already granted location permission; you are not asked for it specifically. We use the search text and the reference point only to answer the request and do not store them. The place data is partly based on OpenStreetMap (© OpenStreetMap contributors) and is available under the Open Database License (ODbL) 1.0 (openstreetmap.org/copyright; details in the imprint).

We no longer use the Google Places API, the Google Maps SDK or the Google Routes API, and we no longer display place photos from Google.

We do not persistently store Google Maps Content. From the former place search via the Google Places API, our database still holds the identifiers Google permits to keep indefinitely — place IDs and coordinates. No new ones are added; the old entries are deleted no later than when their retention period ends. Our own enrichments about public places (AI-generated description texts, mission hints, facts from Wikipedia/Wikidata) may be retained for up to 12 months, place data from OpenStreetMap for up to two years. They relate to public places, not to you.

Images from Wikimedia Commons

Preview images of places in "Discover" and historical comparison images in photo missions come from Wikimedia Commons. The app loads these images directly from the servers of the Wikimedia Foundation; your IP address and information about the app or device are transmitted to Wikimedia in the process. Details: Wikimedia Foundation privacy policy.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in functional navigation).

9. Multiplayer chat in party mode

In party mode you can send messages to fellow players. You pick them from a fixed catalogue of preset messages — free-typed text is not possible; only the identifier of the chosen message is stored. Messages are stored within the temporary session and visible only to the participants of the same session. In youth mode (Section 22) chat is switched off.

Photos in the shared group feed (Section 5.3) are automatically reviewed by an AI before publication; without approval they are not shown to fellow players. If you encounter content that violates our terms or applicable law, use the "Report" function. Reported content is sent to us and reviewed.

If you report a chat message, we store a copy of that message with the report. It therefore survives the 24-hour deletion of the session — otherwise the report could no longer be reviewed at the very moment someone reviews it. Retention of this copy: see Section 17 (reports under DSA Art. 16).

Retention: until the session ends, at the latest about 24 hours after.
Legal basis: Art. 6(1)(b) GDPR.

10. Push notifications and Live Activities

During an active game session, GeoWunder can send you push notifications (e.g. when it is your team's turn again). For this we use Firebase Cloud Messaging (FCM) by Google — on Android devices, and for regular notifications on iOS as well. If you allow push notifications, a device push token is generated when you join a session and stored, together with your app language, in your entry of the player list for the duration of the session; it is deleted together with the session. This entry is technically readable by the members of the same session.

On iOS devices, GeoWunder can additionally show "Live Activities" on the lock screen and in the Dynamic Island so you can see live game information (position, scores) without opening the app. Our backend pushes score updates via the Apple Push Notification service (APNs). For Live Activities we additionally store in the session a Live Activity push token issued by Apple and the most recently displayed game state; both are deleted together with the session.

Recipients: Google Ireland Limited / Google LLC (Firebase Cloud Messaging) and Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (APNs).
Third-country transfer: US, EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(b) GDPR; push messages are sent only if you allowed them in system settings.

11. Usage statistics (Firebase Analytics) and crash reports (Crashlytics)

To improve the app, we collect usage events (e.g. "rallye started", "task solved") plus device and version info only with your consent. The events are pseudonymous: we link them to your Firebase user ID, but never to your real name. Google adds an app-instance identifier, device characteristics, the app version and an approximate region derived from the IP address; we add the identifier of the rallye played and of the play-through. We do not collect an advertising ID. The events are exported daily to our Google BigQuery project (region europe-west6, Zurich) and analysed there. We do not profile for advertising and never sell, rent or share your data for marketing.

If the app crashes, Firebase Crashlytics — likewise only with your consent — sends a crash report with stack trace, device and version data, and your Firebase user ID to Google. The report includes the app's most recent technical log lines; these may contain the PIN of a session, your user ID and — in the event of a sign-in conflict — your email address. We use this strictly for debugging.

You can revoke your consent at any time under Settings → Privacy → Anonymous usage statistics. No further analytics or crash data will be sent thereafter.

Recipient: Google LLC. For Firebase Analytics there is a joint controllership (Art. 26 GDPR) between us and Google; see firebase.google.com/terms/data-processing-terms.
Retention: 14 months (Firebase Analytics default, configurable), up to 90 days for Crashlytics crash data.
Legal basis: Art. 6(1)(a) GDPR (consent).

12. App verification (Firebase App Check)

To deter abuse of our backend, we use Firebase App Check (Apple App Attest / Google Play Integrity). Device- and installation-specific attestation tokens are generated; no content or personal data is evaluated.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and abuse protection).

13. Email delivery (Resend)

We use Resend to send sign-in links ("magic links"), one-time codes for the web dashboard, emails about organisation licences (activation, invitations) and the download link for a data export. In doing so we transmit your email address and the content of the respective email (e.g. link or code) to Resend. Via Resend we also receive internal notifications to our own mailbox when someone uses the contact or sales form or reports content; these emails contain the information entered in the form (name, email address, message, browser identifier) or the details of the report.

Recipient: Resend, Inc., 2261 Market Street #4667, San Francisco, CA 94114, USA.
Third-country transfer: US, EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(b) GDPR.

14. In-app purchases

Certain features ("AI coins") can be acquired via in-app purchase. Payment is handled exclusively by Apple (App Store) and Google (Play Store); we never receive payment data such as card numbers. After a purchase the app sends the product identifier and the store's purchase receipt to our backend, which has the receipt verified by Apple or Google and only then credits the coins. We keep your coin balance and the related ledger entries exclusively on the server under your user identifier; they are deleted together with your account.

Welcome credit: protection against repeated redemption

New accounts with a verified email address or an Apple or Google sign-in receive a one-time starting credit. So that it is granted only once per device, the app sends a device identifier (Android: the Android ID; iOS: the vendor-specific identifier "identifierForVendor") to our backend. Of this we store only a non-reversible hash value together with your user identifier and the time. On iOS we additionally use Apple's DeviceCheck service: the app generates a device token, and our backend has Apple set or query a flag for this device. We also count redemptions per IP address within a 24-hour window; here, too, only a hash value of the IP address is stored. If you delete your account, we remove your user identifier from the device entry; the hash value itself remains so that the starting credit cannot be triggered again by deleting and re-creating an account.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and abuse prevention).

Recipients: Apple Inc. (iOS), Google LLC (Android).
Legal basis: Art. 6(1)(b) GDPR.

15. Visiting geowunder.com

When you visit the website, technically necessary data (IP address, date/time, user agent) is recorded in server logs by our hosting provider Google Firebase Hosting, solely to deliver the site and defend against attacks. Fonts (Nunito, Inter) are self-hosted — no transfer to third parties. Legal basis: Art. 6(1)(f) GDPR.

Cookieless reach measurement

We count page views with our own cookieless counter: only aggregated daily counts per page are stored — no IP addresses, no device identifiers, no profiles, no cookies. The data cannot be linked to a person. Legal basis: Art. 6(1)(f) GDPR.

Playing and hosting in the browser (play.geowunder.com)

At play.geowunder.com you can join a group session or host one without the app. The site is served via Google Firebase Hosting. When you open it, an anonymous account with a technical Firebase identifier is created — as in the app; hosts can additionally sign in with email, Google or Apple. In the session's player list we store the player name you chose (from a fixed list of names) and your progress; players in the browser do not transmit a GPS position. In your device's browser storage (localStorage) the site keeps the identifier of your player name, the language, your decision on usage statistics and reports that have not yet been sent.

To protect against abuse the site uses Firebase App Check with Google reCAPTCHA Enterprise; Google collects browser and device characteristics to issue a verification token. In the host view (map of teams, route planner) the map is loaded via the Google Maps JavaScript API; the host's IP address and browser data and the displayed map areas are transmitted to Google. On request, the route planner queries the browser location once. We collect usage statistics (Firebase Analytics) in the browser only after you agree in the notice banner. If a technical error occurs, the site stores — independently of that — an error report in your user area of our database (error text, beginning of the stack trace, the most recent interaction steps, build version — no location or content data); it carries a deletion date of 14 days.

Google Analytics 4 (only with your consent)

Google Analytics 4 is currently not activated on geowunder.com: neither a cookie banner is shown nor an analytics script loaded. The following paragraph only applies once we activate the service. If you consent via our cookie banner, we use Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without consent, no analytics cookies are set. Purpose: reach measurement and improving our offering (pages visited, dwell time, clicks on download and purchase buttons). IP anonymisation is active; advertising features are disabled. Analytics cookies (e.g. _ga) are stored for up to 2 years. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR, § 25(1) German TTDSG. Withdrawal: at any time via “Cookie settings” in the footer — as easy as giving consent.

Sales and contact forms

If you use our sales or feedback form, we process the data you provide (name, email, organisation if given, message) to answer your request. In addition we store the browser identifier (user agent) and — to protect against spam — a truncated hash value of your IP address; we do not store the IP address itself. We are notified of new submissions by email (Section 13). Data is deleted automatically after 90 days unless a business relationship is established. Legal basis: Art. 6(1)(b) GDPR.

Organisation dashboard and license accounts

For organisation licenses (schools, companies) we process the work email address, the role within the organisation and aggregated usage figures (number of AI generations per month). Sign-in to the web dashboard uses a one-time email code; an account may be created in the process. Organisation admins only see whether a member's seat was used in the current month — no individual counters. In addition, we record every AI generation triggered under a licence as an individual entry with the member's user identifier so that usage can be evidenced in the event of a dispute; these entries are deleted automatically after about 24 months. One-time codes expire after 10 minutes, open invitations after 14 days. Legal basis: Art. 6(1)(b) GDPR.

Payment processing via Paddle

Licenses are sold via Paddle.com Market Limited (Judd House, 18–29 Mora Street, London EC1V 8BT, UK) as merchant of record. Paddle processes billing and payment data under its own responsibility; see Paddle’s privacy policy. We do not receive full payment data from Paddle, only contract master data (e.g. subscription status, seats, contact email).

16. Processors and third-country transfer

We rely on the following processors:

Processor Purpose Processing region
Google Ireland Limited (Vertex AI) AI image verification, pre-publication review of feed posts, award ceremony with photos, embeddings, individual steps of AI tour generation (e.g. translation, analysing place photos); fallback if OpenAI fails or returns no usable response (AI tour generation, place enrichment, checking answers you type in, award ceremony without photos) EU — EU endpoint eu (processing within EU member states)
OpenAI Ireland Ltd. (with OpenAI OpCo, LLC) AI tour generation, place enrichment, checking answers you type in, award ceremony without photos; fallback for task photo verification (Section 7.1) USA (no EU data residency), EU Standard Contractual Clauses
Google (Vertex AI, speech synthesis) Read-aloud audio about public places — exclusively our own description text about a public place, no user content USA — us-central1
Google Ireland Limited / Google LLC (Firebase) Authentication, Firestore, Storage, Cloud Functions, Hosting (geowunder.com, play.geowunder.com), App Check (in the browser with reCAPTCHA Enterprise), Google Maps JavaScript API (hosts in the browser only), BigQuery analysis Firestore + Storage + Functions: europe-west6 (internal administrative functions in europe-west3, Frankfurt); Authentication / Maps JavaScript / App Check: global Google infrastructure (may include the US)
Google LLC (Crashlytics, Analytics, Cloud Messaging) Crash reports, pseudonymous usage statistics (opt-in only), push notifications USA
Apple Inc. Push Notification service (APNs), Sign in with Apple, App Store purchases including receipt verification, DeviceCheck USA
Resend, Inc. Transactional email (sign-in links, one-time codes, licence emails, data export link, internal notifications) USA
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany Our own map servers (map tiles), object storage for offline map packages, OpenStreetMap servers for routes and places EU — Falkenstein (Germany), Helsinki (Finland)

In addition, our backend queries publicly available services without transmitting account data or your IP address: Wikipedia, Wikidata and Wikimedia Commons (Wikimedia Foundation, Section 7). The app loads images from Wikimedia Commons directly (Section 8).

Data residency for AI processing: All content from you that we send to Gemini (photos, tour themes, location inputs, texts from the theme scan) is processed via the Vertex AI EU endpoint exclusively in data centres within EU member states. Content we send to OpenAI (tour-generation input such as tour themes, location inputs and texts from the theme scan, when a task is regenerated the previous task and your keyword, answers you type in, post sentences and game statistics for the award ceremony and, as a fallback, photos from photo missions and photo hunts) is also processed by OpenAI in the US (Section 7.1). A further exception does not concern user data: the read-aloud audio about public places is generated by Google in the region us-central1 (USA); only the description text about a public place (curated by us or generated from public sources such as Wikipedia/Wikidata) is sent there — no content from you, no position, no identifier.

Data residency for backend: Firestore, Cloud Storage and Cloud Functions are pinned to europe-west6. For the database there is a rolling point-in-time recovery history and daily backups, each retained for seven days; deleted data may persist there for up to seven days. Our map and OpenStreetMap servers and the storage for offline map packages are hosted at Hetzner in Germany and Finland. The authentication and platform components (Firebase Auth, App Check and, in the browser, Maps JavaScript API and reCAPTCHA Enterprise) are operated by Google as global services and may route requests through US infrastructure.

Remaining third-country transfers (opt-in Crashlytics/Analytics, Apple services, Resend, OpenAI, Google platform components including speech synthesis) are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and — where applicable — the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).

17. Retention and deletion

We store personal data only as long as needed for the stated purposes:

When you delete your account in the app (Settings → Delete account), all data tied to your identifier — including uploaded photos and videos and your rallyes — is removed. Orphaned session data under pins is cleaned up by the 24-hour process above. This also deletes your coin balance including the ledger, your organisation membership, your sessions and your posts in other people's sessions. What remains — in each case without your user identifier — are the device hash of the welcome credit (Section 14) and the generation logs (Section 7). Deleted data remains contained in the database backups for up to seven days.

One named exception: reports you submitted under DSA Art. 16 remain as a case record — we are obliged to be able to evidence how we handled reports (Art. 17(3)(b) and (e) GDPR). Your personal reference is removed: when you delete your account, we remove your identifier and your email address from these records. What remains is time, subject, reason, location of the content and processing status — without you. Reports that others submitted about a post of yours remain unchanged: they are the subject of the review and not your data trail.

18. Your rights

Under the GDPR you have the following rights:

Send access and deletion requests informally by email to info@geowunder.com. You can perform account deletion yourself under Settings → Delete account.

19. Competent supervisory authority

For you the competent supervisory authority is generally the one of your German federal state. Ours, as the controller's place of establishment, is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
(State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

20. Obligation to provide data

Providing data is neither required by law nor by contract. You are not obliged to create an account or use the app. However, without providing the relevant data you can only use the app to a limited extent or not at all.

21. Security (Art. 32 GDPR)

We use technical and organisational measures to protect your data against unauthorised access, loss, or tampering:

22. Children and young people

GeoWunder is intended for users aged 13 and older. We do not knowingly process personal data of children under 13 — this age limit also aligns with the US Children's Online Privacy Protection Act (COPPA). If you become aware that a child under 13 is using our app, please notify info@geowunder.com; we will delete the data without undue delay.

For users between 13 and 15 (Art. 8 GDPR), processing of personal data — in particular optional analytics consent and transfers to third-country processors — is permitted only with the consent of the parents or legal guardians. By accepting this policy, minors confirm that such consent has been obtained.

In a school or educational context, teachers can let their classes use the app anonymously (no personal account) — in that case no real names or email addresses are collected.

Youth mode in group sessions: When setting up a group session, the host specifies which group the round is for ("Children up to 12" or "13 and older") — players themselves are not asked for their age, and if the setting is missing, youth mode applies. In youth mode teams only see the joint result: there is no list of individual posts, no chat, no attribution of posts to individuals, no award ceremony and no image export. Photos are not published in the feed; at most, the app transmits a photo for automatic task verification (Section 5.2), after which it is discarded. In youth mode this photo check is done by Google Gemini in the EU only. Answers typed in (riddles and free-text tasks) are checked primarily by OpenAI in youth mode as well (Section 6). In all sessions player names come from a fixed list of names.

23. Cookies and similar technologies

The geowunder.com website does not use cookies and has no tracking, analytics or marketing pixels — with two technically required exceptions: (1) If you start a purchase on the pricing page, we load the checkout library of our payment provider Paddle (Section 15) only at that moment; Paddle may then set strictly necessary cookies (§ 25(2) TTDSG, Art. 6(1)(b) GDPR). (2) The password-protected web dashboard loads technically required Firebase libraries from Google servers. The app stores settings and session data only locally on your device (app sandbox); these are not cookies under § 25 TTDSG (German TDDDG). Google Analytics 4 (Section 15) is currently not activated and therefore sets no cookies. The browser version at play.geowunder.com keeps settings (the identifier of your player name, language, the sound setting, your decision on usage statistics) in local browser storage and, to protect against abuse, loads Google reCAPTCHA Enterprise and — only in the host view — the Google Maps JavaScript API; Google may use its own cookies or comparable identifiers in the process.

24. Automated decisions

Automated AI evaluation of photos and of answers you type in serves only the gameplay (task solved / not solved). The automated review of feed posts before publication (Section 5.3) likewise serves only the protection of fellow players and the gameplay; a post that is not approved is simply not shown — you receive an in-app notice with a reason and can contest the decision via the complaint procedure in our Terms of Use (Section 10). There is no automated decision in the sense of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

25. Law-enforcement requests

We only disclose your data to law-enforcement or other authorities when legally compelled to do so (e.g. by court order). Each request is reviewed for legality and proportionality.

26. Changes to this policy

We may amend this policy when the legal situation or the functions of our app change. We will inform you about material changes inside the app. The current version is always available at geowunder.com/en/privacy.

CCPA / CPRA Addendum — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you additional rights. This addendum supplements the GDPR sections above; in case of conflict, this addendum prevails for California residents.

A. Categories of personal information we collect

In the 12 months preceding the date below we have collected the following CCPA categories of personal information:

We do not collect: government IDs, financial-account info, biometric data, health data, precise religious or political opinions, sexual-orientation data, or genetic data.

B. Sources of personal information

C. Business and commercial purposes

We use the categories above for:

D. Recipients

We share personal information with the following categories of recipients, only to the extent needed for the purposes above:

E. "Sale" or "sharing" of personal information

We do not sell your personal information for monetary or other valuable consideration. We do not share your personal information for cross-context behavioural advertising. We have no signals to honour for the Global Privacy Control (GPC) because we operate no advertising mechanisms.

F. Your California rights

G. How to submit a request

Send a verifiable consumer request by email to info@geowunder.com with the subject "CCPA request". Include enough information so that we can reasonably verify your identity (e.g. the Firebase user ID associated with the request, the email address on file).

You may use an authorized agent to submit a request on your behalf — please attach a signed permission. We will respond within 45 days; if we need more time, we will notify you and extend by up to another 45 days.

H. Shine the Light

California Civil Code §1798.83 lets California residents request information about disclosures we have made of personal information to third parties for their direct marketing purposes. We do not share data for third-party direct marketing, so we have nothing to disclose here.

I. Retention

We retain personal information only as long as needed to provide the service or to comply with legal obligations. See Section 17 above for category-level retention periods.

Last updated: 26 September 2026 · Version 1.8