Contents
1. Who we are (controller)
The controller responsible for the processing of personal data in the Locaided app and on this website (within the meaning of Art. 4(7) GDPR) is:
A data protection officer is not required by Art. 37 GDPR / § 38 BDSG given the size and processing activities of the controller. For any privacy-related question, please use the email address above.
2. The Locaided app
This section covers the Locaided app for iPhone and Android. Locaided shows what people post around you. To do that, the app needs to know roughly where a post was made. We collect only what the app needs to work. We do not show ads, we do not sell data, and we do not track you across other apps or websites.
Account
What: your name, your email address and a user ID. If you sign in with Apple or Google, we receive your name and email address from that service (with Apple you can choose a private relay address). We do not use passwords; you sign in with a one time code sent to your email address.
Why: to create your account, sign you in and show your profile.
Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
Location
What: the exact position of your phone (GPS) is used at the moment you open the feed or post something. It is used in that moment and never stored. With each post and story we store only the rough area it was made in (a map cell of a few square kilometres). If you choose to show a street address on a post, that address is stored with the post and shown to others.
Why: to show you posts from people nearby and to place your posts in the right area.
Legal basis: Art. 6(1)(b) GDPR. Showing a street address is optional and based on your choice (Art. 6(1)(a) GDPR). You can withdraw location access at any time in your phone's settings; the local feed then cannot work.
Content
What: posts, stories, photos, videos, comments and direct messages you create, and the likes, dislikes and ratings you give. Posts and stories are visible for 24 hours; the community can shorten or extend this with likes and dislikes.
Why: this is the purpose of the app. Posts and stories are visible to people in the areas you choose and to the contacts you select. Direct messages are visible to the people in the conversation.
Legal basis: Art. 6(1)(b) GDPR.
Reports and safety
If you report a post, story or profile, we process the report, the reported content and the accounts involved to review it and to remove content that breaks our rules. Where the law requires it, we pass information to the authorities, in particular in cases of child sexual abuse material (see our Child Safety Standards).
Legal basis: Art. 6(1)(f) GDPR (keeping the platform safe) and Art. 6(1)(c) GDPR (legal obligations).
Purchases
What: when you buy "areas" packs in the app, the payment is handled by Apple (App Store) or Google (Google Play). We never see your payment details. We receive a record of the purchase through our service provider RevenueCat so that your balance is correct on all your devices.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping records that tax and commercial law require.
Diagnostics
What: if the app crashes or an error occurs, a crash report is sent to our error tracking service Sentry (servers in the EU). It contains technical details about the error and the device, linked to your user ID so we can fix problems that affect you. Crash reports are kept only for a limited period and then deleted automatically.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in an app that works).
Push notifications
What: if you allow notifications, your phone gives us a push token, which we store so we can notify you, for example about replies or about alerts near you. You can switch notifications off at any time in your phone's settings.
Legal basis: Art. 6(1)(a) GDPR (your permission on the device) and Art. 6(1)(b) GDPR.
Service providers
We use the following providers. They process data only on our behalf and under data processing agreements, unless stated otherwise:
- Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): hosting of the app and its data in the Frankfurt region (Germany).
- Sentry (Functional Software, Inc., USA): crash reports, stored in the EU.
- RevenueCat (RevenueCat, Inc., USA): management of in app purchases.
- Expo (650 Industries, Inc., USA), Google Firebase Cloud Messaging (Google Ireland Limited) and Apple Push Notification service (Apple Distribution International Ltd., Ireland): delivery of push notifications.
- Apple and Google process payments for in app purchases as independent controllers under their own privacy policies.
Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) if the provider is certified, or otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).
How long we keep data
- Account data is kept as long as your account exists.
- Posts, stories and comments are no longer shown after they expire. When you delete your account, they are removed within 24 hours.
- Direct messages are deleted automatically 90 days after they were sent, also after you delete your account.
- Exact GPS position: not stored.
- Purchase records are kept without your user ID for up to 10 years, as German tax and commercial law requires.
- Reports are kept as long as needed to handle them and, where required, for the authorities.
Deleting your account
You can delete your account in the app at any time: Profile → Delete your account. If you no longer have the app, see locaided.com/delete-account.
Age
Locaided is intended for people aged 16 and over.
No automated decisions
Your feed is sorted by distance and time. We do not use profiling or automated decisions with legal or similarly significant effects (Art. 22 GDPR).
3. The website: what data we process
Server log data
When you visit this website, our hosting provider (see section 6) automatically logs technical information that your browser sends. This typically includes:
- IP address (in shortened form where possible)
- Date and time of the request
- The requested URL and HTTP status
- Referrer URL (the page you came from)
- Browser and operating system
Purpose: ensuring the technical operation, security and stability of the website, defending against attacks, and identifying and resolving errors.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing a working, secure website.
Retention: log data is kept only as long as needed for those purposes, typically a few days, and is then either deleted or anonymised.
Contact form & email
If you reach out via our contact form or by email, we process the data you provide (name, email, message and optional category) to handle your enquiry.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Retention: we keep your message until your enquiry is fully resolved, plus any retention period required by law (e.g. tax-relevant correspondence under § 257 HGB / § 147 AO).
Contact form submissions are processed for us by Netlify, Inc. (see section 6). We have a Data Processing Agreement in place with Netlify.
4. Web fonts
All fonts on this website (Britti Sans, Inter and Work Sans) are served from our own server. No connection to Google Fonts or any other font provider is made.
5. Cookies
This website does not currently set any tracking cookies, analytics cookies or marketing cookies. We use a small localStorage entry only to remember your choice from the cookie banner (so we don't ask you again on every visit). This entry contains nothing more than your consent decision and is stored on your device, not on our servers.
You can clear it any time by clicking Manage cookies in the footer.
If we add optional analytics or marketing services in the future, we will only load them after you have given consent under Art. 6(1)(a) GDPR / § 25 TDDDG, and we will update this page accordingly.
6. Hosting
This website (not the app) is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. Hosting includes serving the static pages and processing contact form submissions.
For data transfers to the USA, Netlify is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of data protection (Art. 45 GDPR).
More details: netlify.com/gdpr-ccpa.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of incorrect data (Art. 16)
- Erasure of your data (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw any consent you have given, with effect for the future (Art. 7(3))
To exercise any of these rights, email us at privacy@locaided.com. You can delete your app account yourself at any time, see Delete your account.
8. Right to complain
You have the right to lodge a complaint with a supervisory authority. The authority responsible for our company is:
Postfach 31 63
65021 Wiesbaden, Germany
datenschutz.hessen.de
9. Changes to this policy
We may update this policy when our processing changes — for example, when we add a new service or feature. The current version is always available at this URL with the effective date shown at the top.