Data Privacy Policy

This is a courtesy translation. The German version is binding: Datenschutzerklärung.

This policy explains how Location Science GmbH processes personal data on this website and in the StoryMapp app, in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG).

1. Controller

Location Science GmbH
Purrbachstr. 7c, 85305 Jetzendorf, Germany
Represented by the managing director Tobias Neumann
Email: [email protected]

We have not appointed a data protection officer, as we are not required to do so. For all questions about data protection, write to the address above.

2. This website

2.1 Hosting and server logs

This website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you open a page, your browser sends a request to GitHub’s servers. GitHub processes the technical data needed to deliver the page and to keep the service secure: your IP address, the date and time of the request, the requested URL, the referring page, and your browser and operating system. We ourselves do not receive these logs.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating a secure and reliable website. GitHub, Inc. is certified under the EU-US Data Privacy Framework; transfers to the USA rest on the adequacy decision of the European Commission for that framework (Art. 45 GDPR). GitHub’s privacy statement: docs.github.com/site-policy/privacy-policies.

2.2 Fonts

The fonts used on this website are stored on our own hosting. No request is made to third-party font servers.

When you first visit, a banner asks whether you allow optional cookies. Your choice is stored in your browser’s local storage so that the banner does not reappear. In the same way we store which language version you chose when you answer the language hint or switch languages. Both are strictly necessary to honour your decision (§ 25 (2) no. 2 TDDDG) and contain no personal data beyond the choice itself. To change your choice, delete this site’s data in your browser settings; the banner will then appear again.

2.4 Web analytics

We only use web analytics with your consent, given through the banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). At present no analytics tool is loaded on this website, whatever you choose. If we introduce one, it will load only after you have allowed analytics in the banner, and this policy will name the provider, the data processed and the retention period before that happens. You can withdraw consent at any time by deleting this site’s data in your browser.

This website links to the Apple App Store, Google Play and GitHub. Data is only transmitted to these providers when you click a link; from then on, their privacy policies apply.

2.6 Contact by email

If you write to us, we process your email address, the content of your message and any data you provide in order to answer you. Legal basis: Art. 6 (1) (b) GDPR where the message concerns a contract or a request for one, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries. Correspondence is kept in line with our data retention policy.

3. The StoryMapp app

3.1 Location data

The app processes your device’s location entirely on the device. Location data is used only for the immediate functionality of the app (showing places around you), stored temporarily in the app’s cache, cleared when the app is closed, and never transmitted to our servers or to third parties. You can revoke the app’s location permission at any time in your device settings.

3.2 Account and login

You can use the app without an account. If you choose to sign in via Google or Facebook, our authentication service (Keycloak) receives your email address and an authentication token from the provider you chose. We use this data to create and secure your account. Legal basis: Art. 6 (1) (b) GDPR. Google and Facebook process your data under their own privacy policies when you sign in with them.

3.3 Usage data for signed-in users

For signed-in users we store the interaction history within the app, saved favourites and preferences, and basic device information (device type, operating system version), so that your history and favourites are available to you. Legal basis: Art. 6 (1) (b) GDPR. You can delete your account and this data at any time in the app or by writing to us.

3.4 Map display

To display the map, the app loads map tiles from map providers. When tiles are loaded, the provider receives your IP address and the requests for the map area you are viewing. Providers used: MapTiler AG (Switzerland, a country with an adequacy decision), Mapbox, Inc. (USA, certified under the EU-US Data Privacy Framework) and the OpenStreetMap Foundation (United Kingdom, a country with an adequacy decision). Legal basis: Art. 6 (1) (b) GDPR, as the map is the core function of the app.

3.5 Advertising

The app is free of charge and shows advertisements. Advertising is delivered through Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with partner networks. The full list of networks authorised to sell advertising space in the app is published at app-ads.txt.

When an advertisement is loaded, the advertising provider receives technical data such as your IP address, device type and operating system, the app name, and the advertising identifier of your device, and records whether an advertisement was shown or tapped.

  • Personalised advertising is only shown if you consent to it in the dialogue displayed in the app (on iOS also via the App Tracking Transparency prompt). Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw consent at any time in the app’s settings or by resetting or restricting the advertising identifier in your device settings.
  • Non-personalised advertising is shown without consent and is based on Art. 6 (1) (f) GDPR, our legitimate interest in financing a free app. It uses only the technical data needed to deliver and count advertisements.

Google and its partners may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Further information: Google’s privacy policy and Google’s advertising settings.

3.6 Usage statistics and crash reports (Firebase)

The app uses Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for two purposes:

  • Usage statistics (Google Analytics for Firebase). Which screens are opened, which features are used, app version, device type and operating system version, together with a pseudonymous app-instance identifier. We use this to understand how the app is used and to improve it. This data is collected only if you consent to it in the dialogue displayed in the app. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw consent at any time in the app’s settings.
  • Crash reports (Firebase Crashlytics). If the app crashes, a report with the app version, device type, operating system version, the state of the app at the time and a pseudonymous identifier is sent to Firebase so that we can find and fix the error. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a stable app.

Neither data set is linked to your account. Usage statistics are kept for 26 months, crash reports for 90 days. Google may transfer this data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Further information: Firebase privacy and security.

4. Recipients and transfers

We pass personal data to third parties only where this policy says so: our hosting and authentication providers, the map providers, Firebase, and the advertising providers named above. Where data is transferred to countries outside the EU, this rests on an adequacy decision of the European Commission (Switzerland, the United Kingdom, and the EU-US Data Privacy Framework for certified US companies).

5. Retention

We keep personal data only as long as needed for the purposes described here or as required by law. The specific periods are set out in our data retention policy.

6. Your rights

Under the GDPR you have the right to access your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7 (3)). To exercise these rights, write to [email protected]. Our data subject requests page explains how we handle requests.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Email: [email protected]
Website: www.lda.bayern.de

7. Partner organisations, API customers and clients

Partner organisations that publish tours on StoryMapp, and customers of our content API, do not transfer personal data of their own users to us; we remain the controller for the data of app users described in section 3. The roles are set out in section 8 of our Content Provider Agreement. Where a specific project does require us to process personal data on a partner’s behalf, we conclude a data processing agreement under Art. 28 GDPR, or a joint-controller arrangement under Art. 26 GDPR, as an annex to that project’s schedule.

For consulting, software-engineering and subcontracting projects in which we process personal data on behalf of our clients, we conclude a data processing agreement based on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/915). Our template, including the technical and organisational measures and the list of our sub-processors, is available on request from [email protected].

8. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Changes to this policy

We update this policy when our processing changes or the law requires it. The current version is always available at this address.

Last updated: 19 October 2026