Legal
Privacy policy
Last updated: 7 September 2026
This notice explains how personal data is processed on the Friendground website and in the app. The data processed depends on the features you use and the permissions you grant.
1. Controller
Pixelbaum, Michael Tannenbaum, Bergstraße 40, 53332 Bornheim, Germany. Email: hi@friendground.app.
2. Website access
To deliver and protect the site, the server necessarily processes connection data such as an IP address and requested URL while handling the request. The Web application disables request logging, and the public edge removes IP addresses, paths, and headers before writing operational events. The marketing site adds no advertising cookies or marketing analytics. Private invitation and email sign-in routes are configured against indexing and broad referrer sharing.
3. Support and other requests
Email links open your mail application. We process your sender address and the information you send to answer support, access, safety or deletion requests. For account deletion we verify ownership before acting. Please send only what is needed for your request, without passwords, sign-in codes, child names or exact locations. Correspondence is retained while needed to handle the request and any necessary follow-up; legal retention duties and the separate rules for safety evidence may apply. Electronic withdrawals use your name, contract description and confirmation email to receive and handle the declaration and send a receipt. Encrypted delivery records are deleted after 90 days; correspondence needed for a specific legal obligation or claim may be kept separately for that purpose. No account is deleted merely because this public form is submitted.
4. Data processed in the app
Depending on the features you use, Friendground processes account identifiers, sign-in details, a display name, confirmed connections and invitations, your selected place and time, optional notes and child context, replies, blocks, reports and security records. A selected playground or a custom map pin is sent to our server and shared with the people authorised to see your update. A custom pin can specify an exact location. Optional photos and notification-device credentials are processed when those features are enabled. If you enable playground detection, your device uses precise location, including in the background with your permission, to recognise arrival. Raw detection measurements stay on your device. Our server receives coarse map-cell requests and stores detection preferences, playground rules and a hashed, revocable device credential; a confirmed automatic update sends the selected playground and time. Reduced visit summaries support your private statistics. We also store the version and time when you agree to the terms of use. For Sign in with Apple, we retain an encrypted provider token so that we can revoke your authorization when you delete your account. It is removed after successful revocation; outages may delay this step. A pseudonymous revocation timestamp remains for up to 15 minutes to prevent an older sign-in attempt from restoring access. Everyday reminders consider recent app use, current updates and confirmed connections. Optional timing learning keeps only broad time windows from updates you publish yourself for up to 28 days, without places or message content. Both settings start enabled once notifications are allowed and can be switched off separately in Notifications; switching off either clears learned times. These operational data are separate from usage analytics. A small delivery budget prevents more than two additional reminders in seven days.
5. Child context
Children do not have accounts or separate location updates. A caregiver may optionally add a freely chosen name or nickname to one update. Friendground does not collect a child's age, birth date, age group, gender, continuous route, or background location.
6. Purposes and legal bases
We process account, connection, status and support data to provide the service you request (Article 6(1)(b) GDPR). Optional location detection and other processing that requires your consent use Article 6(1)(a) GDPR; you can withdraw consent for the future in the app or device settings. We process necessary data to meet legal duties (Article 6(1)(c) GDPR) and to secure the service, prevent abuse, review reports, document acceptance of our terms and handle disputes (Article 6(1)(f) GDPR). Agreeing to the terms is separate from optional location permission and from your right to object to product analytics.
7. Product analytics
We also count the days when you open or read the app in the foreground, using a fixed authenticated request after the updated notice has been displayed. We store at most one UTC usage day per account for 30 days, without exact activity times, session duration or device identifiers. Usage days are excluded from detailed local exports and are erased when you object or delete your account. To check whether Friendground's invitation and availability features work and lead to the intended interactions, we process a limited set of pseudonymous facts about completed actions on the Friendground server. These facts contain a calendar date, language, account age in days, number of confirmed connections and, depending on the action, limited details such as invitation type, source screen, current or later timing, playground or custom place, number of friends who could see an update, response type, response time in seconds, or confirmed co-presence. For a person opening a public invitation, we count the page view without creating an analytics ID or adding their IP address or browser data to the analytics fact. We do not use names, messages, contacts, photos, child information, precise locations, advertising identifiers, cookies, an analytics SDK, session replay, or analytics storage on the device. The legal basis is our legitimate interest in checking and improving the service (Article 6(1)(f) GDPR). We do not use the facts to evaluate, personalize, or make decisions about individual users. You can object at any time under Profile → Privacy & data. This stops new facts and deletes your detailed analytics from the active system. Temporary local analysis copies are deleted within one hour. Detailed facts are deleted after no more than 13 months. Sufficiently anonymized monthly totals may be retained without a time limit. Product analytics is hosted with Friendground by Hetzner in Germany; no external analytics provider receives these data.
8. Service providers
Current provider categories include Hetzner for hosting, mailbox.org for email, and — depending on device and chosen feature — Apple or Google for sign-in, push delivery, Store distribution, and native map services. Public playground data may come from OpenStreetMap contributors. Providers receive only the data needed for their role and act under their own terms where applicable.
9. International transfers
Apple and Google may process data outside the European Economic Area. Where the GDPR requires it, transfers rely on an adequacy decision or appropriate safeguards such as standard contractual clauses.
10. Retention
A status is operational until it ends. The original update, text replies, quick responses, and related temporary activity are removed from live systems after the defined grace period, with replies deleted 12 hours after the original update ends. Exact temporary map points are deleted from live systems no later than 24 hours after the end; local playground-detection state is deleted within 24 hours and when you sign out, switch accounts, or turn detection off. Detection credentials expire after 30 days and can be revoked sooner. Uploaded media, when enabled, follows its stated five-day live-system deletion period. Restricted recovery copies use seven daily whole-disk slots and a seven-day logical database-dump window, so live-deleted data may remain until the relevant recovery copy rotates. A restore remains isolated until post-backup account deletions and blocks have been reconciled and current retention has run; retention alone is insufficient. Including database dumps inside disk backups, normal daily backup rotation can retain live-deleted data for up to 15 days. Invitations expire, account data remains until deletion or another legal basis ends, and redacted operational or security records remain only while needed to diagnose failures, prevent abuse, or meet a legal duty.
11. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing where the legal conditions apply. You may withdraw consent for the future and complain to a data-protection supervisory authority. The competent authority for Pixelbaum is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). Contact: hi@friendground.app.
12. Changes
We will update this notice before materially changing the public service, its providers, or the way personal data is used.