Privacy Policy

1. Who is responsible

The controller for data processing in the KloKompass app and on this website is:

Markus Gola
Greifenklaustraße 3
54296 Trier
Deutschland
E-mail: golamarkus@googlemail.com

For any privacy question, and to request access or deletion, simply write to that address.

2. The short version

No account, no sign-in. The app works fully without registration.
No tracking, no ads. There are no analytics, advertising or social media components. Your advertising identifier (IDFA) is never read.
Your location stays on your device. It is not transmitted to us and not stored by us.
No cookie banner, because we set no advertising or analytics cookies.
Only when you contribute – adding a toilet, writing a review, uploading a photo, reporting a problem – is anything stored on our side.

3. Location data

If you allow it, the app uses your location to centre the map on your surroundings, sort toilets by distance, calculate a route and guide you during navigation.

Your precise location never leaves your iPhone towards our server. We neither store nor analyse it. You can change or withdraw the permission at any time under Settings → Privacy & Security → Location Services → KloKompass. Without location access the app still works; you then move the map yourself.

Two exceptions where location information does travel – both described in sections 4 and 5:

To load toilets, the app queries the map area you are currently looking at (a rectangle of four coordinates). That is the visible region, not your position within it.
When you add a toilet yourself, your location at that moment is sent along so we can check whether you were actually there.

Legal basis: your consent via the iOS prompt and Art. 6(1)(b) GDPR (providing the function you requested).

4. Loading toilets (map queries)

To fill the map, the app calls our server klokompass.com. This processes:

the corner coordinates of the visible map area,
your IP address (technically unavoidable for any internet connection),
the date and time of the request.

These queries are not linked to any device or person. No device identifier is sent with them.

If our server is unavailable, or an area is not yet mirrored there, the app falls back to the public OpenStreetMap Overpass server overpass-api.de, run by volunteers in Germany. The same map area and your IP address then reach that server, under its own privacy policy. No transfer outside the EU takes place.

Offline data: Under Offline data the app suggests the areas whose toilets you have already loaded. The list of these areas stays on your iPhone. To name an area as a town, the app sends our server the same map area it already loaded the toilets for there (as in section 4). When you download an area, the app fetches its toilets; when you open the app, it asks whether anything has changed in the regions you downloaded and then reloads them. This processes the names of the regions, that map area, your IP address, and the date and time. To limit bulk use we count downloads and requests per IP address for one hour – in hashed form only (see section 6). These requests are not linked to any device or person either.

Legal basis: Art. 6(1)(b) GDPR.

5. Your contributions: toilets, reviews, photos, reports

Contributing is voluntary. Nothing is stored permanently until you tap “Send”.

5.1 The device identifier

On your first contribution the app creates a random identifier (a UUID such as 3f2a…-…-…) and stores it in your iPhone’s keychain. It contains nothing about you or your device and is not an Apple identifier (neither IDFA nor IDFV). We need it to

show you your own submissions under “My contributions”,
enforce rate limits (how many contributions per hour and day),
block a device from contributing after repeated abuse.

You can find and copy your identifier in the app under About KloKompass → Legal → Device identifier. It is the key to access and deletion requests (section 11).

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in an abuse-free, reliable map. We see no equally effective, less intrusive way to keep out spam and false entries. Storing the identifier on your device is strictly necessary for the service you requested (Section 25(2)(2) TDDDG, the German implementation of the ePrivacy Directive).

5.2 What exactly is stored

Contribution	Data stored
New toilet	Position of the toilet, name, type, price, facilities, accessibility, access, opening hours, your note, device identifier, timestamp – plus your location at the time of submission, its accuracy and the distance to the toilet you entered, so we can spot entries made from the sofa.
Review	Star ratings for cleanliness, accessibility and facilities, recommendation, reported price, your comment, reference to the toilet reviewed, device identifier, timestamp.
Photo	The image itself, its dimensions, reference to the toilet or review, device identifier, timestamp.
Report	Type of problem, your comment, reference to the reported item, device identifier, timestamp.

Please do not put personal data into comments and notes – neither your own nor anyone else’s. Approved contributions are visible to all users. No name is ever shown; contributions appear without attribution.

5.3 Photos

Photos are downscaled on your iPhone and re-encoded on our server. All embedded metadata is removed in the process – in particular GPS coordinates, capture time, camera and device model. Only the visible image remains.

Please make sure yourself that no people, licence plates or documents are recognisable. Photos showing identifiable people are not approved.

5.4 Review before publication

Every contribution is checked before it appears in the app – first automatically by our server. It looks for links, email addresses and phone numbers, offensive words and meaningless strings of characters; for new toilets it also checks the distance between your location and the toilet and whether the toilet is already on the map. It also looks at whether contributions from your device identifier have been approved or rejected before.

If nothing stands out and something from your device has been approved before, reviews and new toilets appear immediately. Everything else – your first contribution, anything conspicuous and every photo – we look at by hand. Nothing is ever rejected automatically: whatever the automatic check does not approve is decided by a person, and we can remove automatically approved contributions at any time. The legal basis is Art. 6(1)(f) GDPR (publishing contributions quickly and protecting the map from abuse).

Unapproved contributions and photos are not retrievable by anyone else. We keep an internal moderation log (which decision, when, with what reason, by hand or automatically) so that complaints can be traced.

6. Abuse prevention

IP addresses in hashed form only. Your IP address is converted with a secret key (HMAC-SHA-256) into an irreversible string and only stored that way – it never reaches our database in the clear. This lets us count requests per hour without knowing who is behind them.
Counters per device identifier (contributions per hour and day).
Block list: after repeated abuse we mark a device identifier as blocked.

Independently, our host keeps technical server logs (access and error logs) with IP address, timestamp, requested address and status code, for secure operation and to fend off attacks.

Legal basis in each case: Art. 6(1)(f) GDPR.

Map rendering, address search, route calculation, travel times and traffic come from Apple Maps (MapKit), built into the operating system. Apple receives the data needed for display and calculation – such as the map area and the start and end of a route – and processes it under its own responsibility. According to Apple, random identifiers are used that are not linked to your Apple Account.

See the Apple Privacy Policy and the Apple Maps notice.

Spoken directions are generated by your iPhone itself. Nothing is recorded and nothing is transmitted; the app does not access the microphone.

8. Handing over to Apple Maps or Google Maps

In a toilet’s detail view you can hand navigation over to another app. This only happens when you explicitly tap that button. The destination coordinates and, if available, your starting point are then passed on.

Apple Maps: see section 7.
Google Maps: the Google Privacy Policy applies; Google Ireland Limited is then the controller. Google may associate the request with your Google Account if you are signed in. We have no influence over this. If you would rather avoid it, use navigation inside KloKompass or Apple Maps.

Legal basis: Art. 6(1)(a) GDPR – your tap is the consent.

9. Data stored on your device

The app keeps on your iPhone: recently loaded toilets (so the map starts faster and works offline), the toilets of the regions you download under Offline data, the list of areas whose toilets you have loaded (for the suggestions there), resolved addresses, your filter settings, your acknowledgement of the navigation notice, and the device identifier in the keychain. During navigation iOS shows the next turns as a Live Activity on the lock screen, in the Dynamic Island and on the CarPlay Dashboard; when you use KloKompass in CarPlay, the car displays what the app computes on your iPhone. All of this stays local. Delete the app and it is gone, device identifier included. Later contributions run under a new identifier; already published contributions remain (for deletion see section 11).

10. Retention

Data	How long
Approved toilets, reviews, photos	As long as they are part of the map – or until deleted at your request or by us
Rejected contributions and photos	Up to 12 months, to recognise repeated abuse; deleted afterwards
Reports	Up to 12 months after processing
Hashed IP counters	A few hours (sliding windows)
Device record (first/last seen, block flag)	As long as contributions from that device exist or a block is in place
Moderation log	Up to 24 months
Host’s server logs	Per the host’s policy, typically days to weeks

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). You may withdraw any consent at any time with effect for the future.

How this works in practice: since we keep no accounts, your device identifier is the only way we can find your data. Copy it in the app under About KloKompass → Legal → Device identifier and send it to golamarkus@googlemail.com. We reply within one month. You can view your own contributions at any time under “My contributions”.

One honest caveat: anyone who knows your device identifier could request information about the contributions linked to it. So only share it when you are actually making a request to us.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

12. Recipients and processors

We do not sell data and do not share it for advertising. Access is limited to:

ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany – operates our server in Germany, bound as a processor under Art. 28 GDPR.
Apple Inc. / Apple Distribution International Ltd. – for maps and routes and for distribution via the App Store (as an independent controller, see section 7).
OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom – website only: our server fetches map images there and looks up the places you type in. What is sent are tile numbers or the search term, not your IP address (see section 13). The UK is covered by an EU adequacy decision.
Authorities, where we are legally obliged to provide information.

We do not transfer data to countries outside the EU/EEA. Processing in the United States may occur at Apple and – if you trigger it – Google; those companies rely on the EU-US Data Privacy Framework or standard contractual clauses.

13. This website

When you visit these pages, our host processes the usual access data (IP address, timestamp, page requested, data volume, browser and operating system) in server logs, on the basis of Art. 6(1)(f) GDPR. No cookies are set, no fonts or scripts are loaded from third-party servers, and no analytics take place. The admin area at /admin is for us only and uses a strictly necessary session token for sign-in.

The map

The map at /map loads a script from this server. The map images come from OpenStreetMap, but they are fetched by our server and cached there for up to 30 days. Your browser therefore only ever connects to this website – OpenStreetMap learns neither your IP address nor which area you are looking at. The website does not ask for your location; you type the place in yourself.

Place search

When you enter a place, our server queries Nominatim, the OpenStreetMap search service, with it. Only the search term is sent, not your IP address. We cache the answer for up to 30 days so that the same search reaches them only once. The legal basis is Art. 6(1)(f) GDPR (running the map search).

Adding a toilet through the website

When you send the form at /add, we store what you entered – location, type, price, facilities, opening hours and notes – together with the time and the review status. Added to that is an identifier calculated from your IP address; the address itself is not stored. It limits abuse and lets us find your entry again if you ask – after sending, it is shown on the confirmation page. The legal basis is Art. 6(1)(f) GDPR (a reliable, maintained set of map data and protection against abuse). Section 5 applies to the content itself: every entry is checked by hand before publication, and once published it is covered by the same free licence as the rest of the map data.

14. Children and young people

The app is aimed at adults and young people aged 16 and over. Please only submit contributions if you are 16 or older, or with your parents’ consent.

15. Changes

When the app changes, so does this policy. The version published here is the one that applies. We point out significant changes in the app.

16. Map data

The toilets shown come mostly from OpenStreetMap (© OpenStreetMap contributors, ODbL). We keep our own copy so the app responds quickly and the volunteer-run OpenStreetMap servers are spared. Retrieving that copy transmits no personal data to OpenStreetMap.