Privacy policy

Controller

Bastian Brüggemann, Schildstr. 20, 59909 Bestwig, Germany. Email: info@mycircuits.org

There is no data protection officer, because the legal conditions requiring one are not met here.

Without an account, everything stays on your device

myCircuits can be used entirely without an account. Your visited circuits, your wishlist and your language setting then live only in the app's storage on your device. Nothing is transmitted anywhere, and we do not see it.

If you delete the app, this data is gone. The backup file you create and store yourself in the settings protects you against that.

With an account

If you create an account, we process your email address in order to send you the sign-in email with link and code and to recognise you again. Added to that is the data you enter yourself: visited circuits with date and racing series, your wishlist, display name and home country.

The purpose is syncing between several devices. The legal basis is performance of the contract of use under Article 6 (1) (b) GDPR.

Storage is with Supabase Inc., 970 Toa Payoh North, Singapore. The database runs in their data centre in Frankfurt am Main, Germany. A data processing agreement under Article 28 GDPR is in place. Access from third countries by the provider's staff cannot be fully ruled out technically; Supabase relies on the European Commission's standard contractual clauses for this.

If you delete your account in the settings, the account, visits, wishlist and profile are deleted immediately and without any retention period. Whatever is stored on your device is not affected.

Sending the sign-in emails

The sign-in email with link and code is not sent by the app itself but by a service set up for that purpose. It receives your email address and the text of the message, nothing more.

This is Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Ireland is set as the processing region, so the messages run through European machines. For delivery itself, Resend uses Amazon Web Services.

The legal basis is performance of the contract of use under Article 6 (1) (b) GDPR; without this message you cannot reach your account. A data processing agreement under Article 28 GDPR is in place. For the transfer to the United States, Resend relies on the European Commission's standard contractual clauses.

Without an account, no such message is sent.

Profile picture

You can upload a photo of your own as a profile picture. Before sending it, the app scales it down to at most 512 pixels along its edge and crops it to the square you choose. Only this newly computed image is uploaded; the extra data in the original file, such as the place it was taken and the camera model, is lost in the process and is not transmitted.

The picture does not become visible straight away. It first waits in a queue until we have looked at it and approved it. Until then only you can see it; for everyone else your profile keeps showing the flag of your home country or a neutral outline. If we reject a picture, you are told in the app along with the reason, and you can withdraw it or upload a different one.

The picture is stored with Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, in their R2 storage service with the European Union region. In Germany, Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich, can be contacted. A processor agreement under Article 28 GDPR is in place; for the transfer to the United States, Cloudflare relies on the European Commission's standard contractual clauses.

The legal basis for the picture itself is performance of the user agreement under Article 6(1)(b) GDPR. The prior review rests on our legitimate interest in a service free of unlawful content under Article 6(1)(f) GDPR.

To pick a picture, the app asks once for access to your photo library or camera. You may decline; the flag or outline then stays. Without a picture, only the country code is stored, for example DE. If you delete your picture or your account, the file is removed from storage immediately.

Reporting and blocking

If you report a profile, we store who reported, who was reported, the reason and the time. Without these details a report could not be handled. The legal basis is our legitimate interest in a service free of unlawful content under Article 6 (1) (f) GDPR, together with the duty to review reported content promptly.

If you block someone, we only store whom you blocked. The person concerned is not told about it.

Handled reports are deleted after six months.

Maps

The world map loads its tiles only when displayed, not in advance. In doing so, the provider learns your IP address and which part of the map you are looking at. Without this transmission no map could be shown; the legal basis is our legitimate interest in a working map view under Article 6 (1) (f) GDPR.

The map imagery comes from Esri Inc., 380 New York Street, Redlands, California, USA. There is no choice between several providers.

If you do not want this, do not open the map view. All other parts of the app work without it.

Circuit outlines

The drawn circuit outlines come from OpenStreetMap but ship with the app. Nothing is loaded and nothing is transmitted when they are displayed.

What we do not do

There is no audience measurement, no analytics, no advertising and no sharing with third parties for advertising purposes. There is no consent banner, because there is nothing to consent to.

The fonts ship with the app and are not loaded from an external server. No IP address goes to Google when the app starts.

App stores

If you download the app from the App Store or Google Play, Apple or Google respectively process data over which we have no influence. The privacy notices of the respective provider apply to that.

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. Please contact the address given above.

You can also complain to a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Authoritative version

The German version of this text is the authoritative one. This translation is provided for convenience only.