Privacy.

Controller

This notice covers wobinich.lol, its location API and the Android app “Wo bin ich?” (de.shroomlife.wobinich). The controller is:

Website & hosting

The website and API run on a server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. IP addresses and connection information are processed to deliver and secure the service. The basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable, secure service. Hetzner privacy notice.

This website uses no cookies, analytics, advertising trackers or external fonts. Icons, flags, images and scripts are served locally. It does not request your location; the Germany map shows public states, not visitor locations. The language is selected through the page address. Motion settings last only for the current page visit.

Location in the app

Only pressing “Where am I?” requests a location through the operating system. System settings let you choose whether to allow access and with what precision. The app processes coordinates and reported accuracy. It has no location history, analytics SDKs, account or background location tracking.

Berlin districts and localities are resolved on your device using bundled official boundaries. The app then automatically requests online enrichment for streets and other place names: coordinates and your selected language are sent over HTTPS to wobinich.lol. The API rounds coordinates to five decimal places before querying the active address service (section 04). Your name, advertising IDs and device identifiers are not sent. The reported location accuracy in metres is sent, so the API can flag a locality it resolved itself as lying close to its boundary. Article 6(1)(b) GDPR is the basis for providing the location lookup you request.

Location permission is necessary for a fix. Without internet, coordinates and Berlin boundary matching remain available after a fix, but additional addresses do not. There is currently no separate offline-only switch. You can cancel a search and revoke permission in system settings. Cancellation cannot undo a request already transmitted. Depending on your system settings, operating-system location services may use their own providers, whose processing is described by the operating-system provider.

Address services

For streets and place names our API uses two providers in a fixed order: the Google Maps Platform Geocoding API first, and the OpenStreetMap Foundation’s public Nominatim service as a fallback. In both cases the request originates from our server: we do not forward your device IP. The provider receives the rounded coordinates, your selected language and our server’s IP address. Our service reports which provider is currently active at /healthz.

Google. Google processes these requests as an independent controller, not as our processor. Because our billing account is in the EEA, the Google Maps Platform EEA Terms of Service apply. Google may process the data outside the EEA, including in the United States. The safeguard under Article 46(2)(c) GDPR is the EU Standard Contractual Clauses, which Google has incorporated into its Controller-Controller Data Protection Terms for Google Maps Platform. Neither the app nor this website displays a Google map or loads Google scripts, cookies or fonts. See the Google Privacy Policy for further information.

Nominatim. OSMF keeps its own service logs. Its policy identifies the UK and the Netherlands as storage locations for such data. Our cache lifetime does not apply there; the policy gives no specific deletion period for Nominatim requests. UK transfers are covered by an EU adequacy decision under Article 45 GDPR. See the OSMF privacy policy for details and contact information.

Storage & server logs

The app holds location results only in memory. Your app language is stored locally until changed or app data is cleared. Our API caches rounded coordinates, language and address responses in shared memory for 15 minutes plus at most 30 seconds for cleanup. The cache is limited to 2,048 entries, is not linked to accounts or device identifiers, and is erased on restart.

The Nginx Proxy Manager in front of the API keeps access logs containing IP address, time, HTTP method, hostname, requested path including any URL parameters, status, response size, user agent and, where supplied, referring page. Error logs support troubleshooting. The purposes are operation, troubleshooting and abuse prevention under Article 6(1)(f) GDPR. App coordinates are sent in the POST body, which is not included in the configured access log. The API itself disables access logging.

Proxy logs are configured for weekly rotation, retaining four access-log archives and ten error-log archives alongside the current files. With regular rotation this is approximately five and eleven weeks respectively. Empty files are not rotated, so older archives can remain longer. This configuration therefore does not guarantee deletion after a fixed number of calendar days.

Contact & external links

If you email us, we process your sender information and message to handle your enquiry: Article 6(1)(b) GDPR for service-related matters, otherwise Article 6(1)(f), our interest in responding to enquiries. Messages are retained for the necessary handling and documentation period, then deleted unless statutory retention duties apply.

Downloads are provided through Google Play. Opening the link sends connection information to Google, whose privacy policy applies there.

Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation (Article 21 GDPR). Any consent may be withdrawn for the future. There are no automated decisions with legal effects or profiling.

Contact robin@shroomlife.de. You may also complain to a supervisory authority, such as LfDI Baden-Württemberg. These rights arise under the GDPR.

Optional: “Tell me something” & story history

After your agreement, the app sends current coordinates, accuracy, language, all resolved place levels and their provenance through our API to OpenAI. GPT-6 researches local history and unusual details. Search providers may receive location-related queries. Research instructions exclude exact coordinates and house numbers from search queries. Location resolution works without this optional feature. The legal basis for AI research and associated history is your consent under Article 6(1)(a) GDPR. The app stores the consent version locally; “My stories” lets you reset it for future research.

Saved stories. Titles, place names, text, sources, language, provider and creation date are saved on the device and in our server database. We do not persist the original request with coordinates and accuracy or the complete AI prompt. A randomly generated secret installation key grants access to that installation’s server history. The server stores only its SHA-256 hash. No IMEI, advertising ID or hardware identifier is used. The installation secret is not sent to OpenAI or search providers.

Android encrypts the local archive with an Android Keystore key in private app storage excluded from backup. The iOS foundation uses private, backup-excluded storage with iOS Data Protection. Up to 100 stories remain locally until deletion or uninstall; new entries replace the oldest. The server keeps up to 100 stories per installation for 90 days plus at most 30 seconds of cleanup time. In history, you can delete individual or all stories from the device and server; an internet connection is required. Existing local copies remain readable offline after server retention expires. Uninstalling or clearing app data loses the installation secret, so server copies cannot be recovered without it and expire under the server retention policy. For abuse and cost control, we store the installation hash and request timestamps for up to 24 hours plus 30 seconds (Article 6(1)(f) GDPR).

OpenAI. We use store: false; this does not eliminate OpenAI security logs. Content may remain there for up to 30 days by default, or longer for legal or safety reasons. API content is not used for model training by default. EEA-only processing is not configured. Details of service-provider processing, international transfers and contractual safeguards are in the OpenAI Data Processing Addendum and API data documentation. Cancelling stops waiting but cannot recall sent data; completed research may still appear in server history. Opening a source sends connection information to its operator. AI answers can be wrong; sources allow verification.

Optional: contribute to the public place atlas

In addition to private AI research, you can explicitly opt into “automatically contribute to the place atlas” in the app (consent under Article 6(1)(a) GDPR). Location lookup and private research work without this additional choice. The app remembers it locally with version 2026-09-13-atlas-v1. You can turn it off before any research or reset AI consent to stop future contributions. Existing private stories are never published retrospectively.

After successful new research, an unambiguously identified German city or municipality can become a suggested topic. Names are matched against an independent GeoNames place catalogue. Ambiguous matches and uncertain boundaries are skipped. The separate topic list stores only a public catalogue place ID, a future weekly batch and processing status. It contains no coordinates, accuracy, street address, visit time, IP address, device identifier, installation hash, private story ID or private text, and no relationship to your history.

After at least seven days, OpenAI independently researches a shared German article. It receives only the catalogue city, state, country and language; the provider information in the AI section applies. An additional automated quality review receives the draft article and its sources, but no private user data. Publication requires approval by that review. Repeated discoveries of the same place do not produce additional public entries. Public pages contain the place, state, article and sources. There are no author profiles, visitor pins, visit counters, discovery times or story images.

The shared article remains public until corrected or removed, including for search engines; the private 90-day retention does not apply. Deleting private history does not remove this independent article. A detached topic can no longer be linked to or withdrawn through your installation. For correction or removal, send the public page link to robin@shroomlife.de. We can suppress the article, preventing automatic republication. Third parties and search engines may retain copies.

Separation and delay reduce inferences about individual discoveries. They do not guarantee complete anonymity: additional knowledge can still enable inferences. Private history and infrastructure/provider logs remain subject to the rules above. The website map loads self-hosted state boundaries only, without contacting a map provider or requesting browser location.