Privacy policy

The essentials

Parkonaut is a theme park tracker. Your routes, locations and motion data stay on your device, and we have no access to them.

Without an account we only process what is needed to deliver the website and the app and to prevent abuse. Visits, rides and ratings are stored only with an account.

We use no advertising, no analytics and no tracking. There is no cookie banner because we only set strictly necessary cookies. This policy applies to the website parkonaut.app and the Parkonaut apps for iOS and Android.

Controller

The controller under the General Data Protection Regulation (GDPR) is Tobias Klüver, Rethelstr. 34, 40237 Düsseldorf, Germany. Email: [email protected]. More details are in the imprint.

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). Send questions about data protection and your rights to [email protected].

Visiting the website and the app interface

When you open parkonaut.app or the app loads data from our server, we process the connection data: IP address, time, requested address, HTTP status, browser or app identifier (user agent) and, if sent, the previously visited page. The purposes are delivery, defending against attacks and troubleshooting. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

All connections are encrypted and run through the Cloudflare network, which blocks attacks and delivers content. OVH GmbH runs the website, interface and database for us in a data centre in the EU. Both are our processors (see Recipients).

Only the upstream server logs IP addresses, our application logs without them. To limit abuse, we count requests per IP address in memory only. We create encrypted backups of the database in the EU. Deleted data can remain there until the backup expires (see Retention).

Protection against automated access

When you create an account, send a report or make a suggestion, a Cloudflare Turnstile check may appear that tells humans from bots. It only loads once you fill in the form, in the app in an embedded window. Cloudflare receives your IP address and technical characteristics of your browser and device, our server only receives the result. Cloudflare is our processor for this and additionally uses the characteristics as an independent controller to improve its bot detection (Turnstile Privacy Addendum).

The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR). Access to your device is strictly necessary for this (§ 25(2) no. 2 TDDDG).

Cookies and local storage

We only set cookies that are strictly necessary for a feature you request (§ 25(2) no. 2 TDDDG):

• NEXT_LOCALE: your chosen language, until the end of the session
• pk_access (60 minutes), pk_refresh (90 days) and pk_refreshed (30 seconds): keep you signed in
• pk_google_state, pk_apple_state (10 minutes each) and pk_signin_pending (5 minutes): secure the sign-in process
• pk_return (30 minutes): the page you return to after signing in
• __cf_bm and cf_clearance: set by Cloudflare only when protection against automated access is active

All our cookies except NEXT_LOCALE are inaccessible to scripts and only sent over encrypted connections. We do not use local browser storage (localStorage).

Maps

The website's maps and the app's park and overview maps load their tiles directly from OpenFreeMap. On the pages and in the editors for reporting and checking positions and park boundaries, the tiles come from the OpenStreetMap Foundation instead. The providers receive your IP address and the requested map areas. The website and the app load the map fonts from our own server. The legal basis is our legitimate interest in showing maps without running our own map servers (Art. 6(1)(f) GDPR).

For “Near me”, the website only asks for your location after a click and with your browser's permission. Your browser calculates the distances itself, and your location is neither sent to us nor stored.

Sign-in and account

You can view parks and attractions without an account. For an account you sign in with Apple or Google. The provider confirms your identity to us, and we take over a provider identifier, your email address (with Apple a relay address if you wish) and, if provided, your first name, which you can change at any time. We do not store a last name: from Google we take only the first name, and from Apple as well, even though Apple transmits the full name on first sign-in. We discard the last name immediately. Apple and Google process data during sign-in as independent controllers. The website embeds no scripts from these providers, your browser is only redirected after your click.

Accounts are available from age 18. Beforehand you confirm your age, this privacy policy and the terms of use, and we store the times. With an account we store the following on our server so you have your data on all devices:

• Visits with park, day, start and end, and whether they were detected or added manually
• Rides with attraction and time
• Ratings (thumbs) with an optional comment
• Settings, for example automatic detection per park
• First name, email address, provider identifier, your preferred language (from the sign-in or chosen by you, we write emails to you in it) and the times of your confirmations, together with the version of the terms of use you agreed to each time

Visits and rides show when you were in which park. We use them only for you, not for advertising, and do not pass them on. The legal basis is the user agreement for your account (Art. 6(1)(b) GDPR).

Community score

If you share your thumbs, they count towards the public community score (number of thumbs up and down, the share only above a minimum number). Individual thumbs and comments are never public. You can stop sharing at any time in the settings.

Export and deletion

On the website you can export your data under Account as JSON or CSV. You delete your account in the app under Settings → Account or on the website under Account. We then delete all data of the account. Processed reports and accepted details remain in the catalogue without any link to you and without your free texts. We can also delete an account ourselves, for example after serious violations of the terms of use. If we know your e-mail address, we send you the reason by e-mail in the language of your account. We do not store the reason.

App installation ID

So that you can send reports without an account, the app creates a random installation ID with your first report or sign-in. With it we store the platform, the times of creation and last use, and your reports. It contains no device or advertising identifier. If you sign in, we link it to your account and delete it together with the account. The legal basis is the feature you requested (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG).

To prevent abuse, when the ID is created or renewed we store a hash of your IP address formed with a secret key, not the address itself (Art. 6(1)(f) GDPR).

Reports, suggestions and their review

You can report errors in the catalogue and suggest details about parks and attractions. We store the contribution with time, content and your account or installation ID. It only contains a coordinate if you explicitly provide a position. Moderators do not see who a contribution comes from. The legal basis is Art. 6(1)(b) GDPR, and for moderation our legitimate interest in a correct catalogue (point (f)).

Automatic screening

Before storing them, we automatically screen texts and links from contributions, first names and rating comments for insults, hate, violence, sexual content and dangerous links. Texts go to the OpenAI moderation interface (processing in the EU), links to Google Web Risk, each without account, ID or IP address. We do not store clearly flagged contributions, you get a notice and can change them. Slightly flagged ones are marked for moderation.

AI pre-assessment

A language model by Anthropic (Claude) may pre-assess open contributions for moderation. It receives the content of the contribution, but not your account, your ID or your IP address. A contribution is always accepted by a human. The model can reject obviously wrong or abusive contributions by itself.

The legal basis for both checks is our legitimate interest in protecting Parkonaut from unlawful content, malware and fraud and in relieving moderation (Art. 6(1)(f) GDPR). An automatic rejection only affects that one contribution. If you think it is wrong, write to [email protected] and a human will review it (Art. 22 GDPR).

Suspension of accounts

If someone violates our terms of use, we can suspend the account entirely or only for new contributions. A person from moderation always decides on this. For this we store on the account the type of suspension, the reason, the facts we rely on, start and end, who imposed or lifted the suspension, and any objection from you with its text and time.

We show you the reasons in the app and on the website. If we know your e-mail address, we also send them to you by e-mail. The legal basis is the contract of use (Art. 6 (1) (b) GDPR), our obligation to give reasons for suspensions (Art. 6 (1) (c) GDPR with Art. 17 DSA), and our legitimate interest in protecting Parkonaut and everyone who uses it from abuse (Art. 6 (1) (f) GDPR). If we lift a suspension, we write to you as well.

We keep this information until one year after the suspension has ended or been lifted, so that we can recognise repeated violations. If you delete your account, we delete it as well.

Emails from us

We only send messages that relate to your account to its email address, for example a welcome after you create the account or the reasons for a suspension. We do not send newsletters or advertising. The legal basis is the contract of use (Art. 6(1)(b) GDPR), and for suspensions additionally the grounds named in the section on suspension of accounts.

We use Mailtrap by Railsware Products Studio LLC, USA, as our processor for sending. Mailtrap receives your email address and the content of the message and stores both, together with the sending log, for no more than 30 days (privacy).

The app on your device

The app detects visits and rides using your location (permission “Allow all the time”), on Android also using “Physical activity”. It shows notices as local notifications without a push service. You withdraw permissions in the system settings and turn off detection in the app.

Location data, the detection log and visits without an account stay in a local database on your device and are excluded from device backups. Only after you sign in does the app send visits, rides and ratings to your account, never positions. It loads park data in coarse tiles around you (each about 100 km across) and as a list of all parks, without an identifier. It never sends your exact position. The requested tiles only reveal the rough area you are in.

We deliver minor app fixes without a store update through our update server. The app sends the platform, version and channel, and we store no IP address or identifier with it. Every release is signed by us (Art. 6(1)(f) GDPR). The app contains no advertising, analytics or crash reporting services. Apple and Google are themselves responsible for downloads and updates via the App Store and Google Play.

People in public sources

For the catalogue we evaluate public pages (such as Wikipedia, Wikidata, Coasterpedia and the parks' websites), partly with a language model by Anthropic. These pages may incidentally contain names and roles of people, for example designers. We only process them to verify details about attractions (Art. 6(1)(f) GDPR). As we cannot reach the people concerned individually, we inform them here (Art. 14 GDPR).

Recipients and third countries

Personal data is only received by these parties, and by authorities only where required by law:

• Cloudflare, Inc., USA: protection and delivery, protection against automated access (processor, privacy)
• OVH GmbH, Oskar-Jäger-Str. 173/K6, 50825 Köln: hosting and email in the EU (processor, privacy)
• Railsware Products Studio LLC, USA (Mailtrap): sending of emails (processor, privacy)
• OpenAI Ireland Ltd., Ireland: screening of texts, processing in the EU (processor, privacy)
• Google Cloud EMEA Ltd., Ireland: screening of links (processor, privacy)
• Anthropic Ireland, Limited, Ireland, processing by Anthropic, PBC in the USA: AI assessment of contributions and evaluation of public sources (processor, privacy)
• Hyperknot Software Kft., Hungary (OpenFreeMap) and OpenStreetMap Foundation, United Kingdom: map tiles (OpenFreeMap, OpenStreetMap)
• Apple (Ireland, USA): sign-in, App Store (independent controller, privacy)
• Google (Ireland, USA): sign-in, Google Play (independent controller, privacy)

For Cloudflare, Google and Mailtrap, transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR, list of certified companies), and for all recipients additionally on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). An adequacy decision exists for the United Kingdom.

Retention

• Server access log: 14 days
• Rate limit counters: in memory only
• Sessions: 60 minutes, sign-in expires after 90 days without use
• Account data: until you delete your account
• Installation ID: 24 months after the last report or sign-in, with an account until it is deleted
• IP hash of the installation ID: 30 days
• Reports and suggestions: as long as moderation and the catalogue need them, without any link to you after account deletion. Categories detected by automatic screening until the moderation decision, rejected texts and links not at all
• account suspensions: one year after they have ended or been lifted, immediately if the account is deleted
• Backups: 14 days (daily) and 8 weeks (weekly)
• On your device: detection log 14 days, visits without an account until you sign in or uninstall
• Emails from us at the sending service Mailtrap: no more than 30 days
• Emails to us: until the request is settled, unless we are required to keep them

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Objection: You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR) (Art. 21 GDPR).

You change your first name, stop sharing thumbs, export and delete yourself in the app and on the website. For everything else write to [email protected]. You are not obliged to provide data to us. Without an account or location permission, only some features are unavailable.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (complaint form).

Changes

We update this policy when Parkonaut or the law changes. The date at the top shows the current version. Only the German version is legally binding.