In short
Floeck does not need any personal details to show you a connection. Usage statistics are only collected with your consent. The website uses no cookies and no tracking.
Controller
Simon Lehmann, Rolandstraße 67, 50677 Köln, e-mail: lehmansn@gmail.com
The app
Account and favourites
On first start the app creates an anonymous account so that it may retrieve timetable data. If you want to save favourites, you sign in with Google or Apple. We then store your e-mail address, the sign-in provider, your favourites (stops and places such as home or work) and your settings.
The data is stored at Supabase in Frankfurt am Main. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). It is kept until you delete your account.
Sign-in with Google or Apple
When you sign in, Google's or Apple's sign-in window opens. These providers learn that you are signing in to Floeck and pass us your e-mail address and an identifier. With Apple you can hide your e-mail address. The legal basis is Art. 6(1)(b) GDPR.
Stop and connection search
When you search for a stop, address or connection, the app sends your input, start, destination and time to our server at Supabase. For connections and addresses the server queries the interface of the Verkehrsverbund Rhein-Sieg (VRS). VRS receives only the search request, not your IP address and no account data. Search requests are not stored, except in Supabase's technical logs for their short retention period. The legal basis is Art. 6(1)(b) GDPR.
Location
If you allow it, the app uses your location to show nearby stops, to sort search results by distance and to search connections from where you are. For this, the position is sent with the respective request to our server and, for connections, to VRS. It is not stored and not used for statistics. You can revoke the permission at any time in your device settings. The legal basis is Art. 6(1)(b) GDPR.
Map
The map of a connection shows Google Maps on Android and Apple Maps on iOS. Your device loads map data directly from Google or Apple; these providers receive your IP address and the map area shown. The legal basis is our legitimate interest in a working map (Art. 6(1)(f) GDPR).
Usage statistics (only with consent)
On first start the app asks whether it may send usage data. Only if you agree does it send to PostHog (servers in the EU) which screens you open and when the app starts, together with a random identifier of the installation. No name, e-mail address, location, search terms or chosen stops are transmitted. Your IP address is discarded before storage.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings under "Share usage data"; from then on nothing is sent.
Crash reports
If the app crashes or an error occurs, it sends a report to PostHog (servers in the EU). It contains the technical error message, the screens opened last, device model, operating system, app version and the random identifier of the installation, but no details about you, your location or your searches. The IP address is discarded. The legal basis is our legitimate interest in an app that works without errors (Art. 6(1)(f) GDPR).
On your device
Some settings stay on your device only, such as appearance, haptics and your answer about usage statistics. They are removed when you delete the app.
The website
This website is hosted at Vercel. When it is accessed, Vercel processes technically necessary data such as IP address, time, requested page and user agent in server logs in order to deliver the site and protect it against abuse (Art. 6(1)(f) GDPR). The website sets no cookies, uses no tracking and loads no content from other servers; the fonts are served from this domain.
Service providers
- Supabase Inc. (database and server, data in Frankfurt am Main)
- PostHog Inc. (usage statistics and crash reports, data in the EU)
- Vercel Inc. (hosting of the website)
- Google Ireland Ltd. (sign-in, map on Android)
- Apple Distribution International Ltd. (sign-in, map on iOS)
Where these providers process data on our behalf, data processing agreements are in place. Where data may reach the USA, the transfer is safeguarded by the EU-US Data Privacy Framework or by standard contractual clauses.
Retention and deletion
PostHog deletes usage statistics and crash reports after 12 months.
You can delete your account in the app under Settings → "Delete account". Your account, your favourites and your settings are then removed from the server immediately.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR) as well as the right to withdraw a consent at any time. Just send an e-mail to the address above.
You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Changes
If the app starts collecting new data or sending it to new recipients, this policy will be updated beforehand. The current version applies.