Last updated: July 2026
1. Data Controller
The controller responsible for data processing in the „donde" app is:
Philipp Eichhorn
Email: helpdonde@web.de
2. Overview
We only process personal data to the extent necessary to operate the app. Below we explain which data we process, for what purpose, and on what legal basis (Art. 6 GDPR).
3. Data We Process
a) User account
When you register, we process your username, email address, and login credentials. Purpose: providing the account. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
b) Content (reviews, photos, places)
Reviews, photos, and place information you create are stored and — depending on your visibility settings — shown to other users. Legal basis: Art. 6(1)(b) GDPR.
c) Location data
With your consent, we process your device location to show nearby places on the map. Legal basis: Art. 6(1)(a) GDPR (consent). You can revoke access at any time in your device settings.
d) Camera and photos
To create review photos, we need access to your camera or photo library. Only the images you select are processed. Legal basis: Art. 6(1)(a) GDPR.
e) Contacts
To find friends by username, you can grant us access to your contacts. This data is used only for matching and is not stored permanently beyond what is necessary. Legal basis: Art. 6(1)(a) GDPR.
f) Push notifications
With your consent, we send push notifications via OneSignal. This involves processing a device token. Legal basis: Art. 6(1)(a) GDPR.
g) Usage and analytics data
To improve the app, we use Firebase Analytics (Google). This may process usage events and a pseudonymous identifier. Legal basis: Art. 6(1)(a) GDPR.
4. Recipients / Processors
We use the following service providers, with whom data processing agreements (Art. 28 GDPR) are in place:
- Supabase – hosting, database, authentication
- OneSignal – push notifications
- Mapbox – map rendering (your IP address is transmitted to Mapbox)
Some services may involve a transfer to third countries (e.g. the USA). Such transfers are based on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR).
5. Retention Period
We store personal data only as long as necessary for the stated purposes. Account data is deleted after you delete your account, unless statutory retention obligations apply.
6. Your Rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You can withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
To exercise your rights or to delete your account, simply send a message to: [your-contact@email.com]