Privacy Policy
This policy describes what GPSLarp collects, why, on what legal basis, who else sees it, how long it is kept, and what you can require us to do about it. It describes the system as it is actually built, including the places where what we can do falls short of what you might expect — those are marked rather than smoothed over.
A German-language version is available at Datenschutzerklärung. Both versions describe the same processing.
01Who is responsible
The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:
- Controller
- Nepomuk Crhonek, sole proprietor, trading as GPSLarp
- Address
- Bolleystrasse 9
8006 Zürich
Switzerland - Contact, including privacy requests
- privacy@gpslarp.com
We have not appointed a Data Protection Officer. GPSLarp does not carry out large-scale systematic monitoring and does not process special categories of data as a core activity, so the conditions in Art. 37(1) GDPR are not met. Privacy requests go to the address above and are handled by the controller directly.
Two laws apply at once
The controller is established in Switzerland, and users are in Switzerland and in the European Union. Both regimes therefore apply:
- The Swiss Federal Act on Data Protection (revFADP/revDSG) applies directly, because the controller is established in Switzerland.
- The GDPR applies in addition under Art. 3(2)(a) GDPR, because the product is deliberately offered to users in the European Union.
This policy is written to the GDPR throughout, because it is the stricter of the two on nearly every point. Where Swiss law grants you an equivalent right under another name, it is not narrowed by anything here. Which authority hears a complaint depends on where you are — see section 11.
No EU representative has been appointed
Art. 27(1) GDPR requires a controller outside the Union that offers goods or services to people in the Union to designate a representative established in the Union, unless the exemption in Art. 27(2) applies — processing that is occasional, involves no large-scale special-category data, and is unlikely to result in a risk to rights and freedoms.
No such representative has been designated. Whether the Art. 27(2) exemption covers this service has not been formally determined. We state this plainly rather than leaving the section out, which is the usual way this gap is presented. Requests from data subjects in the Union are handled directly by the controller at the address above, and none of your rights depend on a representative existing.
02What we collect, and why
GPSLarp is a desktop application that changes the GPS position your paired iPhone reports. Most of what it does happens on your own computer. The list below is exhaustive for data that reaches our servers.
Account
Sign-in is required to use the product. Authentication is operated by Clerk (see section 6), which holds your email address and credentials. Our own database does not store your email address. Against your account identifier we store only the date we first saw the account.
Subscription and entitlement
If you subscribe, we store which tier you are on, where the entitlement came from, your Stripe customer and subscription identifiers, and the date your current period ends. We never see or store your card number. Payment details are entered on Stripe's own hosted checkout page and never pass through our systems.
Free-tier counters and device identifier
The free allowance is enforced per account and per device. To make the per-device half work, the app computes a salted SHA-256 hash of device characteristics and sends only that hash. The API rejects anything that is not a 64-character hexadecimal digest, so a raw hardware serial cannot be stored even by accident. We cannot reverse the hash to identify your hardware; we can only tell that two requests came from the same device.
Saved locations
Locations you deliberately save are stored against your account so they are available on your other installations: a name, a latitude and longitude, and a sort position. These are stored at full precision, because rounding a location you saved on purpose would break the feature. They are coordinates you chose, not places you have been.
Product analytics
Analytics is opt-in only and off until you turn it on (see section 4). When enabled, an event carries: an event identifier, the event name, your account identifier, an installation identifier, the app version, the platform and CPU architecture, and a timestamp.
No IP address is stored with analytics events. This is structural rather than a policy promise: the event record has no field for one, and the function that builds it is not given access to request headers, so an IP address could only be added by a visible change to the code.
Location analytics
Coordinates are a separate, additional opt-in and default to off. Refusing costs you no functionality. If you do enable it, the coordinates attached to an event are rounded to four decimal places — roughly 11 metres — at the moment they are received. The precise value your device computed is never written down, so it cannot later be leaked.
The server strips coordinates from any event that arrives without consent, even if the sender included them.
Session replay
Session replay records what a visitor does on the website — pointer movement, clicks, scrolling. It is opt-in only, as a separate choice from analytics, and the recorder is not even downloaded unless you have opted in. All form inputs and typed text are masked before anything leaves your browser, and the server re-checks your recorded consent and discards anything it cannot match to one.
Consent records
When you make a choice about tracking we store the choice itself, the version of this policy it was made against, and when it was made — we are required to be able to demonstrate consent. As evidence we also keep your browser's user agent and your IP address truncated to /24 (IPv4) or /48 (IPv6), never the full address.
What is actually running today
This policy describes the system as designed and built. As of the effective date above, the consent, session-replay and data-export endpoints return "not implemented" and the desktop application does not transmit any analytics events at all. Nothing described in this section is being collected through those paths yet. This paragraph will be removed when it stops being true; we would rather over-disclose than describe collection that is switched on later without notice.
03Legal basis for each purpose
| Purpose | Data | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Providing the application; authenticating you | Account identifier, first-seen date | (b) performance of a contract |
| Syncing saved locations | Location name and coordinates | (b) performance of a contract |
| Billing, subscription management, refunds | Entitlement, Stripe identifiers | (b) performance of a contract |
| Statutory retention of business records | Invoices and payment records | (c) legal obligation |
| Enforcing the free allowance; preventing abuse | Hashed device identifier, usage counters | (f) legitimate interests — see below |
| Product analytics | Event, version, platform, install id | (a) consent |
| Location analytics | Rounded coordinates, place name | (a) consent, separately given |
| Session replay | Masked interaction recording | (a) consent, separately given |
| Demonstrating that consent was given | Consent record, truncated IP, user agent | (c) legal obligation, Art. 7(1) |
The legitimate-interests balancing test
Our interest is in not giving away an unlimited quantity of a paid product to a single person creating accounts in a loop. The measure chosen is the least intrusive one we could make work: a salted one-way hash, computed on your own machine, that we cannot reverse into a hardware identifier and cannot use to recognise you anywhere else. It is used for counting and nothing else — never for advertising, profiling, or building a picture of you across services. You can object to this processing under Art. 21 GDPR, though we may then be unable to offer the free allowance on that device.
04Consent, and how to withdraw it
Analytics and session replay are two independent choices. Both default to off. Nothing is pre-ticked, because a pre-ticked box is not consent.
Refusing is exactly as easy as accepting — the same prominence and the same number of clicks. Declining costs you no feature and no performance: the session recorder is never downloaded to a browser that has not opted in.
You may withdraw consent at any time, and withdrawing is as easy as giving it (Art. 7(3) GDPR). Withdrawal takes effect for the future; it does not make processing that already happened unlawful, and see section 9 for what withdrawal does and does not delete.
Consent is versioned. If we change what we collect or why, the version increases and consent given against the old text no longer authorises anything — you will be asked again rather than silently carried over.
05Services your app contacts directly
Some features work by contacting third-party services directly from your computer. Those requests do not pass through our servers, so we never see them — but your IP address and the content of the request reach the operator concerned, and you should know that before you use the feature.
| Feature | Service contacted | What it receives |
|---|---|---|
| Searching for a place by name; naming a pin you drop | Nominatim, operated by the OpenStreetMap Foundation | The text you typed, or the coordinates you clicked, plus your IP address |
| The map itself | CARTO basemap tiles (map data © OpenStreetMap contributors) | Which map tiles you are viewing — that is, roughly which part of the world you are looking at — plus your IP address |
| Building a driving route between two points | The public OSRM demonstration routing server | The start and end coordinates of the route you are planning |
Read this one twice
The map and routing requests above are the most revealing thing this application does over the network, and they are the part we have the least control over. Panning the map to the place you intend to appear to be tells the tile provider which part of the world interests you, and planning a route sends its two endpoints to a public demonstration server operated by the OSRM project — which is not run by us, and offers no availability or privacy commitment to us or to you. None of this is joined to your account by us, and none of it reaches our analytics. We are telling you because you cannot see it from the interface.
06Recipients and sub-processors
We do not sell personal data and we do not share it for advertising. The following processors act on our behalf under Art. 28 GDPR data processing agreements:
| Processor | Role | Processing location |
|---|---|---|
| Amazon Web Services | Hosting: application servers, database, file storage, content delivery, the analytics warehouse | us-east-1 (Northern Virginia, USA) |
| Clerk | Authentication and account management; holds your email address and credentials | USA |
| Stripe | Payment processing, subscription billing, the billing portal | EU and USA |
Stripe is not only our processor. For fraud prevention, regulatory compliance and its own anti-money-laundering obligations, Stripe acts as an independent controller of payment data. That processing is governed by Stripe's own privacy policy, and we cannot instruct Stripe to stop it or delete data it holds for those purposes.
If you sign in with Apple, Google or GitHub
You can create your account with an email address, or by signing in with Apple, Google or GitHub. Those three are deliberately not in the table above: they are not our processors. We do not instruct them and they do not act on our behalf. Each is an independent controller for the sign-in service it runs, under its own privacy policy.
Choosing one of them means:
- That provider learns that you are signing in to GPSLarp, and when.
- It returns to Clerk the identifiers you approve — normally your email address and the account identifier that provider issues. Apple offers to hide your real address behind a relay address; if you use that, we only ever see the relay.
- We never receive your password for that account, and we cannot read anything else in it.
The legal basis is Art. 6(1)(b) GDPR — performing the contract you asked for, namely signing you in the way you chose. It is a choice: signing up with an email address instead involves none of these three companies. All three are US companies, so section 07 applies to them as well.
We may also disclose data where we are legally required to — a binding court order or a lawful request from a competent authority.
07International transfers
Your data is stored in the United States, not in the EU or
Switzerland. Our entire infrastructure runs in the AWS
us-east-1 region in Northern Virginia. Clerk and Stripe also process
data in the United States, as do Apple, Google and GitHub if you choose one of
them to sign in with.
The United States is a third country for the purposes of Chapter V GDPR. Transfers are made on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the European Commission's Standard Contractual Clauses together with the supplementary technical measures described in section 12. For transfers from Switzerland, the Swiss–US Data Privacy Framework and the Swiss addendum to the Standard Contractual Clauses apply correspondingly.
You can request a copy of the relevant transfer safeguards from privacy@gpslarp.com.
08How long we keep things
| Data | Retention | How it ends |
|---|---|---|
| Account record, saved locations, entitlement, usage counters, consent record | Until you delete your account | Deleted on request, immediately |
| Analytics events, including any rounded coordinates | 90 days | Automatic expiry rule on the storage bucket. Not deleted on request — see section 9 |
| Session replay recordings | 30 days | Database time-to-live; the record deletes itself with no job to run |
| Consent record of a visitor who never signed up | Expires automatically | Time-to-live set to expire with the recording it authorises, so evidence about a non-customer is not kept indefinitely |
| Payment-processor event markers (duplicate protection) | 30 days | Database time-to-live |
| Server logs | 30 days | Automatic expiry |
| Invoices and accounting records | As required by applicable commercial and tax law, typically 10 years | Statutory obligation; these survive account deletion |
09What erasure actually deletes
This section says something most privacy policies do not, and we would rather you read it here than discover it later.
Deleting your account immediately and permanently removes everything held against your account in our operational database: the account record, saved locations, entitlement, usage counters, your consent record, and the hashed device identifiers linked to your account.
Analytics events are not deleted on request
Analytics events are kept in a columnar archive organised by the time they arrived, with no index from a person to their rows. There is no mechanism today to find one user's events and remove them, and building one means rewriting entire storage partitions — a job that is designed but not built.
So, honestly: if you delete your account, any analytics events you previously consented to survive, and are removed only when they reach the 90-day expiry described above. They still carry your account identifier during that window. We are not able to accelerate it.
Two things limit the exposure. Analytics is off unless you switched it on, and coordinates are off unless you switched them on separately. If you never consented, there is nothing in that archive about you at all. For the same reason, a copy of your data supplied under Art. 15 states explicitly that analytics events are not included, rather than quietly leaving them out.
Session replay recordings are on the path where deletion works: they carry a 30-day self-expiry, and they can be removed on request.
Data held by Stripe as an independent controller, and account data held by Clerk, are subject to those companies' own retention rules. We will pass on a deletion request, but we cannot compel deletion of records they are legally required to keep.
10Your rights
- Art. 15 — Access
- Confirmation of whether we process data about you, a copy of it, and the information in this policy. Our copy explicitly names analytics events as not included, for the reason in section 9.
- Art. 16 — Rectification
- Correction of inaccurate data, and completion of incomplete data.
- Art. 17 — Erasure
- Deletion of your data, subject to the limits in section 9 and to records we must keep by law.
- Art. 18 — Restriction
- Processing limited to storage only, for example while a dispute about accuracy is resolved.
- Art. 20 — Portability
- The data you provided to us, in a structured, commonly used, machine-readable format — we supply JSON — and transmission to another controller where technically feasible.
- Art. 21 — Objection
- Objection, on grounds relating to your particular situation, to processing based on legitimate interests — here, the abuse-prevention counters in section 3.
- Art. 22 — Automated decisions
- We take no decision producing legal or similarly significant effects on you by automated means, and we do not profile you. Checking whether a subscription is active is a contractual condition, not a decision about you within the meaning of Art. 22.
- Art. 7(3) — Withdrawal
- Withdraw consent at any time, as easily as it was given, effective for the future.
- Art. 77 — Complaint
- Lodge a complaint with a supervisory authority — see below.
11How to exercise them
Write to privacy@gpslarp.com from the address associated with your account, or from any address if you tell us which account you mean. We respond within one month, extensible by two further months for complex requests, in which case we will tell you inside the first month. Exercising these rights is free.
We may ask for information to confirm you are the person the data is about. We ask for the minimum needed and do not require identity documents in the ordinary case; we will not use anything you send for verification for any other purpose.
Where a complaint goes
Because two regimes apply, there are two answers, and which one is yours depends on where you are:
- In the EU or EEA
- You may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). The European Data Protection Board publishes the list of national authorities at edpb.europa.eu. You do not need to go through us first.
- In Switzerland
- The competent authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.
This is without prejudice to any other administrative or judicial remedy.
12Security
- All traffic between your device and our servers is encrypted in transit with TLS.
- Everything stored on our servers is encrypted at rest.
- Authentication tokens on your computer are kept in the operating system's own credential store — the macOS Keychain, or Windows Credential Manager — not in a file.
- We never receive or store your password; Clerk handles authentication.
- We never receive or store card details; Stripe handles payments.
- Analytics coordinates are rounded before storage and no IP address is stored beside them, so even an attacker with the archive gets an 11-metre approximation and no network identifier.
No system is perfectly secure. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you (Art. 34 GDPR) and the competent supervisory authority (Art. 33 GDPR).
13Children
GPSLarp is not directed at children and we do not knowingly process the data of anyone under 16. If you believe a child has created an account, write to privacy@gpslarp.com and we will delete it.
14Changes to this policy
We will update this document when the processing changes. The version number and effective date at the top always identify the current text.
If a change affects what we collect or why, the consent version increases. Consent you gave against an earlier version stops authorising anything, and you will be asked again — a changed policy can never silently inherit an agreement to terms you never saw. Material changes will also be announced in the application.