Privacy Policy for the “Hamburg City Guide Explorer” App
Last updated: April 29, 2026
1. Controller
Peter Wilkens
Waitzstraße 24
22607 Hamburg
Germany
Email: info@cityexplorer.tours
Commercial Register: Amtsgericht Hamburg, HRA 126427
2. Scope
This Privacy Policy applies to the mobile app “Hamburg City Guide Explorer”. It may also be published on an accompanying website insofar as it describes data processing within the app.
Where this website reproduces privacy information for the “Hamburg City Guide Explorer” app, the following applies: in-app purchases, product displays and the restoration of previous purchases take place exclusively inside the iOS app via Apple StoreKit or the App Store. Merely visiting this website does not trigger any purchases via StoreKit.
Where this website carries out its own processing, such as server logs, contact forms, cookies, embedded content or reach measurement, this is described in the separate website privacy notices.
3. General Information on Data Processing
We process personal data only to the extent necessary to operate the app, provide its content and features, or where you have given your consent.
The relevant legal bases include Art. 6(1)(a), Art. 6(1)(b), Art. 6(1)(c), Art. 6(1)(f) GDPR and Section 25 TDDDG, where information is stored on or accessed from your device.
Unless a specific retention period is stated, we delete or anonymise personal data once the relevant purpose no longer applies and no statutory retention obligations prevent deletion.
4. App Use Without an Account and Local Storage
The current release version of the app can be used without a user account. For technical operation and personalisation, the app stores certain information locally on your device, in particular:
privacy and consent settings
onboarding completion status
language and display preferences
a local technical user identifier
interests, travel type, trip duration and optional arrival date
locally saved routes, downloads and caches
technical app states and local preferences
locally stored entitlement information for premium content
Depending on the type of data, this information is stored in local app storage, protected local storage or the iOS Keychain. The data is used to provide the app, remember your choices, display content faster and restore unlocked features.
Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR, and Section 25(2) TDDDG.
Retention period: generally until app data is deleted or reset, until the app is deleted, or until the respective purpose no longer applies.
5. Location Data and Map Features
If you allow the app to access your location, the app uses your approximate or precise location to show nearby sights, tours, routes, distances and location-based content.
Location permission is requested via the iOS system dialog and can be withdrawn or restricted at any time in the iOS settings.
In the current release configuration, we generally do not permanently store location data on our own servers. Location processing primarily takes place locally on your device.
Legal basis: Art. 6(1)(a) GDPR where you grant location access; additionally Art. 6(1)(b) GDPR where you use location-based app functions.
6. Apple MapKit / Apple Maps
The app uses Apple MapKit and Apple Maps for maps, map views, routes and navigation handoff. According to Apple, this may involve the processing of data such as:
time of the request
device model and software version
input language
device or map location, if enabled
visible map area
interactions with maps, search terms, displayed places and route requests
Apple processes this data as an independent controller under Apple’s privacy terms.
Further information: https://www.apple.com/legal/privacy/data/en/apple-maps/
7. Backend, Content, Media and Weather
We use Supabase as technical backend infrastructure to deliver editorial content such as points of interest, tours, events, images, audio content and selected server-side functions.
Provider: Supabase, Inc.
When you use the app, the following data may be processed in particular:
IP address and technical connection data
date and time of access
requested API endpoints and content
app language and technical request parameters
technical error and response data
requests for image, audio and content files
The current release version does not require a user account. Personal profile data is not centrally processed as a mandatory part of an app login in this version.
For the weather feature, the current release configuration does not transmit your precise location to our weather proxy; only the selected app language is transmitted.
Our Supabase project is currently configured for an EU region. Where required, Supabase is used on the basis of a data processing agreement under Art. 28 GDPR.
Legal basis: Art. 6(1)(b) GDPR where processing is required to provide app functionality, and Art. 6(1)(f) GDPR for secure and reliable app operation.
8. Analytics and Error Monitoring with Amplitude
We use Amplitude for product analytics and error monitoring only if you explicitly consent to this optional processing.
Provider: Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA.
If you consent, the following categories of data may be processed in particular:
screen views and navigation within the app
interactions with tabs, buttons, POIs, routes, events and booking calls
search terms and number of search results
onboarding results, such as selected interests, duration and mobility preferences
language settings and permission status
technical diagnostic data, error names and error messages
app version, build number, platform, device language and device locale
usage-related properties such as “onboarding completed”, “routes saved” or number of preferred categories
pseudonymous technical identifiers that may be generated by the service or SDK
In our app, Amplitude is configured to use the EU server region. We do not actively use a separate session replay or experiment/A/B testing function in the current configuration. The current app version does not use ATT-based advertising tracking or IDFA-based cross-app tracking.
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
Withdrawal: You can withdraw your consent at any time with future effect in the app’s privacy settings.
9. In-App Purchases, App Store and StoreKit
Where the app offers paid digital content or premium features, it uses Apple StoreKit and the App Store to display available products, process purchases and restore previous purchases.
In-app purchases, product displays and the restoration of previous purchases take place exclusively inside the iOS app via Apple StoreKit or the App Store. Merely visiting an accompanying website does not trigger any purchases via StoreKit.
This may involve the processing of the following data in particular:
technical device and app information
information about requested products, prices and availability
transaction, purchase and restore status, as well as product identifiers
Apple ID, payment and billing data, insofar as processed by Apple through the App Store
Apple processes payment, billing, Apple ID and transaction data under its own data protection responsibility. We receive only the information required to associate purchases in the app, provide unlocks and restore previous purchases.
To restore and locally enforce unlocked premium access, the app may store the unlock status and associated product identifiers in protected form on your device, currently in the iOS Keychain.
Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR and Section 25(2) TDDDG.
Further information: https://www.apple.com/legal/privacy/data/en/app-store/
10. External Links, Partner Offers and GetYourGuide
The app contains external links, in particular to event pages, ticket pages and partner offers such as GetYourGuide. When you tap such a link, you leave the area controlled by the app and are redirected to the respective third-party provider.
Certain POI detail pages may also include a GetYourGuide widget. When such a widget is loaded, the app establishes a connection to GetYourGuide so that the offer can be displayed.
External links or embedded partner offers may involve the processing of the following data in particular:
IP address
date and time of access
device, browser or WebView information
accessed offer or partner page
referrer information, where technically transmitted
partner, campaign or affiliate identifiers
If bookings are made via such links, we may receive a commission. This does not result in any additional costs for you.
Provider: GetYourGuide Deutschland GmbH, Sonnenburger Str. 73, 10437 Berlin, Germany.
Legal basis: Art. 6(1)(f) GDPR.
Further information: https://www.getyourguide.com/c/privacy-policy
11. Push Notifications
Push notifications are not active in the current release version. As long as push notifications are not activated, no push tokens are processed for notification purposes.
12. Recipients and Third-Country Transfers
Personal data is transferred only where necessary for operating the app, using integrated services or complying with legal obligations.
Recipients may include in particular:
technical service providers for hosting and backend infrastructure, especially Supabase
Apple in connection with MapKit / Apple Maps and the App Store / StoreKit
Amplitude, if you have consented to analytics and error monitoring
external partner pages, ticket providers or widget providers if you open or display the respective content
Where providers in third countries, especially the United States, are involved, processing takes place on the basis of your consent and/or appropriate data protection safeguards, such as contractual protection mechanisms, standard contractual clauses or other lawful transfer mechanisms.
13. Security
We use technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised disclosure. These include encrypted connections, protected local storage and limiting app permissions to the functions actually required.
14. Your Rights
Subject to the requirements of the GDPR, you have the following rights in particular:
right of access under Art. 15 GDPR
right to rectification under Art. 16 GDPR
right to erasure under Art. 17 GDPR
right to restriction of processing under Art. 18 GDPR
right to data portability under Art. 20 GDPR
right to object under Art. 21 GDPR
right to withdraw consent with future effect
right to lodge a complaint with a supervisory authority under Art. 77 GDPR
To exercise your rights, you may send an informal message to: info@cityexplorer.tours
Competent supervisory authority in Hamburg:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
Email: mailbox@datenschutz.hamburg.de
https://datenschutz-hamburg.de
15. No Automated Decision-Making
The current release version of the app does not involve solely automated decision-making within the meaning of Art. 22 GDPR.
16. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy if the legal situation, the technical design of the app or the services used change. The currently published version applies.