Privacy Policy for the "Heidelberg Walking Tours Guide" App

Last updated: April 29, 2026

1. Controller

The controller responsible for data processing in the “Heidelberg Explorer” app is Peter Wilkens, Waitzstrasse 24, 22607 Hamburg, Germany. Contact: info@cityexplorer.tours, phone +49 40 60778218-0.

2. Scope

This Privacy Policy applies to the iOS mobile app “Heidelberg Explorer”. Separate websites, app-store services, map providers, weather providers, booking pages, and partner sites may be subject to their own privacy policies.

3. Use Without Account

The app can currently be used without registration and without a central user account. We do not collect mandatory login data such as name, email address, or password within the app.

4. Legal Bases

Depending on the function, data is processed on the basis of Art. 6(1)(a) GDPR where you consent, Art. 6(1)(b) GDPR where processing is necessary for requested app functions, and Art. 6(1)(f) GDPR for secure and stable app operation. Where information is stored on or accessed from your device, Section 25 TDDDG applies.

5. Local Storage on Your Device

The app stores certain information locally, including onboarding status, trip profile, interests, visit duration, display and comfort settings, text-size preference, analytics consent status, partner-link notice status, audio playback speed, and cached app content. This data usually remains stored until you delete the app, reset app data, or change the relevant setting.

6. Location Data

If you allow location access, the app may use your current location during use to provide nearby content, route context, and local weather information. Permission is granted through the iOS system dialog and can be withdrawn at any time in iOS settings. Based on the current app version, Heidelberg Explorer does not permanently store your location on its own servers.

7. Weather Data

For local weather functions, the required coordinates are rounded before being sent to Open-Meteo. Technical connection data such as IP address, request time, and requested URL may also be processed by the provider. The app does not permanently store the weather coordinate as a movement profile.

8. Maps and Navigation

For map display and external navigation, the app uses Apple MapKit and Apple Maps, or the map or navigation app opened by the operating system. Depending on use, Apple or the respective map provider may process data such as request time, device information, language, authorized location, visible map area, search data, and interaction data.

9. Backend, Content, Images, and Audio

Editorial content, image metadata, image files, app session tokens, booking-link resolution, and audio content are provided through Supabase. This may involve processing IP address, request time, requested content, app bundle identifier, app version, build number, platform, and technical security or connection data. Some content may be cached locally to improve app speed and reliability.

10. Optional Usage Analytics

Optional usage analytics are disabled by default. Only after your active consent may Heidelberg Explorer process pseudonymous usage events through Amplitude EU, such as app launches, screen views, navigation, interactions, app version, operating system, device model, language, and a pseudonymous device identifier. Real name, email address, or a user account are not sent as mandatory fields. You can withdraw consent at any time in the app with effect for the future; the local analytics identifier is then removed.

11. No Advertising Tracking

Based on the current app version, the app does not use ATT-based advertising tracking, IDFA for cross-app tracking, session replay tools, or sell personal data.

12. External Links and Partner Links

The app may redirect you to external map, navigation, booking, or partner pages, including GetYourGuide. When you open such a link, you leave the area controlled by Heidelberg Explorer. The third-party provider may then process its own data, such as IP address, device and browser data, referrer, partner or campaign identifiers, and booking data. Qualified partner links may generate a commission without increasing your price.

13. App Store

When you download, update, rate, or purchase through the App Store, Apple processes personal data under its own responsibility. Apple’s privacy notices apply.

14. Contact

If you contact us by email or phone, we process the contact details and content you provide in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where the request relates to contractual or pre-contractual matters, and otherwise Art. 6(1)(f) GDPR.

15. Recipients and International Transfers

Recipients may include Supabase, Apple, Open-Meteo, Amplitude EU where analytics consent has been granted, and GetYourGuide or other external partner pages. Where providers or subprocessors operate outside the EU or EEA, international data transfers cannot be excluded. Where required, such transfers are based on appropriate safeguards such as standard contractual clauses, adequacy decisions, or your consent.

16. Retention

We store personal data only as long as necessary for the purposes described above or as required by law. Local app data usually remains stored until the app is deleted or the relevant setting is changed. Based on the current app version, location data is not stored by us as a permanent movement profile.

17. Your Rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent with effect for the future. To exercise your rights, you can contact us at info@cityexplorer.tours.

18. Right to Lodge a Complaint

You also have the right to lodge a complaint with a data protection supervisory authority. At the controller’s place of business, the competent authority is in particular the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de/.

19. Automated Decisions

The app uses local sorting, filtering, and personalization logic for content and route suggestions. Based on the current app version, no solely automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR are made.

20. Changes

We may update this Privacy Policy if the legal framework, app functions, or services used materially change.