Privacy policy

1. Who is responsible

Controller under the GDPR: [please complete], [please complete], [please complete], Austria. Email: [please complete].

2. Visiting this website

When you open a page, your browser sends technical data to our hosting provider: IP address, date and time, requested page, browser and device type. This is necessary to deliver the site and to keep it secure (Art. 6(1)(f) GDPR, legitimate interest). Server logs are kept for a short time and are not combined with other data.

The site uses no analytics, no advertising and no tracking. Fonts and images are served from our own domain, not from Google or other third parties.

3. Looking up a spot

If you open a spot page, your browser asks our API (api.pickerl.app, hosted on Google Cloud) for the public details of that spot. Your IP address is processed to answer the request and to limit abuse. We do not store a profile of you and you do not need an account.

The page shows no exact locations.

4. Launch notification form

If you want to be told when pickerl launches, you enter your email address and confirm the checkbox. We use the address only to send you that notice (Art. 6(1)(a) GDPR, consent). You can withdraw your consent at any time by writing to us; we then delete the address.

The address is passed to a Google service (Apps Script) that forwards it to our mailbox. To protect the form from bots we use Google reCAPTCHA v3. It is loaded only after you click “Allow and send”, and it sends technical data (such as your IP address and browser details) to Google. Legal basis: your consent (Art. 6(1)(a) GDPR and § 165 (3) TKG 2021).

5. Browser storage

We store your language choice and your reCAPTCHA decision in your browser (localStorage). Details are on the page “Cookies and storage”.

6. Recipients and transfers

Our hosting provider (Vercel Inc., USA) and Google (Google Cloud and reCAPTCHA) process data on our behalf or under their own terms. Data can therefore be transferred to the USA. Transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.

7. How long we keep data

Server logs: a short time, as set by the hosting provider. Email address for the launch notice: until the notice is sent or you withdraw, then it is deleted. Browser storage stays on your device until you delete it.

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time. Write to us to use them.

• Complaints: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.

9. The pickerl app

This part describes what the app processes. It applies once the app is available.

• Account: you sign in with a login provider (Firebase Authentication by Google). We store your account ID, your username and your avatar.
• Location: the app uses your precise location when you collect a spot. The server checks your position and the quality of the fix against the spot’s zone and records each attempt to detect cheating (Art. 6(1)(b) and (f) GDPR). The app asks for permission first.
• Game data: stickers you collect (with time, season and weather of the spot), trades, Pinboard offers, balances, notes and trade chat messages.
• Public to other players: your username, your avatar and the stickers you put up for trade. A spot shows when it was found, not by whom, unless you sign a note.
• Moderation: reports and blocks are stored to keep trading and notes safe.
• You can ask us to delete your account and the data tied to it.

10. Changes

We update this page when the site or the law changes. The date at the top shows the current version.