Privacy statement

Who we are, and what this covers

GeoQuestly is a location-based social app made by Mandrill Software GmbH. This statement covers both this website and the GeoQuestly app, because they are one service to the person using them.

The short version: location sharing is off until you switch it on, you decide who sees you and how precisely, and you can stop at any moment. Following somebody is not the same as seeing where they are — those are two different things in GeoQuestly, and they always have been.

We do not sell personal data, we run no advertising, and there is no tracking across other websites or apps. Everything below was written from the source code and configuration of the product rather than from what a privacy statement usually says.

Terms of use

Who GeoQuestly is for

GeoQuestly is for people aged 16 and over. It is not made for children, we do not ask for or hold anybody’s date of birth, and we do not knowingly process data about anybody younger.

The terms of use state the same minimum age as a condition of holding an account. If you believe an account belongs to somebody under 16, write to us and we will look into it.

When you create your account, you confirm in the app that you are at least 16 and accept the terms of use; an account that already exists confirms this once at its next start. For this we record only which version of the terms of use you confirmed and when — no age and no date of birth. When you delete your account, this is deleted too.

This website

The website is a set of pages built in advance and delivered by a web server. There is no account, no contact form, no comment function and no shop.

It sets no cookies. It contains no advertising and no social-media buttons, and it loads no fonts, scripts or images from anybody else — everything comes from the same address you are reading, and that includes the two services described below, which the website reaches only through that address.

It stores at most two things in your browser, each only after you chose something yourself:

• geoquestly.locale, a two-letter language code such as "de", written when you pick a language from the language menu, so you do not have to choose it again on every visit,
• geoquestly.visitorCounting.v1, your answer to whether we may count your visits — "granted" or "denied" — and the date of that answer, written when you answer; after twelve months the site asks again,
• neither is ever sent to us, and neither contains an identifier of any kind,
• clearing your browser’s site data removes both; the site then follows your browser’s language again and asks its question again.

Technical connection data — your IP address, the time, the page requested — is necessarily processed by our hosting provider in order to deliver the page to you. We have not enabled log collection for the website.

We count page views with PostHog, a product-analytics service whose data is stored in Frankfurt (Germany). Unless you allow us to count your visits, a page view carries the address of the page without anything after a question mark, the language of the page and the time — no referrer, no screen size, no browser or device details, and no identifier of you. It reaches PostHog through our own server, which passes on neither your IP address nor anything else about your browser. All such page views carry the same fixed label, so PostHog counts them as page views, never as visitors.

If you allow us to count your visits, your page views reach PostHog through a second route of our own server, which passes on exactly two things besides the page view: your IP address and your browser’s details (user agent). PostHog uses them, together with the website’s address and a random value that changes every day, only to form an identifier that cannot be reversed; PostHog deletes that random value once the day’s page views have been processed, and it does not store your IP address. There is still no cookie, and nothing is stored in your browser for it. Because the identifier changes every day, each day counts as a new visit. A page view counted this way also carries where your visit came from: only the domain of the page that linked to ours (for example news.example.ch — never its full address) and, if the link carried them, the three campaign values utm_source, utm_medium and utm_campaign. Without your permission none of this is sent.

We ask with a small bar at the bottom of the page, and allowing is as easy as declining. Your answer is remembered in your browser (see above). You can change it at any time under “Privacy settings” at the bottom of every page; the change applies from the next page view.

If the website’s own code fails in your browser, it reports the error to Sentry, an error-monitoring service whose data is also stored in Frankfurt (Germany): the error and where in the code it happened, and the address of the page without anything after a question mark. The report travels through our own server as well and — whatever you answered above — carries no IP address, no cookie and nothing that identifies you.

PostHog keeps page views for one year on its free plan and seven years on a paid plan; a shorter period cannot be set. Sentry keeps error reports for 30 days on its free plan and 90 days on a paid plan. Neither can connect what it keeps to a person.

Your account

Signing in runs through Microsoft Entra External ID, a Microsoft identity service. Your credentials are handled there; GeoQuestly never sees your password.

What GeoQuestly’s own database holds about your account is:

• a GeoQuestly user id, your display name and your handle,
• the identifiers that link your account to the directory that authenticates you,
• your account status and the dates it changed — activated, deactivated, deletion requested,
• your devices: an installation id, the platform, an optional device name, the app version and when it was last seen,
• which version of the terms of use you confirmed — with your confirmation that you are at least 16 — and when.

GeoQuestly does not store your e-mail address. It exists in the Microsoft directory that signs you in; the app neither reads it from the sign-in token nor saves it.

A profile picture you upload is stored in our media storage under your user id, and is replaced or removed when you change or delete it.

People, groups and events

GeoQuestly is a social app, so it holds the connections you make in it:

• friendships, and friend requests you have sent or received,
• who you follow and who follows you,
• the groups you belong to and your role in them,
• event invitations and whether you accepted them.

Who can see a group, an event or a post is decided by that item’s own settings and by whether you are a member — checked on every request against the current, committed state, never against a remembered answer.

Anyone with the platform role SuperAdmin can view and manage every group and event for moderation — private ones too, and ones they are not a member of: with their members, places and events, the hidden ones included. They can edit them, change roles and delete them. No other role can, Admin and Moderator included. Every such intervention is recorded internally: what was changed or deleted, by whom, and that it was done as SuperAdmin.

What you write and share

Posts, chat messages, group chats and the media attached to them are stored so that the people they are meant for can see them:

• the text of posts and messages,
• pictures and other media you attach,
• reactions, hashtags and mentions,
• which conversations you have read.

The text of chat messages and posts is encrypted where it is stored, so it is not readable in the database itself.

If you deliberately attach a place to a post or a message, that place is part of the content you posted and is visible to whoever the post is visible to. That is a separate decision from live location sharing, which the next section describes.

A video or a document you attach is stored as the file you chose: GeoQuestly does not convert it, read it or strip anything from it. Whatever the file carries inside — the place and time a video was recorded, the author name saved in a document — therefore travels with it to the people you send it to. A photo is different: it is re-encoded on your device before it is uploaded, which removes such data.

You can delete a post of your own at any time. Anyone with the platform role Moderator, Admin or SuperAdmin can delete any post; a role in a group does not allow it. A deletion removes the text, the pictures and videos together with their stored files, the attached location, and the reactions, hashtags and mentions, and it cannot be undone. Replies by other people stay, under "Post deleted". Every deletion is recorded internally: who deleted it, and whether it was moderation.

In chats, members see whether and when a message they sent has reached the others ("Delivered") and whether and when it was read ("Read") — in a one-to-one chat for the other person, in a group chat for the members who received it. Others see the same for the messages they send you. In the settings you can turn "Read receipts" off: then nobody sees when you read a message, and you don’t see it for others either; "Delivered" stays visible. The exact time a message was delivered or read is kept as long as the chat exists and you belong to it; it is deleted when you leave the group or are removed from it, when the chat is deleted, and with your account.

Location

Location sharing is off until you switch it on. Nothing about your position is shared, stored or shown to anybody before you do.

When you switch it on, four things are yours to decide: whether it is on at all, for how long, who can see you — the groups you tick and your friend settings — and how precisely, from your exact position to a coarse area to nothing at all.

The precision somebody actually receives is the lowest of three limits: how precisely your device was allowed to measure, the limit you set, and what that person is entitled to. A recipient can never raise it. An AI app the recipient has connected to GeoQuestly also receives your location only as precisely as you share it with that person (see “AI apps you connect to GeoQuestly”).

Following somebody does not let you see where they are. Location sharing is its own decision, made by the person being shared, and being followed has never been a part of it.

If you allow it, the app can receive positions while it is in the background or your screen is off. That is what makes shared location keep working when you put your phone in your pocket, and both iOS and Android show you that it is happening. You can withdraw the permission at any time in your device settings, and you can switch sharing off in the app without touching the permission at all.

While you are sharing, this is what exists:

• your current shared position, in a short-lived cache that expires after about 30 minutes and is replaced by each new position,
• one checkpoint of your latest shared position on your sharing record, written at most once every couple of minutes, so that a recipient still sees something if the cache is lost,
• the audience and the duration you chose,
• whether the app is currently open, which expires by itself shortly after the app stops saying so,
• whether you are currently moving, which is a short-lived state and not a route.

GeoQuestly does not keep a location history. There is no trail, no table of past positions and no record of where you have been — what exists is your latest position while you are sharing, and the checkpoint carries the time it was actually measured, so a position twenty minutes old says so rather than pretending to be current.

When you switch sharing off, or the duration you chose runs out, the switch, the audience and the stored checkpoint are cleared together in a single step, and the short-lived copy expires on its own.

While sharing is on, your phone itself keeps at most ONE position that has not reached us yet — the newest one — so that a moment without signal does not lose you. It lives on your device only, it is never a route, it is replaced by each newer position, and it is deleted when you switch sharing off. Nothing about it changes what we keep: still your latest position and nothing else.

The route your map is showing stays until you close it or a new route replaces it — even when you close the app. It is stored on your device only and belongs to your account: when you sign out or switch accounts it is removed, and another account on the same phone does not see it. It is never sent to GeoQuestly’s servers; its start and destination go there only when you calculate or recalculate a route. It is only ever this one route, never a history of where you went.

Arrival and departure alerts

A place in GeoQuestly can notify somebody when a person arrives at it or leaves it. There are two kinds: an alert a group’s managers set up for that group, and a personal alarm you set for yourself.

Both are worked out from a position you are already sharing. There is no separate tracking, no second permission and no additional collection: if you are not sharing your location with the group or the person concerned, nothing is evaluated. Sharing is the permission.

A group alert notifies the people the group’s configuration names; a personal alarm notifies you and nobody else. The records of the arrivals and departures they produce are kept for a limited period — currently seven days — and then removed automatically.

Push notifications

If you allow notifications, your device gives the app a delivery address for them. We store:

• the push token issued by Apple or Google, which is a delivery address and changes over time,
• an installation id, the platform and the app language, so the notification arrives in the right language on the right device,
• when the device was last seen.

Notifications are delivered through Azure Notification Hubs, which passes them to Apple or Google for delivery to your device. Who receives a notification is worked out from our own database at the moment of sending, never by the notification service. A notification tells the app where to look; the app then loads the content itself, with your session and your permissions.

AI in GeoQuestly

GeoQuestly has AI features that every person with an account can use: they draft a group or the events of a programme, answer in a group chat when somebody writes @geoquestly, propose changes to a group’s admins and moderators under “Edit with AI”, and draw a picture from a description. Every request is started by a person, and it costs that person Credits (see “Credits and in-app purchases”).

The request goes to Anthropic or to OpenAI in the United States, a picture always to OpenAI. Which provider and which model answer is decided by GeoQuestly, not by the person asking. What reaches the provider:

• for a draft: the written brief, the named region, the language and any attached document — a PDF, a picture, a page,
• for @geoquestly in a group chat: the question; the group’s name and description, up to 40 of its places and up to 20 of its events — no hidden places and no surprise before it is revealed; the last twelve messages of the chat, their text only, each with the display name of the person who wrote it; and, only while the person asking shares their location and it is at most an hour old, the area they are in — a zone of about 350 metres, never their exact position,
• for “Edit with AI”: the same, but without chat messages and without names,
• for a picture: the description, nothing else.

Not included are account data, handles, member lists, attachments and anybody else’s position. If you write in a group chat, it is worth knowing: when somebody there asks @geoquestly, the latest messages go along with their display names. The request may include a web search that the provider carries out. GeoQuestly then checks the proposed places against map data sources itself and computes paths with OpenRouteService; what reaches them is the names and positions of places, nothing about you.

The AI applies nothing by itself. A person opens a draft in the ordinary editor and decides what is saved; a proposal from the chat or from “Edit with AI” is applied by an admin or moderator of the group, and the group’s name and description only by an admin. The answer in a group chat is a message every member reads; it is stored encrypted like every chat message and stays for as long as the chat exists.

What somebody wrote to the AI — a brief, a question, a picture’s description — and what it answered or proposed, GeoQuestly keeps as the record of the request, together with the provider, the model and the usage. It is deleted when you delete your account or when the group it belongs to is deleted. What you wrote into somebody else’s AI proposal stays there, like your messages in a group chat — attributed to a deleted person.

Attached documents are removed automatically when they are not used — currently after 48 hours, after 6 hours for a request without a draft — and with the account. Drafts stay, also once saved or discarded, until you delete your account or the group that came from a draft or that it was made for is deleted; only an event draft you discard is deleted at once. A drawn picture that is not used stays 24 hours. An AI app you connect to your own account is something else — what it can read is described in the next section.

AI apps you connect to GeoQuestly

You can connect an AI app you use yourself — for example Claude by Anthropic (the Claude app or Claude Code) or ChatGPT by OpenAI — to your GeoQuestly account. To do so, you sign in to your GeoQuestly account from the AI app: signing in is what connects it, and GeoQuestly does not ask you a separate question about access. From then on it can read and act in GeoQuestly when you ask it to — as you, with exactly your rights in the app and no more. Until you connect one, none of this happens.

What it can read is what you see in the app:

• your profile, your friends and your friend requests, your groups with their members, invitations and places, events (a surprise stays a surprise), posts, and your chats with their messages, as well as anybody you look up by name or handle — with their name and handle, as the app’s search shows them,
• where your friends are — only if, and only as precisely as, they share their location with you: exactly or as a rough area, with when it was last updated and the address beside it,
• whether your friends are online or on the move — as each of them lets it be seen under “Who sees your status”, also when they do not share their location with you: a status says nothing about where somebody is,
• the positions shared into a group you are a member of, and your own shared position.

What it can do, when you ask it to, is what you can do in the app: answer invitations and friend requests, send messages in groups and to friends, write posts, create events in your groups, create and join groups, and change your location sharing — under the app’s rules, and others see it just as if you had done it in the app. Pictures, videos and documents, editing and deleting, and administration are not available there. A message to @geoquestly that an AI app sends for you does not start GeoQuestly AI and costs no Credits.

What the AI app reads this way is received by its provider — Anthropic for Claude, OpenAI for ChatGPT, both in the United States — which processes it under the terms you have agreed with it and may keep it under those terms. GeoQuestly has no influence on that, and deleting something in GeoQuestly does not delete what the provider has already received. It happens on your instruction: GeoQuestly sends nothing to an AI app on its own initiative, and its provider does not process the data on our behalf. You can disconnect at any time in the AI app’s settings. GeoQuestly offers these two AI apps. If you connect another tool on your own computer instead — for example VS Code — it is your own tool: what it reads goes wherever you let it send it.

If you share your location with a friend: if that person has connected an AI app, the AI app can read your location exactly as you share it with that person — exactly if you share it exactly, otherwise only the rough area — and it then reaches that AI app’s provider. Nothing more, and nothing you do not show that person. The same goes for posts and messages you show or write to others: their AI app reads what they see. Who sees you and how precisely is still your decision, and turning sharing off applies to an AI app from its next request.

The server through which AI apps connect stores nothing of its own: what an AI app writes for you is stored as in the app. It logs which function was called and when, with what outcome and how long it took, under a shortened hash of your account id — without content, message texts, coordinates or addresses.

Credits and in-app purchases

GeoQuestly meters some paid features — the assistant is the first — in Credits. Credits are GeoQuestly’s own units: they are not money, have no cash value, cannot be transferred and are not paid out. What GeoQuestly keeps about them is a balance and a ledger of every change to it — Credits added, used, adjusted or taken back — keyed by your user id, with the amount, the kind of change and the date. For a paid assistant run the ledger also records which pricing applied and the usage counts the charge was computed from; never the brief, the document or the reply.

Credits can be bought in the app. A purchase is made through Apple’s App Store on an iPhone or iPad or through Google Play on an Android device, under that store’s terms and with the payment method you have with it. GeoQuestly does not see your card, your billing address or your receipt, and it sets no price in the app: the price you see is the store’s, for your country.

What passes between the store and GeoQuestly for a purchase is:

• a random token GeoQuestly attaches to your account and hands to the store when you buy, so that the store can tell GeoQuestly which account a purchase belongs to without either side naming you,
• the store’s identifier for the transaction, the product bought, its state — paid, pending, refunded — and the store’s own signed proof of the purchase, which GeoQuestly checks with the store’s servers before any Credits are added,
• for a purchase on Google Play, the purchase token Google issues, which GeoQuestly stores encrypted and uses only to ask Google about that purchase again,
• the store’s notifications about the purchase afterwards — a refund, a revocation, a test message,
• what GeoQuestly keeps: the transaction identifier, the product, the Credits it granted, its state and the dates of each step,
• nothing else: no name, no e-mail address, no Apple ID or Google account, no payment data.

Credits are added only after the store has confirmed the purchase to GeoQuestly’s servers. If the app is closed or offline in between, the purchase is not lost: it is completed the next time the app starts. If the store refunds or revokes a purchase, all of the Credits it granted — or, for a partial refund, the corresponding portion, according to the store’s verified refund decision — are taken back, even if you have already used some of them; your balance can then be negative, and paid features stay unavailable until it is positive again. If the store later reverses that refund, GeoQuestly restores the Credits it had taken back for it.

The record of a purchase and of its refund is our accounting record of a sale. It is kept for as long as accounting law requires us to keep it, which is longer than your account may exist, and it survives the deletion of your account under the marker that replaces your user record. Remaining Credits are not paid out when an account is deleted.

Apple and Google are independent of us for the purchase itself: their own privacy statements govern what they do with your payment and your store account. GeoQuestly’s servers contact them to verify a purchase and, on Google Play, to mark it as delivered; what those requests carry is the transaction identifier, the product and — for Google — the purchase token, never anything about you.

Usage and error data in the app

So that we can see which parts of GeoQuestly are actually used, and fix what breaks, the app sends two kinds of data: usage events to PostHog and error reports to Sentry. The data of both services is stored in Frankfurt (Germany).

Whether this device sends them is yours to decide, under Settings → Legal → “Send usage and error data”. The switch is on when the app is installed and applies to this device only. Switched off, the app sends neither usage events nor error reports from it — and nothing is collected in the meantime to be sent later.

What is sent, and what never is:

• a usage event is the name of an action from a fixed list in the app’s code — for example that the app was opened, a screen viewed, a group created or a message sent — with at most a few coarse attributes, such as the kind of message (text, picture, video), the step of a wizard or the size class of a Credit package. Nothing is recorded by watching where you tap,
• every screen is named by its route with all ids removed — that a group page was opened, never which group,
• each event also carries the app version, the platform (Android, iOS or web) and the GeoQuestly platform the app is connected to, together with a random identifier of this installation and, once you are signed in, the pseudonym of your account described below,
• an error report carries the error and where in the code it happened, the app version and platform, and the screens and requests just before it — named by their route with every id removed, a request only with its method and result,
• never: your position or anything worked out from it, the content of messages, posts, groups, events, places, comments or AI requests and answers, names, usernames or e-mail addresses, the ids of groups, events, places, chats or people, your IP address, or any recording of the screen,
• in the web app, both reach PostHog and Sentry through our own server, which does not pass your IP address on; the iOS and Android apps send to them directly, and both services are set not to store the IP address of the device.

The pseudonym is worked out by our server from your user id with a secret key and shortened to 32 characters. It lets us count how many people use a feature without knowing who they are. PostHog and Sentry cannot turn it back into your account, and we keep no list that links the two: once your account is deleted, nothing connects the pseudonym to you any more.

Error reports from our own servers are part of running the service and do not depend on the switch: when something fails on the server, the error and the server’s log lines go to Sentry, cleaned the same way — no position, no content, no names or e-mail addresses, no ids, no IP address, no request body, header or cookie — and at most with the pseudonym of the account that made the request.

PostHog keeps usage events for one year on its free plan and seven years on a paid plan; a shorter period cannot be set. Sentry keeps error reports for 30 days on its free plan and 90 days on a paid plan, and server log lines for 30 days.

When you sign out, switch to another platform or delete your account, the app forgets the pseudonym and starts again with a new random identifier.

Maps and other services your device contacts

A map is drawn from tiles published by other organisations, and your device fetches them directly from those organisations. That is how maps work, and it means those organisations see the request:

• base maps from OpenFreeMap, swisstopo (in Switzerland), Esri and OpenStreetMap (the "Classic" map),
• the optional Swiss overlays — swisstopo and geo.admin.ch, the federal offices for environment and roads, MeteoSwiss, Basel-Stadt, Basel-Landschaft and geodienste.ch — which are switched off unless you switch them on,
• GIPHY, when you open the GIF picker in a chat or a post. GIPHY requires apps to call it directly and does not permit us to fetch on your behalf,
• what any of them can see is what any web request shows: your IP address, what you asked for, and your device’s technical request data.

Other lookups run on GeoQuestly’s own servers rather than on your device, so you do not contact those providers and your IP address does not reach them: searching for places and addresses (Photon), calculating routes (OpenRouteService), planning public-transport connections (opentransportdata.swiss), the address shown beside a position (swisstopo in Switzerland, Nominatim elsewhere), checking places proposed by the AI assistant (Nominatim, Overpass) and finding pictures of places (Wikimedia Commons).

The address beside a position — for a place, an event, a shared position, or a moved start or destination of a route — is fetched by GeoQuestly’s server. For a position in or near Switzerland it first asks the Swiss federal geodata services (geo.admin.ch, operated by the Federal Office of Topography swisstopo): the nearest official building address within 50 metres, otherwise the municipality and canton. Elsewhere, and whenever the federal services know no Swiss address there, do not answer in time or their request quota is used up, it asks Nominatim, OpenStreetMap’s address service. Your phone contacts neither service, and your IP address reaches neither. The request carries only the coordinates rounded to about 11 metres — for Nominatim also the language of the answer — and nothing about you. GeoQuestly’s server keeps the answer for 24 hours, filed under those rounded coordinates and without reference to any person.

All of these organisations are independent of us; their own terms and privacy statements apply to what they do with a request they receive.

Switching an optional overlay off stops the requests for it, and not opening the GIF picker means no request is made to GIPHY at all.

Where your data is, and who processes it

GeoQuestly runs on Microsoft Azure. Mandrill Software GmbH remains responsible for your data; Azure processes it on our instructions and for no purpose of its own.

Where the parts of the service run:

• the application database, holding your account, content and sharing settings — Switzerland (Switzerland North),
• the cache and the real-time connection that keeps the map live — Switzerland (Switzerland North),
• media storage for pictures and attachments — Switzerland (Switzerland North),
• push delivery — Switzerland (Switzerland West), and from there to Apple or Google,
• sign-in through Microsoft Entra External ID — the directory is registered for Switzerland, and Microsoft holds its identity data in its European region,
• usage events and the error reports of the app and the website — PostHog and Sentry, data stored in Frankfurt (Germany).

Some data necessarily leaves Switzerland: to Apple and Google when a notification is delivered to your device or when you buy Credits through their stores, to the AI provider when somebody uses an AI feature, to the provider of an AI app — for example Anthropic or OpenAI — when an AI app that you — or someone you share with — has connected reads for that person, to the map and GIF providers your own device contacts, and within Microsoft’s European infrastructure when you sign in. For usage and error data the processors are, in addition, two US companies, PostHog, Inc. and Functional Software, Inc. (Sentry): their data for GeoQuestly is stored in Frankfurt but may be accessible from the United States. For that, both rely in their data processing agreements on the Swiss–U.S. Data Privacy Framework and on the EU Standard Contractual Clauses adapted to Swiss law.

Switzerland recognises the EU and EEA states as providing an adequate level of data protection, and since 15 September 2024 also the United States for companies certified under the Swiss–U.S. Data Privacy Framework.

If you would like to know which safeguard applies to a particular transfer, ask us and we will tell you.

How long things are kept

Data is kept for as long as it has a purpose, and no longer:

• your account, profile and settings: while your account exists. Posts, messages, groups and events: until they are deleted — and the account deletion page says what happens to content you wrote to other people when the account itself goes,
• your shared position: the short-lived copy expires after about 30 minutes, and the checkpoint is cleared the moment you stop sharing,
• whether the app is open: a few minutes after it stops saying so,
• arrivals and departures recorded by location alerts: currently seven days,
• documents attached to an AI draft: 48 hours if they are never used, 6 hours if the run produced no draft,
• your Credit balance and ledger, and the record of any purchase and its refund: purchase records for as long as accounting law requires, and all of them beyond the deletion of your account, under the marker that replaces it,
• usage events at PostHog: one year on its free plan, seven years on a paid plan — the pseudonym in them can no longer be connected to you once your account is deleted,
• error reports at Sentry: 30 days on its free plan, 90 days on a paid plan; server log lines at Sentry: 30 days,
• what somebody wrote to the AI and what it answered: until the account or the group is deleted; a draft, also once saved or discarded: until the account is deleted, or the group that came from it or that it was made for — a discarded event draft is deleted at once; a drawn picture that is not used: 24 hours.

Anything not listed above is kept while it serves the purpose described in this statement, and is removed when you delete your account.

Why we are allowed to process this

Everything above is processed for one of a small number of reasons, and it is worth saying which is which — not least because the reason decides what you can do about it.

Reading down what GeoQuestly holds:

• your account, your profile and the social features you use — friends, follows, groups, events, posts and chats — are processed in order to give you the service you asked for. Without them there is no product to deliver.
• signing you in is processed for the same reason: an account you cannot get back into is not an account.
• your location, and the arrival and departure alerts worked out from it, rest on your own decision. You make it every time you switch sharing on, you choose its audience and its precision, and you withdraw it by switching sharing off.
• push notifications rest on the permission you gave your device, which your device also lets you take back.
• the AI features run because a person starts them, and are processed to provide that person the service they asked for. What goes along from others — for a question in a group chat, the latest messages with their authors’ display names — we process in our legitimate interest that the AI understands the conversation it is asked in. We have weighed it against the members’ interest: text only, only the last twelve messages, display names only, no attachments and no positions.
• buying Credits, and the delivery, recovery and reversal of a purchase, are processed to perform the purchase you made and to keep the accounting record the law requires of a seller.
• keeping GeoQuestly working, secure and free of abuse — refusing bad requests, protecting accounts, keeping the service standing up — is our own legitimate interest in running it, and we have weighed it against yours.
• usage events and the app’s error reports, page views counted without your consent and the website’s error reports rest on our legitimate interest in knowing which parts of GeoQuestly are used and in fixing what breaks. We have weighed it against yours: nobody is identified by them, nothing of your content or position is in them, and in the app you can object at any time, for each device, with the switch in the settings. Counting your visits to the website rests on your consent, which you give or withdraw under “Privacy settings” at the bottom of every page.
• what an AI app you have connected reads and does is processed on your instruction, to provide the service to you in the way you chose. What others share with you reaches your AI app only as they share it with you, and this statement tells them so.

Where a processing rests on a decision of yours, taking it back is a switch rather than a request: turn location sharing off, revoke the notification permission in your device settings, delete your account. None of it has to go through us.

Where it rests on our own interest in the service working, there is no advertising, no profiling, no scoring and no picture of you being built anywhere in it. If you still object to a particular processing, tell us and we will look at it on its own facts.

Your rights

Under Swiss data protection law you can ask us for the following, free of charge:

• access: confirmation of whether we process data about you, and a copy of it,
• correction of data that is inaccurate,
• deletion of your account and the data belonging to it,
• to object to a particular processing, or to withdraw a permission you gave — switching location sharing off is exactly that,
• in certain cases, to receive the data you provided in a common machine-readable format.
• to have a particular processing restricted while a disagreement about it is being settled.

Much of it you can do yourself, without asking anybody: edit your profile, delete your own posts and chat messages, leave a group, switch location sharing off, and delete your account permanently under "Account" in the app. If you no longer have the app installed, the account deletion page explains how to ask us instead.

For anything the app cannot do — an access request, a correction we have to make for you — write to us. We may have to ask you to identify yourself first, because handing your data to the wrong person would be the worse mistake.

Requests reach us at the data protection address below, or by post to Mandrill Software GmbH at the address given in the legal notice.

Data protection contact

info@mandrill.software

Delete your account

Which law applies, and where to complain

Mandrill Software GmbH is a Swiss company, GeoQuestly runs on infrastructure in Switzerland, and this statement is written under Swiss data protection law — the Federal Act on Data Protection.

The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. If you think we are handling your data wrongly, tell us first — we would rather fix it than argue about it — but you can report it to the FDPIC at any time, and nothing here asks you to come to us before you do.

GeoQuestly is being released in Switzerland first. This statement was written so that it already carries the information the European General Data Protection Regulation requires as well, and if we later offer GeoQuestly to people in the EU or the EEA we will complete the remaining EU-specific parts — including the representative in the Union that a company established outside it has to appoint — before that happens rather than afterwards.

Wherever you happen to be, the rights described above are the ones we act on. We do not ask which country you are in before answering a question about your own data.

Security

The measures that matter most here, at a level it is sensible to state publicly:

• everything between your device and our servers travels over encrypted connections,
• the content of messages and posts is additionally encrypted where it is stored,
• whether somebody may see something is decided on every single request from the authoritative database, never from a cached answer that could have gone stale,
• sign-in is handled by Microsoft’s identity service, so your password never reaches GeoQuestly.

No system is perfectly secure, and we do not claim otherwise. If a breach of data security occurs that is likely to result in a high risk to your personality or fundamental rights, we will report it to the Federal Data Protection and Information Commissioner as soon as possible, and inform you where the law requires it or where it would help you protect yourself.

Changes to this statement

GeoQuestly is being actively developed, so this statement will change as the product does. The current version is always the one on this page.

The version and date at the top say when it last changed. A change that materially affects how your data is used will be pointed out in the app rather than left here to be discovered.