Privacy notice

1. Controller

Alexander Liebing, Panoramaweg 6, 76189 Karlsruhe, Germany, aliebing@gmx.de

2. Hosting

HikeSense runs on a server rented from Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, which processes data on our behalf (Art. 28 GDPR). Accounts, saved plans, uploaded photos and chat logs are stored only on this server.

When you open a page, the server necessarily processes your IP address and the request to deliver it. No access logs with IP addresses are kept.

3. Chat without an account

You can use the planning assistant without an account. To limit guest use (10 requests per day per connection), the server stores a keyed hash (HMAC) of your IP address with the time of the request – never the address itself. These entries are deleted after 24 hours. Legal basis: Art. 6 (1) (f) GDPR (preventing misuse and costs).

4. Chat log

For each chat request the server writes a log entry: your message and up to five earlier messages of the conversation, the understood request, the answer, the tours considered, the model's prompts and tool calls, duration and cost. With an account, the entry is linked to your account; for guests only a pseudonymous code is stored.

The log serves operation, troubleshooting and improving the answers (Art. 6 (1) (f) GDPR). Only the operator can see it. Entries are deleted automatically after 30 days.

5. AI processing (OpenRouter)

To understand and answer your message, it is sent with the conversation context to OpenRouter, Inc. (USA, https://openrouter.ai/privacy), which passes it to the language model's provider (currently OpenAI, USA). The search for events and group dates also runs through OpenRouter's web search. Your IP address, email address and account id are not sent.

This is a transfer to a third country. Please do not enter personal data (names, addresses, health information) in the chat. Legal basis: Art. 6 (1) (f) GDPR (providing the assistant you are using).

6. Account

To save plans and searches or to add your own photos you need an account. We store: email address, password (only as a hash), time of registration, confirmation and last sign-in, account status, your saved plans and searches, and photos you upload. Your photos are visible only to you.

Confirmation and password-reset mails are sent through GMX (1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany).

Legal basis: Art. 6 (1) (b) GDPR (the account and its functions). The data is kept until you ask for your account to be deleted; write to the address above.

7. Data stored in your browser

HikeSense uses only storage that is strictly necessary (Section 25 (2) no. 2 TDDDG), so there is no consent banner:

• Cookie „hikesense.lang“ and a localStorage entry: the language you chose (1 year).
• When you are signed in: your session in localStorage (deleted when you sign out).
• Your position on the „On the way“ page is computed only in your browser and never sent to the server.

There is no tracking, no analytics and no advertising.

8. Content loaded from other servers

Some content is loaded by your browser directly from other servers, which therefore see your IP address (Art. 6 (1) (f) GDPR, showing maps and photos):

• Map: basemap.de of the Bundesamt für Kartographie und Geodäsie (BKG), Frankfurt am Main, Germany; if it cannot be reached, map tiles of the OpenStreetMap Foundation (United Kingdom).
• Photos: Wikimedia Commons of the Wikimedia Foundation, Inc. (USA).

Weather forecasts (Open-Meteo) are fetched by our server with the tour's coordinates only; no data about you is sent. Fonts are delivered by our own server.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) (Art. 21). Write to the address above.

You can also complain to a supervisory authority, for example: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, https://www.baden-wuerttemberg.datenschutz.de.