Wo Bilder entstehen

Privacy Policy

Last updated: 09/06/2026

1. Controller

baxxstage
Sander Kauschke
Vogelweiderweg 3a
6112 Wattens
Austria
E-Mail:

2. Data We Process

Server Logs
With every page request, the web server automatically records IP address, timestamp, requested URL and browser identifier (user agent). This data is used solely to ensure operation and for error analysis, and is not linked to any other data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Registration & Account
Upon registration, email address, display name and an encrypted password (bcrypt) are stored. Registration date and last login time are also recorded. This data is required to operate the user account.
Legal basis: Art. 6(1)(b) GDPR (performance of contract)

Spots
Spots created by users contain a name, description and GPS coordinates set via the map view. This content is necessary for the core function of the platform and is displayed publicly.
Legal basis: Art. 6(1)(b) GDPR

Photos
Uploaded photos are linked to the user account and displayed publicly. Before storage, all metadata (EXIF) is removed from the image file. Camera data (manufacturer, model, focal length, exposure, ISO) and the capture date are — if present in the original file — stored separately in the database and displayed on the spot page. GPS coordinates from photo EXIF data are not read.
Legal basis: Art. 6(1)(b) GDPR

Bookmarks & Likes
The assignment of saved spots (bookmarks) and photo likes to the user account is stored in order to provide these functions.
Legal basis: Art. 6(1)(b) GDPR

Session Cookie
A technically necessary session cookie is set for the login function (secure, httponly, samesite=Lax). It contains no personal data, only a random session ID. No tracking or advertising cookies are used; no analytics service is integrated.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

3. Third-Party Services

Google Maps
This website uses the Google Maps JavaScript API. When the map view is loaded, your browser establishes a direct connection to Google servers, transmitting your IP address to Google LLC, USA. Google processes this data in accordance with its own privacy policy.
Google Privacy Policy

Google Gemini API
The "Find spot by photo" feature (/find-spot) forwards photos uploaded by the user server-side to the Google Gemini API to identify the depicted location. Transmission only occurs when this feature is actively used.
Google Privacy Policy

Other server-side services (Nominatim, Overpass API, Gemini for geo-tagging) transmit only spot coordinates and names — no personal data.

4. Retention Period

Account data is stored until the account is deleted. Deletion can be requested at any time by email to .

5. Your Rights (Art. 15–22 GDPR)

You have the right to:

  • Access your stored data (Art. 15)
  • Rectification of inaccurate data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection to processing (Art. 21)

Please send requests to:

6. Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with the competent supervisory authority:
Austrian Data Protection Authority (DSB)
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

7. Automated Decision-Making

AI-generated content (tags, categories, location descriptions) is used solely for display purposes and has no legal or similarly significant effects on users (Art. 22 GDPR does not apply).