Wo Bilder entstehen

Privacy Policy

Last updated: 13/10/2026

1. Controller

baxxstage
Sander Kauschke
Vogelweiderweg 3a
6112 Wattens
Austria
E-Mail:

2. Hosting & Server Logs

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

With every page request, the web server automatically records IP address, timestamp, requested URL and browser identifier (user agent). This data is used solely to ensure operation, for error analysis and to defend against attacks, and is not linked to any other data. Log files are deleted after 30 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

3. Data We Process

Registration & Account
Upon registration, email address, display name and a securely hashed password (bcrypt) are stored. Registration date and last login time are also recorded. This data is required to operate the user account.
Legal basis: Art. 6(1)(b) GDPR (performance of contract)

Spots
Spots created by users contain a name, description and GPS coordinates set via the map view. This content is necessary for the core function of the platform and is displayed publicly.
Legal basis: Art. 6(1)(b) GDPR

Photos
Uploaded photos are linked to the user account and displayed publicly. Before storage, all metadata (EXIF) is removed from the image file. Camera data (manufacturer, model, focal length, exposure, ISO) and the capture date are — if present in the original file — stored separately in the database and displayed on the spot page. GPS coordinates from photo EXIF data are not read.
Legal basis: Art. 6(1)(b) GDPR

Bookmarks & Likes
The assignment of saved spots (bookmarks) and photo likes to the user account is stored in order to provide these functions.
Legal basis: Art. 6(1)(b) GDPR

My Location
If you use the "My location" button on the map, your browser determines your position after asking for your permission. The position is only used in your browser to display it on the map and is not stored on our server.

4. Cookies & Local Storage

Session cookie
A technically necessary session cookie is set for the login function (secure, httponly, samesite=Lax). It contains only a random session ID.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Local storage in your browser
Your privacy settings (uniqspot_consent) and the last map position (mapLat, mapLng, mapZoom) are stored in your browser's local storage. This data never leaves your device.

No tracking or advertising cookies are used; no analytics service is integrated.

5. Google Services (only with your consent)

When you first visit, you can choose in the privacy settings which Google services you want to allow. Without your consent, these services are not loaded. You can change your choice at any time via the "Privacy settings" link at the bottom of the page.
Legal basis: Art. 6(1)(a) GDPR (consent)

Google Maps
For the map view, the Google Maps JavaScript API is loaded. Your browser connects directly to Google servers, transmitting your IP address to Google.

Google AI services (Gemini, Cloud Vision)
The "Find spot by photo" feature and the assistance features during upload (description, tags, categories) send the photo you select server-side to Google Gemini and Google Cloud Vision for analysis.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also be processed by Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework.
Google Privacy Policy

6. Automatic Translation & Tagging

To present published content in other languages and to tag it automatically, spot names, descriptions, photo captions and published photos may be sent server-side to Google Gemini. This only concerns content that is already publicly visible on the platform.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a multilingual, searchable platform)

Other server-side services (Nominatim/OpenStreetMap, Overpass API, OpenTopoData) receive only coordinates and place names — no personal data.

7. Retention Period

Account data is stored until the account is deleted. Deletion can be requested at any time by email to .

8. Your Rights (Art. 15–22 GDPR)

You have the right to:

  • Access your stored data (Art. 15)
  • Rectification of inaccurate data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection to processing (Art. 21)
  • Withdrawal of consent at any time with effect for the future (Art. 7(3)), e.g. via the privacy settings

Please send requests to:

9. Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with the competent supervisory authority:
Austrian Data Protection Authority (DSB)
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

10. Automated Decision-Making

AI-generated content (tags, categories, location descriptions) is used solely for display purposes and has no legal or similarly significant effects on users (Art. 22 GDPR does not apply).