The controller for the processing described here is SCAI GmbH, Quettinger Straße 143a, 51381 Leverkusen, Germany, phone +49 2171 776960-0, e-mail admin@frelestray.com. All further details about the provider are given in the legal notice under "Legal".
The service may see the data it needs to answer; it does not keep it. Tours and locations can point to a person even without an account: anyone whose tours always start at their own front door reveals where they live. We therefore treat them as personal data, whether or not there is an account behind them. There is no advertising, no tracking, no third-party analytics and no sharing for advertising purposes. We do not sell data. All connections between your device and our server are encrypted with TLS (HTTPS).
Tour search, planning, editing: your starting point, waypoints and settings are sent to our server and processed for the response. They are not stored and not linked to your IP address. Legal basis: Art. 6(1)(b) GDPR (provision of the requested service).
On-the-way mode (app): When you start navigation and when you use "Back to the route", your current position is sent to our server so it can compute the way to the tour. It is discarded after the response: we do not store your position and we do not keep a sequence of your positions. Progress along the tour is kept only on your device. Legal basis: Art. 6(1)(b) GDPR.
Location on the device: The position itself comes from your device's location service. On devices with Google Play services this is, for navigation, their service, which combines satellites, Wi-Fi, mobile cells and motion sensors; without Play services it is the system's own location. How that service determines the position and which data it transmits to Google is decided by Google on its own responsibility; you set this in your device's location settings. We transmit nothing to it.
Place search and addresses: search terms and coordinates go to our own Nominatim instance on our server. No third party is involved.
Map: map tiles are delivered by our own server. The access log only records that tiles were requested (the path class “/kacheln/*”), not which ones. Which map section you are looking at therefore does not appear next to your IP address (see section 5).
Tour names: to suggest a name for a tour, the following is sent to Amazon Web Services (Amazon Bedrock service; processing takes place in data centres in the EU, Frankfurt region and other EU regions): names from the tour's surroundings (waters, forests, viewpoints, towns and districts — including the place of the starting point) and share values of the tour such as “71 % of the tour quiet”. Coordinates, length, your IP address, your account and your current position are not sent. Amazon Web Services is a processor under Art. 28 GDPR (AWS Data Processing Addendum, which includes the EU Commission's standard contractual clauses for any transfer to third countries). Legal basis: Art. 6(1)(f) GDPR (our interest in understandable tour names).
For the account we store: your e-mail address, a hash of your password (if set), for each sign-in (session) a hash of its token, the kind of application (web, Android or iPhone) and when it started and was last used, your language choice, the time of creation, your saved tours (track, starting point, settings, name and your rating with favourite and stars) and your confirmations of the Terms of Use and of the notice on generated tours (time, checksum of the confirmed version, language read). A sign-in ends after 30 days without use, at the latest 90 days after it started; we then delete it within one day. Under “Signed-in devices” you see your sign-ins and can end any of them. Legal basis: Art. 6(1)(b) GDPR; for the confirmations additionally Art. 6(1)(f) GDPR (proof).
In addition we count your GPX exports: one number per account and day, nothing else — no tour, no coordinate, no timestamp. The counter enforces the limit from section 3 of the Terms of Use, which we derive from the licence terms of the map data (Art. 6(1)(f) GDPR). It is deleted by the day after next at the latest.
Entitlements: for your account we store which entitlements it has, such as Premium, each with its validity (until when, or without expiry) and origin (default for new accounts, assigned by an administrator, or set by us in another way), and every change to them with its time; if an administrator made the change, also the administrator's identifier. Access under Art. 15 lists these records without the administrator, as with the log below. If you are an administrator yourself, your access also lists the entitlements you assigned to or withdrew from other accounts, without the other account; if you delete your account, your identifier is removed from these records. We do not store a price, a payment method or a contract. We delete an expired entitlement 90 days after it ends, and the records of its changes likewise; deleting the account deletes all of it. Legal basis: Art. 6(1)(b) GDPR.
Access from applications you choose: if the feature is enabled for your account, you can also use Frelestray with your account from within an application you have chosen yourself, for example an AI assistant. This application talks to our interface for AI applications (Model Context Protocol, MCP). To do so, you sign in to Frelestray in the application and agree to the access. The application gives us an internet address of its provider as its identifier; when you sign in, our server loads a short document from there that describes the application. We do not transmit any data about you in this retrieval. With every request from the application we check the sign-in and answer your requests only within the scope you have granted: searching for places, tours and car parks, retrieving results, saving and rating tours, listing your saved tours. The application cannot delete or share tours or change your account. It sends us your wishes for the tour, for example a starting point, a length and answers to our questions about the experience. We reply with descriptions of the tours found: length, walking time, scores, notes on the paths and the names of sights and places to eat with their position along the tour, but without the course of the tour; the only coordinate in them is the starting point the application named. For places and car parks we give names and coordinates, for car parks also the distance. From “My tours” we give the name, length, walking time, score, rating, favourite and the date it was created, but no starting points and no waypoints. We neither choose nor engage the provider of the application. From the request we cannot reliably tell who operates the application, where it or you are located, or what the results are used for there. Whether and how the application processes the results further depends on how it works and on the information from its provider. We store the sign-in (the application's identifier, when it was created and last used, and when it ends) and its access keys only as a check value. The sign-in is listed under “Signed-in devices”. It ends after 90 days at most, earlier if you end it there, choose “Sign out all others” or change your password. Once it has ended, we delete it together with its keys within one hour at the latest. Search results that you request through the application stay in your account for 24 hours so that you can save them, and are then deleted. An access request under Art. 15 lists the sign-ins and the search results. Legal basis: Art. 6(1)(b) GDPR (you request the retrieval yourself).
Voice control: with Premium you can operate the app with a sentence, typed or spoken. Your device turns speech into text itself; the recording never leaves the device. The app sends a typed sentence when you tap “Send”. It sends a spoken sentence by itself 2 seconds after recognition ends. If you tap into the field before then, the sentence is only sent with “Send”; if you tap the cross, it is not sent at all. We send the sentence, together with a state of the app (for example which view is open, your settings for the tour, the tours shown and your saved tours with name and rating; during navigation only whether it is the way back, whether you are signed in, whether the tour has an elevation profile and what kind of place comes next), to a language model that we run ourselves on our own server. The server is located in the data centre of Hetzner Online GmbH in Helsinki, Finland; the connection from our server to it is encrypted. No other provider receives your sentence. The model evaluates the text and can then call Frelestray functions: searching for places, choosing the settings for a search (the app then starts the search, as with “Find a tour”), retrieving car parks, saving and rating tours, listing your saved tours. We pass what these functions return back to the model so that it can choose the next step. This can include some or all of the data you have stored in Frelestray or that we keep for your account, including information about places and positions: for example the names of places, car parks and sights near your starting point or your position and how far away they are, or names you have given your tours. With every sentence outside navigation the app sends the starting point you set to our server and, if it has your position, that too. None of these coordinates goes to the model. During navigation the app sends neither the starting point nor your position; a sentence there needs no location. Whether navigation is paused and whether announcements are on is known only to our server, not to the model. Your position serves as the starting point when you say something like “from here” or have not set a starting point. The app carries out the steps the model chooses. During navigation the model calls none of these functions; it only chooses steps of the app, such as pause, announcements, turning around or a question about the rest of the tour, and the app answers them from its own figures on the device. A search that comes about this way runs like any other search in the app (section 2) and is not stored. The app treats the settings the sentence changes like your own input (section 4). We do not store the sentence or the model's replies, not on the model's server either; our log only counts the calls (time, duration, purpose, size in tokens) and is deleted after 90 days. For voice control the app creates a sign-in that is tied to your session and ends with it; it is not listed under “Signed-in devices”, but it is included in an access request under Art. 15. Hetzner is a processor under Art. 28 GDPR (see section 6). Legal basis: Art. 6(1)(b) GDPR.
If you share a saved tour, the service creates a link with a random identifier that has no connection to your account. Whoever opens the link does not see your saved tour but an obscured view: the tour is missing within at least 300 metres of your starting point and of your destination — also in the GPX file a recipient downloads. For a loop this is the same place, and the view starts the loop at a different point. The gap applies to the whole line, not only to individual points. How much more is missing at each edge of a gap is random for each tour. This makes it harder to calculate the start or the destination back from the edges; we cannot rule it out entirely. If you share several tours from the same starting point, a recipient can infer the area from the gaps. Your saved tour itself stays unchanged. You can revoke the links to a tour at any time; deleting the tour or the account invalidates them. GPX downloads via a shared link are counted per link and day (one number, nothing else). Legal basis: Art. 6(1)(b) GDPR.
If you request access under Art. 15, we store the timestamps of that request (requested, compiled, notified, downloaded) and, until you download it or for at most 30 days, the compiled file itself. The timestamps remain as evidence that we complied with the request (Art. 5(2) GDPR); they are deleted together with the account.
If an administrator changes your account – creates, blocks or unblocks it, assigns or withdraws roles or entitlements, sends a confirmation or sign-in link or deletes it – we record this in a separate log: the time, the kind of change, the identifier of your account and the identifier of the administrator. This lets us trace who changed what, even if an administrator account was misused. If you are an administrator yourself, the same applies to your changes to other accounts and to an incident you record. Only administrators can read the log. Each entry is deleted after 90 days, even if the account was deleted earlier. Access under Art. 15 lists the entries about your account without naming the other account involved. Legal basis: Art. 6(1)(f) GDPR (our interest in protecting the service and the accounts against misuse).
Registration involves a confirmation procedure: your e-mail address is held in our process engine for at most 72 hours: you have 48 hours to confirm the link, and after 72 hours the procedure ends in any case. It is then deleted within seven days. Account messages are sent by e-mail via Amazon Web Services (Amazon SES service, processing in the Frankfurt region): confirmation, login and password links, the message after a password change, and a notice when someone tries to register with your address although an account already exists for it. The same route carries the message that a report under Art. 15 is ready to collect. What is transmitted is your e-mail address and the content of exactly these messages — no tours, no starting points, no coordinates. Amazon Web Services is a processor under Art. 28 GDPR (AWS Data Processing Addendum, which includes the EU Commission's standard contractual clauses for any transfer to third countries). Legal basis: Art. 6(1)(b) GDPR for the account e-mails, Art. 6(1)(c) GDPR for the notification about the report. To prevent abuse, an address receives a link or a registration notice at most three times per hour; for this the service keeps the address only in working memory, not in the database and not in the log. Once the hour is over, it removes the address with the next such message, at the latest at the next restart (Art. 6(1)(f) GDPR).
Retention: until you delete the account. "Delete account" removes all account data immediately; only the entries in the log of changes made by administrators remain until their 90 days are over. Backups are deleted within 30 days at the latest. We use backups solely to restore operation. If we have to restore a backup, we immediately afterwards delete again those accounts and tours whose deletion you have already requested; for that we keep the identifier of the deleted entry and the time until the 30 days have elapsed, and nothing else (Art. 6(1)(c) GDPR). We protect and delete this note in the same way as the backups themselves.
The web interface stores your settings, language choice, session and confirmations in the browser (localStorage). The app stores the same on the device, plus the current tour for navigation without a network. This storage is necessary for the service (Section 25(2) TDDDG); there are no cookies for tracking purposes.
The app uses your location for two things: the starting point and navigation. If you have allowed it, the app sets the starting point to your position when you open it and when you tap "My position"; for this it reads your position once. You start navigation yourself; it then keeps running even while the screen is off or you are using another app. "End" stops location use. The app tracks your location continuously only during navigation. Where the position comes from is described in section 2. The app uses the microphone only for voice control and only while you tap it; recognition runs on the device.
Display outside the app: During navigation the app also shows the next instruction on the lock screen: an arrow, the distance, the instruction text with the name of the path or street, and the remaining distance and time. On Android this appears in the notification "Ongoing tour". While the screen is off, a second one, "Turn alerts", is added before a turn. On the iPhone it appears as a Live Activity on the lock screen and in the Dynamic Island. If a watch is paired, the operating system passes this display on to it: Android passes on the turn alerts, the iPhone passes the Live Activity to an Apple Watch (from iOS 18 and watchOS 11). If you wish, the iPhone also shows the instructions as a notification (switch "Turn alerts as notifications" in the app's settings, off by default); the companion app of a watch from another maker can pass this notification on to the watch. We transmit nothing in the process, neither to our server nor to third parties. How the display reaches the watch and what your watch's app does with it is up to the makers of the phone and the watch. For watches with Wear OS, Google's Terms of Service apply (https://policies.google.com/terms). You can switch this off on Android in the app's settings under "Notifications", category "Turn alerts", and on the iPhone in the app's iOS settings under "Live Activities", and the notification with the switch in the app. Navigation keeps running in both cases. Notifications and the Live Activity serve only the running navigation.
When it loads, the web interface asks your browser for your location in order to show the map there. Whether it gets it is up to you in the browser's prompt; without permission the map shows a fixed area. The position stays in the browser: it only moves the map view, does not set a starting point and is not sent to our service. The map then loads the tiles for that area from our server, as for any other view; the log contains no tile coordinates (section 5). Where the browser gets the position from is up to the browser; some browsers ask a location service run by their maker.
For every request our servers log your IP address, the time, the kind of request, the response status and the duration. The kind of request is the method and a path class, such as “map tiles” or “tour search”: without tile coordinates, without the identifiers of individual tours or shared links and without the contents of the request. In the case of technical errors, your IP address may appear in an error log together with the error message and the failed request, including its path. The same retention period applies to that log. The purpose is preventing abuse and troubleshooting (Art. 6(1)(f) GDPR). We delete these logs at the latest 14 days after the entry, including all copies; they are not part of our backups.
The service also counts how often its functions are used and how long requests take, for example how many tours were searched per hour and with which desired length. Only totals across all users are stored, without IP address, without account and without location; no single request can be traced back to a person from them. The figures stay on our own server; no third party receives them. The purpose is to run the service reliably and to improve it (Art. 6(1)(f) GDPR). We delete them after 400 days.
Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server and backups are located in Falkenstein, Germany, the server of the language model for voice control in Helsinki, Finland; no transfer to third countries. Processor under a contract pursuant to Art. 28 GDPR. E-mail delivery: Amazon Web Services EMEA SARL, Luxembourg (Amazon SES, processing in the Frankfurt region), processor (see section 3). Language model for tour names: Amazon Web Services EMEA SARL, Luxembourg (Amazon Bedrock, processing in EU regions), processor (see section 2). Applications you connect to your account yourself (section 3): we neither choose nor engage their provider; what they receive from us, you retrieve yourself through the application.
Public authorities receive data only where we are legally obliged to disclose it.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) (Art. 21). You delete your account and tours yourself in the interface; you export tours as GPX. You request access under Art. 15 while signed in, in the "Account" area: you receive a file with all data stored for your account, for download in the interface; an e-mail tells you when it is ready. For anything else, write to the e-mail address given above. You may lodge a complaint with a data protection supervisory authority, for example the one responsible for your place of residence. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, www.ldi.nrw.de). Our data protection officer is IITR Datenschutz GmbH, Marienplatz 2, 80331 Munich, Germany, phone +49 89 1891 7360; you may also contact them directly.
If you suspect a personal data breach, you can report it in the interface under “Legal” — also without an account. If you voluntarily provide an e-mail address for follow-up questions, it is stored only within this case and deleted at the latest seven days after the case is closed; the case itself ends after 90 days at the latest; without an address we can neither ask back nor reply. If you report while signed in, we reply to your account's address. We review every report under Art. 33 and 34 GDPR; the permanent documentation of an incident contains no details about the reporting person. Legal basis: Art. 6(1)(c) GDPR (Art. 33), for the voluntary contact detail point (a).
There is no automated decision-making within the meaning of Art. 22 GDPR. Only persons aged 16 or over may create an account.