Privacy policy

Last updated: 8 November 2026

In short

• No account, no ads, no tracking, no analytics, no cookies.
• Your location stays on your device. Our server only receives the map area you are looking at, and does not store it.
• Favourites and settings are kept on your device only.
• Map images come from OpenFreeMap and address search from Nominatim (OpenStreetMap). These services see your IP address.

1. Controller

We have not appointed a data protection officer because we are not required to. If you have questions, just write to the email address above.

2. Scope

This policy covers the web app at www.vegan-map.com and the “Vegan Map” apps for Android and iOS from version 2.

3. Hosting and server logs

The web app and its interface run on a server provided by Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany. Alfahosting processes data on our behalf (Art. 28 GDPR); our email also runs through this provider.

The web server logs each request with a shortened IP address (IPv4 without the last byte, IPv6 only the first three blocks), time, method and path of the request without parameters (so without map area or search term), status code, amount of data and user agent (browser or app and operating system). If an error occurs, the error log also records the full IP address and request. We need these logs to run the service, find errors and fend off attacks (Art. 6(1)(f) GDPR). Both logs are deleted automatically after 7 days.

4. Map images: OpenFreeMap

The app loads map tiles, map style and fonts directly from OpenFreeMap (Hyperknot Software Kft., Hungary). Their servers receive your IP address, the requested tiles (that is, the map area) and the identifier of your browser or the app. According to OpenFreeMap, its access logs contain no IP addresses and are deleted after 7 days. OpenFreeMap may use Cloudflare (Cloudflare, Inc., USA) as a content delivery network; Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission. The legal basis is our legitimate interest in a map without tracking (Art. 6(1)(f) GDPR). More information: openfreemap.org/privacy.

5. Address search: Nominatim

When you search for an address, the app sends your search term directly to Nominatim, the geocoding service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The Foundation receives the search term, your IP address and the identifier of your browser or the app, and stores data in the United Kingdom and the Netherlands. The United Kingdom is covered by an adequacy decision of the European Commission. The legal basis is Art. 6(1)(f) GDPR. More information: osmfoundation.org/wiki/Privacy_Policy.

6. Your location

If you allow it, your device determines your location. The app uses it on the device only, to centre the map on you and to calculate distances. We do not store it.

So that our interface can return the right places, the app sends it the visible map area (corner coordinates and zoom level). When you search by name or city, it may also send a reference point so that results can be sorted by distance. Because the map is often centred on you, this roughly reveals where you are. We use this information only to answer the request, do not store it and do not write it to the logs (section 3).

The legal basis for location access is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings of your device or browser; the map and search work without it.

7. Suggesting places and reporting problems

Suggestions: we store the name, category, diet, address (street, postcode, city, country), the position of the pin and, if provided, the place’s website. These details and your optional note are sent by email to our moderation inbox; we do not store the note in the database. A suggestion is only published once we approve it.

Reports: we store the place concerned, the reason and, if provided, your message, and receive an email about it.

Please do not include personal data in notes and messages. You do not need an account or an email address.

Protection against abuse: up to 5 suggestions and 10 reports per hour are possible. To check this, we store a hash of your IP address created with a secret key (for IPv6 only the /64 prefix), together with the time and type of action. We do not store the IP address itself. These records are deleted after 24 hours.

The legal basis is our legitimate interest in a complete, up-to-date directory and in preventing abuse (Art. 6(1)(f) GDPR). Approved places stay published as long as they exist. We delete rejected suggestions and closed reports after 90 days at the latest, and moderation emails once they have been dealt with.

8. Favourites and settings

The app stores favourites, filters and language on your device only (in the local storage of the browser or the app). So that it also works offline, it may cache program files and the data of your favourites on the device. None of this is sent to us. This is necessary for these functions and does not require consent (Art. 22(2) LSSI-CE). You can delete the data by removing favourites, clearing the site data in your browser or uninstalling the app.

9. No cookies, no tracking

We do not set cookies and do not use analytics, advertising or tracking services, nor embedded content from social networks. There are no user accounts, no profiling and no automated decisions.

10. Directions, websites and sharing

When you ask for directions, open a place’s website or share a place, the app opens your device’s maps app, browser or share sheet. Only then does that provider receive data such as the destination, and its own privacy policy applies.

11. Contact by email

If you write to us, we use your email address and message only to reply to you (Art. 6(1)(f) GDPR) and delete them once the matter is closed, unless we are legally required to keep them.

12. App stores

If you download the app from Apple’s App Store or Google Play, Apple or Google process data such as your account and the download under their own responsibility. We only receive aggregated statistics from them.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to info@vegan-map.com.

You may lodge a complaint with a data protection authority. Our lead authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es. You can also contact the authority where you live.

14. Changes

We update this policy when the app changes. The version published here applies.