Privacy policy

Last updated: 03.10.2026

1. Controller

The controller for data processing on this website and in the TripPhoto app is:

Michael Grewelding
Michael-Erhard-Straße 66
77855 Achern-Oberachern, Germany
michael@grewelding.com · +49 (0)7841 6655-919

2. Principle

TripPhoto uses no advertising or analytics tools. There is no tracking, no reach measurement and no sharing with advertising networks. Fonts, icons and program code are served from our own server, as are images of sights. Your browser loads only map tiles, country flags and the program libraries of a few additional features directly (all listed in section 5). The cookie notice only asks about convenience settings and embedded videos (section 9); without your consent the website stores nothing apart from the technically necessary session and your choice in the notice.

3. What data is processed

• Account: Email address, display name, hashed password, chosen language and units, plan, and your entitlements (Pro) with their origin and term. Optionally: profile picture, two-factor secret, passkeys, postal address.
• Photos and their metadata: The image file itself plus data read from EXIF: capture time, time zone, GPS coordinates, altitude, camera, lens, exposure values. If the image lacks time or place – for example photos you take in the app – we take the capture time from the device and the place from the device or from your running recording of that trip.
• Location and movement data: If you start recording in the app: coordinates, time, accuracy, speed, altitude and heading – including while the app runs in the background. This forms a movement profile of your trip. Recording only ever starts on your instruction and can be stopped at any time.
• Device sensor data: During a recording, additionally and only if your device provides them: the movement type detected by the operating system (stationary, walking, cycling, in a vehicle), air pressure and barometric altitude, steps and floors. They improve transport detection and the elevation profile. The operating system asks separately for permission; without it recording still works, just less precisely.
• Stays: During a recording, iOS reports places where you stayed for a while. They remain on the device at first and are suggested to you as waypoints after the trip. They are only stored once you accept them.
• Your own input: Trip titles, descriptions, notes, waypoints, ratings (including the stars you give a sight after a stop), comments, equipment, trip plans, a trip's checklist, which trip belongs to which plan, and optionally a home location.
• Imported files: Positions, times, altitudes and names are taken from uploaded GPX, KML, GeoJSON or CSV files. The file itself is not stored permanently.
• Context per photo and origin of points: From a photo's capture time and place our server calculates the light phase (e.g. golden hour), the sun's position, the trip day and the weather at that moment, and stores them with the photo. For each track point we store where it came from: iPhone, CarPlay, hands-free system, website or import – with no details about the vehicle. Only you see both, under your trip's “Data & sources”.
• Photo selection on the iPhone: When the app suggests the best of many photos, the iPhone itself rates similarity, sharpness and brightness of the images (Apple Vision, from iOS 18 also the overall image quality). No image is sent to us or any other service for this, and the ratings are not stored. Only what you then select is uploaded.
• “Nearby”: When you tap “Nearby” in the app, it sends your current location once to our server, which looks up sights and your saved places around it. The location is only used for this, not stored.
• Day texts and title suggestions (Apple Intelligence): On iPhones with Apple Intelligence the app can write day texts and suggest trip titles. The language model runs on the iPhone itself; for this the app loads the facts of your trip (distance, places, number of photos) from our server. Neither we nor any AI service receive the trip for writing. We store the written texts with the trip so they also appear on the website; you can edit or delete them.
• Corrections to automatic detection: When you change a detected mode of transport, move a photo or change a capture time, we store WHAT was changed (e.g. “bike → car”) with speed, duration, length and the iPhone’s motion type – but without location and without time of day. We evaluate this in aggregate to improve detection. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). It is deleted with your account and included in your data export.
• Health data (sport mode, Apple Watch): If you switch on sport mode on the Apple Watch, the watch measures your heart rate and saves the workout to Apple Health. TripPhoto NEITHER stores NOR transmits these values: they only leave your watch towards Apple Health and reach neither the iPhone nor our server. We therefore do not process health data within the meaning of Art. 9 GDPR. Sport mode is a separate button; if you never press it, you are never asked about Health.
• Adding from Apple Health and journaling suggestions: If you forgot to record, the app can add a trip on request. With your permission it reads only workouts and their routes from Apple Health (no heart rate or other health values). From Apple’s journaling suggestions it receives only the suggestion you pick yourself (places, photos, workouts of that day). Only what you accept is transmitted: route points and mode of transport of the chosen workouts, the places as waypoints and the chosen photos – just like a normal recording. We use data from Apple Health for nothing else, do not share it and do not use it for advertising. You can revoke the permission at any time in the iOS settings under Health.
• Means of transport with Apple Health (optional): If you turn on “Apple Health for transport” in the app profile, the app reads workouts, steps and heart rate from Apple Health for the period of a drive, with your permission – for example from an Oura Ring or Apple Watch. These values are evaluated on your iPhone only; they are neither stored nor transmitted. Only the result reaches our server: the means of transport (e.g. bicycle, on foot) for each time segment of your recording. We therefore do not process health data within the meaning of Art. 9 GDPR. You can turn it off at any time in the profile and revoke the permission in the iOS settings under Health.
• Reports and blocks: If you report a comment or a trip we store: who reported, what was reported, the chosen reason, the time and a copy of the reported text. The copy is needed because the content may be deleted before anyone reviews the report. If you block someone we store only the pair of identifiers and the time – the blocked person is not told. The legal basis is our legitimate interest in a service free of harassment. If you delete your account, your blocks and the reports you filed go with it.
• Following: If you follow someone we store the pair of identifiers and the time. When that person makes a trip public you get a notice once on the website and – if you allowed push notifications – on your iPhone. Only public trips are announced, never private ones or trips shared by link. The person you follow only sees how many people follow them – not who. The legal basis is the performance of the user agreement: you chose to follow. You can stop at any time in your profile; if either of you blocks the other it ends automatically, and it is removed when you delete your account.
• Last sign-in: On every sign-in (website or app) we store the time, the channel and an approximate location (city and country). The location is derived from the IP address on our own server using the "IP to City Lite" database by DB-IP; the IP address is not sent to anyone and is not stored. There is no history – each sign-in replaces the previous one. You can see it yourself under Settings ▸ Sign-in & security; the operator sees it in user administration. The purpose is to detect sign-ins by someone else: if you sign in from a different country than last time, you receive an email (at most one a day). It is deleted together with the account.
• Notifications to the operator: The operator receives an email when someone registers (email address, name, sign-up channel), when a trip is created or made public (title, number of photos) and when content is reported. For a deleted account only figures, without the email address. The purpose is operating and moderating the platform.
• Server logs: On each request the host logs IP address, time, requested address, browser and amount of data transferred. This serves operation and defence against attacks.
• Protection against attack scanners: If someone requests addresses that do not exist here and are only probed by automated attack tools (such as /wp-admin/ or /xmlrpc.php), we store a keyed hash of the IP address (not the address itself) with the time. After three such requests within ten minutes, that IP address is refused for 24 hours. The entry is deleted 24 hours after the last request. Signed-in users and the app are exempt.
• Error log: Occasionally – for example during a disruption or when you report a problem – we log which page or app feature was called, when, with what result and how long it took, plus actions (e.g. "photos uploaded: 5") and errors that occurred. In the app this also covers whether a command from the Apple Watch, from Siri or from a widget arrived, and whether the iPhone connected to a car's hands-free system – with no details about the vehicle. We store your user number and a shortened session identifier; no IP address, no content, no locations and no search terms. The log stays on our server, only the operator can see it, and it is deleted after 14 days. You can object under Settings ▸ Your data; you will then never be logged.

4. Purposes and legal bases

• Account, trips, photos, recordings and every analysis derived from them: to perform the user agreement, Art. 6(1)(b) GDPR.
• Server logs, error log, last sign-in, protection against misuse and attack scanners, technical stability, anonymous statistics across many travellers (section 8): legitimate interest, Art. 6(1)(f) GDPR. You can object to the error log and the anonymous statistics at any time.
• Publishing a trip, push notifications, signing in via Google, Apple or Facebook: your consent, Art. 6(1)(a) GDPR – revocable at any time.

5. Services contacted during operation

To make maps, places, routes and weather work, TripPhoto calls external services. Only the necessary information is transmitted – for server-side requests just coordinates, not your IP address. Where your browser loads directly, this is noted explicitly.

• OpenStreetMap Foundation (United Kingdom) — Map tiles (your browser loads them directly, transmitting your IP address), place lookup via Nominatim and Overpass (server-side, coordinates only).
• Additional map layers — Only if you choose a different view or an extra layer on a map does your browser load tiles directly from that provider, transmitting your IP address: OpenTopoMap (terrain, Germany), CyclOSM (cycling, France), Waymarked Trails (hiking and cycling routes, Germany), OpenRailwayMap (railways) and OpenSeaMap (nautical chart, Germany).
• LocationIQ (Canada/EU data centre) — Place lookup, server-side, coordinates only. Since 17 September 2026 the first service we ask, because Nominatim permanently throttles our shared server address; if it does not answer, we ask Nominatim.
• Geoapify (Germany, EU data centres) — Place lookup and search, server-side, coordinates or search text only. Used when another service does not answer or its daily quota is used up.
• Apple Maps (USA) — Place search in the planner, server-side, only the typed search text and the approximate area.
• Photon / komoot (Germany) — Place suggestions while typing in the planner, server-side, only the typed text and the approximate area. We do not send photo coordinates to Photon.
• GeoNames — Population figures and place names from a local file on our server; nothing is requested.
• FOSSGIS e.V. (routing.openstreetmap.de, valhalla1.openstreetmap.de, Germany), BRouter (brouter.de), openrouteservice / HeiGIT (Heidelberg University, Germany) and, as a last resort, OSRM (router.project-osrm.org) — Road, cycling and walking route calculation, server-side, coordinates only. Which service answers depends on availability.
• Overpass-API (overpass-api.de, overpass.openstreetmap.fr, overpass.kumi.systems, overpass.private.coffee) — Railway lines, traffic lights, path names, surfaces, passes and places from OpenStreetMap data, server-side, coordinates or map areas only.
• Open-Meteo (Germany) — Weather at capture time, server-side, coordinates and time only.
• MET Norway (Norway), National Weather Service (USA) and Deutscher Wetterdienst via Bright Sky (Germany) — Weather forecast for planned stops and photo stops and weather at capture or trip time, server-side, only coordinates rounded to about one kilometre (trip weather: 0.1°) and time. Home zone and private or hidden photos are excluded. Which service answers depends on place and availability; the source used is shown with the weather figures.
• Apple WeatherKit (USA) — Weather forecast for planned photo stops in the planner (“photo forecast”), server-side, rounded coordinates only. We keep the answer per area for at most one hour.
• Wikimedia Foundation (USA) — Background information about places from Wikipedia and Wikidata, server-side. Images of sights come from Wikimedia Commons; our server fetches each image once and then serves it itself. Your browser does not contact Wikimedia.
• Mapillary (Meta Platforms, USA) — Open street-level images for a trip's street film. They are fetched server-side using the route's coordinates; the images reach you via our server, your browser does not contact Mapillary.
• jsDelivr, Cloudflare (CDN) — Program libraries for a few additional features: 3D terrain, converting HEIC photos on upload, the QR code when setting up two-factor sign-in, and sorting planner stops. Your browser only loads them when you use the feature, transmitting your IP address.
• Amazon Web Services (USA) — Openly available elevation data (Terrain Tiles) for 3D terrain; your browser loads them directly, but only when you open the 3D view, transmitting your IP address.
• flagcdn.com — Small country flags in lists and the atlas; your browser loads them directly, transmitting your IP address.
• Apple (USA) — Push notifications to iPhones (APNs) and, if chosen, “Sign in with Apple”. In the app, also operating-system features that only work between your own devices: Handoff passes the address of the trip currently open to a Mac or iPad on the same Apple ID; iPhone search (Spotlight) receives the title and photo count of your trips and keeps them on the device. This search index is deleted when you sign out.
• Place lookup on the device (Apple) — While recording, the app asks the operating system what the area you are in is called – city or region only, no street name. iOS answers via Apple’s map service, transmitting the coordinates to Apple, without your name and without any link to your account. We ask sparingly: at the earliest after two kilometres or three minutes. The name is only used for display on the lock screen and in the widget, is not stored and is not sent to our server. Without a connection the line stays empty.
• Google (USA) — Only if chosen: sign in with Google. Fonts are NOT loaded from Google but from our own server.
• Meta/Facebook (USA) — Only if chosen: sign in with Facebook.
• YouTube (USA) — Only if you add a video to a trip. Embedded in privacy-enhanced mode (youtube-nocookie.com).

6. Processing on our behalf and transfers to third countries

The website runs at Strato AG, Pascalstraße 10, 10587 Berlin, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Strato; the servers are located in Germany.

Apple, Google, Meta and Amazon are based in the USA, as is Cloudflare. A transfer to Apple, Google or Meta only takes place if you enable push notifications or sign in via one of these providers; Amazon and the content delivery networks only receive your IP address when you use one of the additional features named above. These companies are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Wikimedia, Mapillary and Apple WeatherKit only receive requests from our server (images, coordinates), no information about you.

7. Visibility of your content

Trips are private to begin with. You decide per trip: private, reachable via link only, or public. A trip that is “reachable via link only” can only be opened through that link – including for signed-in users. Only public trips appear in the Discover overview and in search engines. A photo spot only appears there once at least three different people have taken public photos at that place. Individual photos can additionally be marked private, or have their GPS or EXIF data hidden. Private photos are only visible to the trip's owner – people you share a trip with do not see them either. Photos with hidden GPS data are not used for photo spots. Wherever others view a trip, private photos and private waypoints are missing, and photos with hidden GPS data have no coordinates. Images from private trips and private photos are kept outside the public web folder; their addresses are signed and expire after two days at the latest. If you set a trip to “private”, image addresses from it that were passed on earlier stop working.

8. Anonymous statistics across many travellers

Some information on sights and in the planner is derived from the data of many travellers. It only appears once at least three different people have contributed, and it never names a person, a trip or a single point in time:

• Typical time spent at a sight – from the detected stops of recorded trips (median); hidden stops do not count.
• Stars of a sight – average of the ratings given after a stop; only the latest per person counts. Text never goes into it.
• “Travellers also visit …” in the planner – which sights people plan together or visit on the same trip. A stop you hide on your trip does not count; sample routes never count.
• Most popular photo time and photo spot – only from photos that are not hidden anyway (not private, location not hidden, trip not private). The photo spot is the centre of a grid cell of about 30 metres in which at least three people took photos – never the position of a single photo. Many pictures by one person at the same time count once.

For the first three, stops from private trips are also taken into account – only the aggregated result becomes visible. The legal basis is our legitimate interest in giving travellers reliable information about places (Art. 6(1)(f) GDPR). You can object: with the switch “Do not include my trips in statistics” under Settings ▸ Your data, your trips are left out of all statistics named here and of photo spots. If you delete a trip or your account, your contributions drop out at the next recalculation.

9. Cookies and local storage

Technically necessary and always active are the session cookie that keeps you signed in (it contains no personal content and expires on sign-out or when the browser closes) and the “tp_einwilligung” cookie, which stores your choice in the cookie notice for 12 months (legal basis § 25(2) no. 2 TDDDG). If you choose “Stay signed in” when signing in, we also set the “tp_angemeldet” cookie for 30 days; it holds a random identifier, we only keep its check value, and it is deleted when you sign out, change your password or it expires (at your request, § 25(2) no. 2 TDDDG). Only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) does the website remember display settings such as light/dark, sorting or the ticks of the trip checklist in your browser’s local storage – they never leave your device – and load embedded YouTube videos directly. Without consent videos show a placeholder and you can load each one individually. We set no advertising, analytics or tracking cookies. You can change or withdraw your consent at any time via “Cookie settings” in the footer; anything already stored is deleted. The app stores settings and not-yet-uploaded track points locally on your device. For the widgets on the home and lock screen it also writes a small file into a shared folder of the app: the state of the current recording, a rough line of the trip, kilometres per month and – if you picked a planned route – its stops; the app also keeps the plan of the current trip ready for use without a connection. The file stays on the device, is emptied when you sign out and is readable only by the app and its widgets.

Open cookie settings

10. Retention

Your content is stored as long as your account exists. If you delete a trip, a photo or an import, the associated data is removed. If you delete your account, the account, trips, photos, recordings, uploaded files, invitations you sent and reports about your content are deleted completely and immediately – this cannot be undone. We send you one last email as confirmation. The error log is deleted after 14 days. The host's server logs are deleted according to its own periods. Caches for places, weather and routes expire automatically.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with effect for the future.

You can download your data yourself – as an archive with all trips, photos and GPX files or as JSON – and delete your account with all content yourself: both in the website settings under “Your data”, deletion also in the app profile. For anything else, an email to michael@grewelding.com.

12. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

13. No automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. Analyses such as milestones, statistics, the photo score, the photo forecast or the suggested photo selection are suggestions for your own view and have no legal effect.

Imprint →