Privacy Policy
Last updated: 10 October 2026
This Privacy Policy explains how Enrico Leonardo Berardone ("we", "us") processes your personal data when you use the HiddenSteps mobile app (iOS and Android), visit hiddensteps.app or sign up for a HiddenSteps event. We comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Controller
Enrico Leonardo Berardone, Lange Straße 52, 72525 Münsingen, Germany — enrico@hiddensteps.app. There is no statutory obligation to appoint a Data Protection Officer.
2. The HiddenSteps app
Account and profile. When you start the app, an anonymous account is created so your saved and visited spots can be stored. If you register, we process your email address and password (stored only in encrypted form by our authentication provider). Optionally you can add a display name, profile photo, a short "About you" text and your interests.
Your activity in the app. Spots you save, mark as visited, favourite or mark as not interested, your selected cities and filter preferences – needed to show your personal map and progress.
Content you create. Spots you suggest (title, description, location, photos), photos you upload, feature requests and comments. Suggested spots are reviewed by us before they become public. Public content can be seen by other users together with your display name.
Chat messages. If you use the chat, we store your messages so they can be delivered to the other person. You can report and block other users.
Location. With your permission the app uses your device's precise location to show spots near you and the distance to them. If you turn on nearby notifications, the app uses location in the background ("Always" permission) to notify you when you walk past a spot. This geofencing runs on your device; we do not store a history of your location on our servers. If you have granted location access, the app also stores the city you last opened it in (city, country and time – no coordinates) in your account. Each new value replaces the previous one, so no history is kept. We use it to send notifications relevant to a city, e.g. to people recently in a city where new spots are available. When you add a spot, its coordinates are stored with the spot. You can withdraw location access at any time in your device settings.
Camera and photos. Used only when you take or choose a photo (e.g. for a spot or your profile picture).
Push notifications. If you allow notifications, we store a push token for your device to send you notifications: new chat messages, nearby spots, a confirmation when a spot you suggested is approved, and occasional news about HiddenSteps (e.g. a new city). News can be sent to all users or only to users recently in a certain city (see "Location"). You can turn notifications off at any time in your device settings; on Android you can mute "News & updates" separately.
AI features. Some features use AI: automatic translation of texts and reading opening hours from a photo you take. For this, the text or photo is sent to an AI provider and is not used to identify you.
Usage analytics. We use Mixpanel to understand how the app is used (e.g. which screens are opened and which buttons are tapped) and to improve it. Data is linked to a random user ID, processed on Mixpanel's EU servers and not used for advertising or tracking across other apps.
Legal basis. Providing the app and its features – Art. 6(1)(b) GDPR (contract). Location, camera, photos and notifications (including city-based news) – your consent via the device permission, Art. 6(1)(a) GDPR. Analytics, security and moderation of user content – Art. 6(1)(f) GDPR (legitimate interest in improving and protecting the app); you can object at any time.
Deleting your account. You can delete your account at any time in the app under Profile → Settings → Delete account. Your account, profile, saved spots, chats and interests are then deleted permanently. You can also request deletion by email.
Service providers for the app (processors).
- Google Firebase (Google Ireland Ltd.) – login, database, file storage, server functions. Data is stored in the EU (Frankfurt).
- Mixpanel Inc. – usage analytics, EU data residency.
- Expo / 650 Industries Inc. (USA) – delivery of push notifications and app updates.
- OpenRouter Inc. (USA) and the AI models it forwards to (Google Gemini, DeepSeek) – translation and photo analysis.
- Apple (Apple Maps) on iOS and Google (Google Maps) on Android – map display.
- Wikimedia Commons – some spot photos are loaded from Wikimedia; your device's IP address is transmitted to Wikimedia when they are shown.
3. Website and events
Landing page signup: email address and language preference. Event signup form: first name, joining situation (solo / partner / friend / family), group composition, activity preferences and prioritisation, day budget, accommodation status (and an approximate map pin if you place one), allergies and free-text notes, email address, WhatsApp phone number, consent to these terms, language. Server logs: when you visit the site, our hosting provider automatically processes technical data such as IP address, user agent and timestamps for security and stability purposes (legitimate interest, Art. 6(1)(f) GDPR).
4. Why we process it & legal basis
Performing the registration and organising the event you signed up for — Art. 6(1)(b) GDPR (pre-contractual / contractual measures). Sending you event-related information by email or WhatsApp — Art. 6(1)(b) GDPR for transactional messages and Art. 6(1)(a) GDPR (your consent) for the WhatsApp Community invitation. Photos taken at the event — Art. 6(1)(f) GDPR (legitimate interest in documenting the event); you can object at any time. Compliance with legal obligations — Art. 6(1)(c) GDPR.
5. Hosting & backend (processor)
The website and our database run on Lovable Cloud, which is powered by Supabase (Supabase Inc., infrastructure hosted in the EU). A Data Processing Agreement (DPA) under Art. 28 GDPR is in place. Data is stored on EU servers.
6. WhatsApp Community
After your registration we may invite you to a WhatsApp Community to coordinate the event. Joining is voluntary and based on your consent. The service is operated by WhatsApp Ireland Limited, part of the Meta group. By joining, your phone number and any messages you send become visible to WhatsApp and to other members of the community according to WhatsApp's settings. See WhatsApp's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea. You can leave the community at any time.
7. Email
We currently send transactional emails (registration confirmation, event updates) manually or via a standard email-sending service. If we add a dedicated provider (e.g. Resend, Mailchimp), we will update this policy and ensure a DPA and — where applicable — EU Standard Contractual Clauses are in place.
8. Analytics & cookies
Website: We currently do not use any third-party analytics or tracking tools on hiddensteps.app and only set cookies that are strictly necessary for the site to function. App: The app uses Mixpanel for usage analytics as described in section 2. The app does not use advertising or cross-app tracking.
9. Recipients & transfers outside the EU
Personal data is not sold and not shared with third parties for their own purposes. The only recipients are processors acting on our instructions (hosting, email delivery, WhatsApp and the app service providers listed in section 2). Where possible, data is processed within the EU/EEA. Some providers are located in the USA (e.g. Expo, OpenRouter, Mixpanel, Google, Meta/WhatsApp). Transfers are based on the EU-U.S. Data Privacy Framework where the provider is certified, or on EU Standard Contractual Clauses.
10. Retention
Signup data is kept until 12 months after the event for follow-up communication and legal documentation, then deleted, unless a longer retention is required by law (e.g. tax law, up to 10 years where applicable). You can request earlier deletion at any time. App data is stored as long as your account exists and is deleted when you delete your account.
11. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3)). To exercise your rights, contact enrico@hiddensteps.app.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our location is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, Germany.
13. Children
The app is not intended for children under 16.
14. Changes to this policy
We may update this Privacy Policy when our processing changes. The version date above always reflects the current version.