Last updated: 15 October 2026
AddToMap ("we", "the app") provides offline, self-guided audio walking tours. We built the app to need as little of your data as possible. This policy explains what we do and don't collect.
Controller under the GDPR: Anton Tonkushin, Rödelheimer Landstraße 5, 60487 Frankfurt am Main, Germany, [email protected] (see also the Impressum).
With your permission (“While Using the App”), the app uses your location on your device to show where you are on the map, guide you along a tour route and start a stop's story when you arrive — also with the screen locked while a tour's map is open. Your location is not sent to us or stored on our servers. You can use the tours without location, and you can revoke the permission anytime in iOS Settings.
Usage statistics — only with your consent. On the last page of the first start, and at any time in Settings → Share usage statistics, the app asks whether you want to share usage statistics. Only if you agree does it send app events via Google Firebase Analytics (without advertising identifiers): for example that a tour was opened, downloaded or finished, that the purchase screen was shown, and the outcome of a purchase or a restore (product and result — never payment details), together with device model, iOS and app version and coarse region. The events are tied to a random install identifier, not to your name: this is pseudonymous data. You can withdraw your consent at any time in Settings; collection stops at once.
Crash reports. To fix bugs, the app sends crash and error information with device model, iOS and app version and a random identifier via Firebase Crashlytics.
Legal basis: usage statistics — your consent, Art. 6(1)(a) GDPR; crash reports — Art. 6(1)(f) GDPR, our legitimate interest in an app that works. Retention: crash reports 90 days; analytics events at most 14 months (Google's retention setting), then deleted automatically. Neither is used for advertising or tracking.
After a tour the app may ask you to rate it from 1 to 5 stars. Ratings are stored anonymously as a per-tour counter (sum and number of ratings) in Google Firebase Firestore — nothing in them identifies you. If you choose to tell us what could be better, that text (with the rating, the tour, the app language and version — no identifier) is stored in Firestore and forwarded to us through a Cloudflare Worker to a Telegram chat so we can read it quickly. It is never shown in the app or published; please don't include personal data in it. After you rate a tour, whatever the stars, iOS may show Apple's standard App Store review prompt, which is handled entirely by Apple.
Legal basis: Art. 6(1)(f) GDPR (improving the tours) and, for the text you choose to send, your decision to send it. Ratings are kept as counters while the tour is offered; feedback texts are deleted once they have been read and acted on.
Tour files (audio, text, images) are downloaded from our content delivery
network (cdn.addtomap.co, served via Cloudflare). The maps show OpenStreetMap data loaded from
OpenFreeMap (tiles.openfreemap.org); the map of a tour's area is stored on your
phone for offline use. Both servers process standard technical request data (such as IP address) to deliver
the files and protect the service; we do not use it to identify you. Legal basis: Art. 6(1)(b) GDPR —
delivering the tours you asked for — and Art. 6(1)(f) GDPR for security.
addtomap.co is hosted on GitHub Pages and delivered through Cloudflare. When you open it, the servers process technical request data (IP address, time, requested page, browser) to deliver the page and protect it against attacks; the providers keep such logs only briefly. The site uses no cookies, no analytics and no third-party content. Your chosen language and preview voice are saved in your browser's local storage only on your device. Legal basis: Art. 6(1)(f) GDPR.
Paid tours are bought through the App Store. Apple processes the payment as the seller; we never receive your payment details or your Apple ID — the app only learns which tours are unlocked. If you agreed to usage statistics, the app also records that a purchase was started and its result (see above).
Processors working on our behalf:
Other recipients, each responsible for its own processing:
Google, Cloudflare and GitHub may process data in the USA; they are certified under the EU–US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). Feedback relayed to Telegram may be processed outside the EU — please do not include personal data in it.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent to usage statistics at any time in Settings, without affecting what was processed before (Art. 7(3)). As the data is pseudonymous we generally cannot link it to you; you can stop all diagnostics by deleting the app, and you control location in iOS Settings. Write to us for any request.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example in your country of residence. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
The app is not directed at children and does not knowingly collect data from them.
We may update this policy; the "last updated" date reflects the latest version.
Questions about privacy: [email protected]
Data controller: the person named in the Impressum.