Privacy statement

A translation, offered for convenience. The German version is the binding one.

Controller

Klaus Bechtold
Steinstr. 19
12169 Berlin
Germany

Contact

This website

This is a plain, static information page. It sets no cookies, embeds no third-party fonts, scripts or analytics, and does no tracking. Every file, the fonts included, is served from this server; opening the page contacts no one else.

One single entry is stored on your device: when you choose between “Light” and “Dark” at the top right, the browser remembers that choice under the name ovarlay-theme in local storage. What is stored is the word light or dark and nothing else. It never leaves your device, is never evaluated, and serves only to show the page the way you set it. Until you choose, nothing is stored and the page follows your device's own setting. You can remove it at any time by clearing this site's data in your browser.

For technical reasons the web server records the usual server log files that your browser sends when the page is opened: IP address, date and time of the request, the page requested, the browser used. These serve the technical security and stability of the server alone (Art. 6(1)(f) GDPR, legitimate interest) and are not combined with any other data.

The OvARlay app

While playing

Your position does not leave the device. OvARlay has no account, no sign-in and no server of its own. Where you are standing, which targets you have found and how your rounds ended stays on your phone.

There is one exception, and it concerns the map itself. Maps you photographed or drew live entirely on the device — playing them makes no network request at all. Maps cut from a section of a live map are drawn from map data that comes from a map provider. The app downloads the chosen section when the map is created or imported so that it works without a signal; anything missing — after the app's data has been cleared, say, or when zooming out beyond the stored area — is fetched.

Such requests do not contain your location. They contain the number of the map tile requested; as with any request on the internet, your connection's IP address is involved. The provider can infer which section of the map is being looked at — not where within it you are. The legal basis is Art. 6(1)(f) GDPR (the legitimate interest in being able to display a map).

Map providers

Which provider is asked depends on the map style the author chose when creating the map:

OpenFreeMap — the default. Map data from OpenStreetMap, rendering by OpenMapTiles. The service states that it keeps anonymised logs without IP addresses and stores IP addresses only temporarily (at most 30 days) in the event of a security incident. Cloudflare may be used as a content delivery network. OpenFreeMap's privacy statement
OpenStreetMap — the tile servers of the OpenStreetMap project. The OpenStreetMap Foundation's privacy policy
Mapbox (Mapbox Inc., USA) — only if that style was chosen explicitly. The transfer to the USA rests on the European Commission's standard contractual clauses as provided by Mapbox. Mapbox's privacy statement

While creating a map

Creating a map yourself causes a few network requests:

The playing-field picker opens at your own GPS position and loads map data for the surroundings from the chosen provider (see above).
Place search sends the name you typed, together with your approximate position (as a weighting for the order of the results), to the same service.
The automatic target suggestions send the rectangle of the chosen map section to Overpass, an interface of the OpenStreetMap project.
The suggested name for a new map section asks Nominatim (OpenStreetMap as well) what the area is called.

In each case only the approximate location the request needs is transmitted, and only while a map is actively being created. While playing, your location is never transmitted — see above.

Maps you pass on

A finished map can be shared as a file (.ovarlay). That file may contain the real coordinates of hiding places you chose — a garden, for instance. Passing it on is done by you alone, to the recipients of your choice; we take no part in it and receive no copy.

Challenge: the leaderboard

A challenge is voluntary and has to be started by you or joined with a code. Only then does anything leave your device at all. For anybody who uses no challenge, it remains true that OvARlay sends no data from the hunt.

What is processed is exclusively:

a nickname you choose yourself — a first name or an invented one is enough,
your result: points, how many targets you found, how many targets the map has in total, how many quiz questions you answered at the first attempt, and the time you took,
the challenge's code and a checksum of the map — a string that reveals nothing about places, names or contents,
the times of the entry and of its expiry.

What is not processed: location or movement data, e-mail addresses, contacts, accounts, step counts, and the map itself. The map stays a file that you pass on yourself.

Taking part creates an anonymous guest account without any input from you. It exists only so that you can change and delete your own entry, applies to that one challenge alone, and is deleted after at most 30 days without use. No lasting device identifier is created by it.

Storage period: a challenge runs for at most 30 days. After that, challenge and leaderboard are deleted automatically. Whoever created it can end it early at any time, and you can withdraw your own entry yourself at any time.

Processor: the leaderboards are stored with Google Cloud Firestore (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The storage location is the eur3 region — the data is held replicated in Belgium and the Netherlands. Google's data processing terms apply (Cloud Data Processing Addendum).

Legal basis: Art. 6(1)(b) GDPR — the processing is necessary to provide the function you asked for (comparing results).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) with regard to the controller named above. Since OvARlay stores location data exclusively on your own device, you can view and delete it yourself at any time — through the list of hunts in the app, or by uninstalling it.

You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

This statement is adjusted whenever something about the processing changes. As of August 2026.