Privacy Statement

1. Purposes of Processing and Legal Bases

We process personal data only for the following purposes:

• Providing the location-sharing service. When you register, we create your account and a unique sharing URL and process your location (and, where you enable it, your location history) so it can be shown to the people you authorise. You control who can see your location through the visibility settings. Providing this data is necessary to use the Service; without it the location-sharing function cannot work. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
• Account security (website). We set a necessary cookie in your browser to identify you as the account owner and to protect your account from unauthorised access. Legal basis: our legitimate interest in securing the Service, Art. 6(1)(f) GDPR.
• Account security (app). When you sign in with the Android app, we issue a random sign-in token for that installation, so the app no longer has to store your password. To recognise the same installation again — for example after you reinstall the app — the app transmits the device's Android ID, an identifier Android generates separately for each app (it is not the hardware serial number and not the advertising ID). We store only a one-way hash of it, together with the device model, the app version and when the device was last used; the Android ID itself is never stored. We also record which of your devices sent a location. When you move to a new Android device, the app can restore your sign-in through Android's Restore Credentials feature: a restore key is kept in your Google account's backup (end-to-end encrypted where your device supports it), and we store only its public key. Device entries are kept until the device is signed out or your account is deleted; when you change your password you can sign out all other devices. Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and our legitimate interest in securing your account, Art. 6(1)(f) GDPR.
• Communication. If you contact us by email, we process your message and email address to handle your request. Legal basis: performance of the contract, Art. 6(1)(b), or our legitimate interest in responding, Art. 6(1)(f) GDPR.
• Purchases. If you buy additional features, the purchase is handled through Google Play Billing. We process the related transaction data to provide the feature and to meet our statutory accounting and tax obligations. Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
• Advertising. The free version of the app displays advertising through Google AdMob, and our websites may display advertising through Google AdSense. Personalised advertising and the related use of advertising identifiers or cookies take place only with your consent — which you give, and can withdraw at any time, through the consent dialog in the app or, on the website, through the cookie consent banner and its “Privacy and cookie settings” link, or through the link of the same name in the account menu and the page footer. Legal basis: consent, Art. 6(1)(a) GDPR. Without your consent, Google shows only non-personalised ads, which are not based on your past browsing; to deliver them, your IP address is transmitted to Google. Legal basis: our legitimate interest in financing the free Services through advertising, Art. 6(1)(f) GDPR. How Google uses data from websites and apps that use its services is explained at policies.google.com/technologies/partner-sites; you can also manage or turn off personalised advertising in your Google account at myadcenter.google.com.
• Map display. To show locations on a map, the Services load map data from the map provider you select — Google Maps or OpenStreetMap. When a map is displayed, your IP address is transmitted to the selected provider so that it can deliver the map. Legal basis: performance of the contract, Art. 6(1)(b) GDPR, as the map is necessary to provide the location display you have requested.
• Remote commands and notifications. To deliver remote commands and notifications to your device, we use a Google push-notification service. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.

2. Recipients

We do not sell your personal data. We share it only with service providers acting on our behalf, to the extent necessary to operate the Services — in particular our hosting provider (our server is located in Germany), Google (for purchases, notifications, advertising and Google Maps) and, when you select OpenStreetMap as your map provider, the OpenStreetMap tile servers. Google's privacy information is available at policies.google.com/privacy.

3. International Transfers

Some providers, in particular Google, may process data outside the European Economic Area, including in the United States. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses.

4. Retention

We keep personal data only for as long as necessary for the purposes described above — generally for as long as you maintain your account — and delete it thereafter, unless we are required to retain it to comply with legal obligations (for example, billing records subject to statutory tax-retention periods). You can delete your account and associated data in the app at any time.

5. Your Rights

You have the right to access your personal data (Art. 15), to have inaccurate data corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise these rights, contact support@greenalp.com.

6. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, dsb.gv.at); you may also contact the authority in your EU country of residence.

7. Family Use and Children

The Services can be used to share the location of family members, including minors — for example, parents locating their own children. If you use the Services to share or monitor another person's location, you are responsible for ensuring that you are legally entitled to do so and have obtained any consent required by law; in the case of a minor, this means that you hold parental responsibility or have the consent of the person who does. The Services are not directed to children as independent users, and an account may only be created by a person who has reached the age of digital consent in their country (in Austria, 14).

8. Changes

We may update this Privacy Policy from time to time. The current version is always available on the Greenalp website, with the date of the latest update shown above.