Privacy Policy

Who we are

The controller responsible for your data is Playstate UG (haftungsbeschränkt), represented by Thomas Cox, Schönholzer Straße 8A, 13187 Berlin, Germany. For anything in this policy, or to exercise any of the rights below, contact us at hello@playstateprojects.com. See our Impressum for full company details.

What we collect

• Account data — email address, and a password (stored as a salted hash) if you sign up with email/password rather than a magic link.
• Profile data — display name, bio, and profile photo, if you choose to add them.
• Observation data — the insect sightings you tap during a session, session timing, weather, and any notes on habitat conditions or other wildlife.
• Location data — GPS coordinates when you create or use a spot/space, or search for an address, and to look up weather for your session.
• Photos — cover images for spots and spaces you create, and the optional scene photo you take when starting an observation session.
• Payment data — if you buy a space or spot pack, Stripe processes your payment; we receive confirmation of payment, not your card details.
• Usage data — which pages you open and a few in-app actions (for example, starting a session), tied to a random ID stored on your device and, if you're signed in, to your account. We use this only to see how the app is used and to improve it.
• Technical data — standard server logs (IP address, request timing) generated by our hosting infrastructure.

How we use it

• To run your account and remember your sightings, cards, and streaks.
• To show spots, spaces, and leaderboards to you and other observers.
• To read the scene in a photo you submit (habitat, plants) using an AI image-analysis service, so we can pre-fill details for you.
• To look up real weather conditions for your session's time and location, from Bright Sky (a public weather API built on Deutscher Wetterdienst (DWD) open data) for German locations, or Visual Crossing for other locations.
• To process payments for space/spot packs.
• To understand how the app is used (which screens are opened, where people drop off) so we can fix problems and improve it.
• To aggregate anonymised sighting counts for biodiversity research and public leaderboards.

Legal bases

• Providing the app (account, observations, locations, photos, weather, payments) — performance of our contract with you, Art. 6(1)(b) GDPR.
• Usage statistics, server logs, and security — our legitimate interest in running a stable, secure app and improving it, Art. 6(1)(f) GDPR.
• Invoices and payment records — legal obligations under German tax and commercial law, Art. 6(1)(c) GDPR.
• Optional profile details and photos — your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by removing them.

Who we share it with

We don't sell your data. We use the following processors to run the app:

• Cloudflare — hosting, database, storage for photos and avatars, and storage of usage statistics.
• Stripe — payment processing for space/spot packs.
• Resend — sending account emails (magic links, confirmations).
• DeepSeek — AI analysis of photos you submit, to detect habitat features. This provider is located outside the EU; photos sent to it are used only to generate the description shown back to you.
• Bright Sky — a public weather API (built on Deutscher Wetterdienst open data) we query with your session's approximate location and time to record real weather conditions, for locations in Germany.
• Visual Crossing — a weather API we query the same way, for locations outside Germany.
• Stadia Maps — map tiles shown when placing a pin.
• Esri (ArcGIS) — satellite imagery shown when placing a spot or drawing a space boundary.
• OpenStreetMap (Nominatim) and BigDataCloud — turning addresses and GPS coordinates into place names.

Cookies and on-device storage

We use one essential cookie to keep you signed in. We don't use advertising cookies or third-party trackers. The app also stores a few things in your browser's local storage:

• Observation sessions not yet uploaded, so you don't lose them when you're offline.
• Your language choice, and whether you've already seen the start-up screen.
• A random device ID used to group usage statistics. It contains nothing about you, and you can reset it by clearing this site's data in your browser.

Fonts are served from our own servers, not from Google or another font provider.

How long we keep it

We keep your account and observation data for as long as your account is active. If you delete your account, we delete your profile and personal data, though aggregated, anonymised sighting counts may be retained for research purposes. Payment records are kept for as long as German tax law requires (up to 10 years).

Your rights

Under GDPR, you can ask us to access, correct, delete, or export your data, or object to how we use it. Email hello@playstateprojects.com and we'll respond as quickly as we can. Where we rely on legitimate interest, you can object at any time. You can also lodge a complaint with a data protection authority, for example your local one or the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Children

The SPAIA App isn't directed at children under 16. If you believe a child has created an account without parental consent, contact us and we'll remove it.

Changes

We may update this policy as the app changes. We'll update the date at the top when we do.