Privacy policy
Version: 2026 · Draft
1. Controller
Patrick Schöller
Salzgasse 11
74206 Bad Wimpfen
Deutschland
Email: p@gq9.de
2. Principle
Travel Map uses no advertising, tracking, analytics services or embedded third-party content. Fonts, maps and scripts are hosted on our own server. Your browser only connects to map.gq9.de.
3. Account
For an account we store your username, email address, a password hash (scrypt – we never know your password), your chosen language, who invited you and the time of sign-up. Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR).
4. Travel data
We store the countries, regions and places you mark as visited, favourite or wish (later also travel year and notes). This data is private. In shared maps, members only see the entries you share there and your username – never your email address. After you leave a shared map, your data is no longer visible there.
5. Emails
We only send emails required for your account: address confirmation, password reset, and notices about password or address changes. No newsletters, no advertising, no tracking pixels. Emails are sent via the mail server of our host STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (data processor).
6. Cookie
After you log in we set exactly one strictly necessary cookie ("sid") that identifies your session (HttpOnly, HTTPS only, this site only, valid for 30 days or until you log out). There are no other cookies and no other browser storage. That is why there is no cookie banner.
7. Server and logs
The app runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (data processor). The app itself does not store IP addresses. To prevent abuse (e.g. too many login attempts), IP addresses are kept briefly in memory only as a hashed value and discarded after one hour at most.
8. Retention
- Unconfirmed accounts: deleted after 7 days.
- Confirmation links: 24 hours, password reset links: 1 hour.
- Sessions: 30 days or until you log out.
- Account and travel data: until you delete your account.
- Backups: encrypted (age) at STRATO, up to 12 months. Deleted data therefore disappears from the backups only after this period.
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority. Write to p@gq9.de.