Applies in particular to anonymously reporting parking status, condition, and checks on Rastplatz.app.
This page is a translation provided for convenience. The German version is legally authoritative. View German original
The controller within the meaning of Art. 4 No. 7 GDPR for the data processing described on this page is:
Michael Fuchs
Vornholzstraße 121
94036 Passau
Germany
Contact: info@noschmarrn.dev
To accept reports without a user account, your device generates a random device
identifier (UUID) the first time you submit a report and stores it locally in
your browser (localStorage). This identifier is not linked to any
person and is never transmitted to or stored on our servers in plain text: for
every report, our servers instead compute a hash value (reporter_key)
salted with a secret key from the device identifier. The original value cannot
practically be reconstructed from it. The sole purpose of this storage is the
report function you actively use (e.g. to detect multiple reports from the same
device) — no analytics, no tracking, no advertising.
When submitting occupancy and condition reports, you may optionally share your location. Proximity to the reported parking site is never a requirement for reporting. If you consent, your exact position is already rounded on your device to two decimal places (approx. 1.1 km accuracy) before anything is sent at all — the exact coordinates never leave your device. When reporting an active large-scale police check, no location is ever collected or stored.
Every report stores the report type (e.g. free/occupied, roadworks, toilet/shower condition, active check), the reported parking site, and the time of the report. This data is the basis for the live information shown on Rastplatz.app for other drivers.
Processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest is to provide truck drivers with reliable, up-to-date information on parking availability and condition — the core purpose of Rastplatz.app.
The device identifier (reporter_key) and any coarse position submitted
are automatically removed from the report (anonymized) after typically 7 days. The
anonymized report itself — type, status, and time, without any link to your device
identifier or position — may continue to exist beyond that, in order to preserve
the long-term reliability of live data for all drivers.
Once you create an account and link your device to it (see "Account and Sign-In" below), the legal basis for retaining your device identifier shifts from the 7-day anonymization described above (Art. 6(1)(f) GDPR) to the contractual relationship with your account (Art. 6(1)(b) GDPR): the link remains in place for as long as your account exists, so that your report history stays available under "My Reports".
An account is optional. If you register or sign in (via email and password, or via Google), we set a session cookie and a CSRF protection cookie to keep you signed in during your visit and to secure form submissions against cross-site request forgery. These cookies are strictly necessary (technically required) within the meaning of § 25(2) TDDDG (German Telecommunications-Digital-Services-Data-Protection Act) and Art. 6(1)(f) GDPR — sign-in does not work without them. Therefore no cookie banner/consent is required for these cookies.
When you register, we store your email address, your username, and a password hash (never the password itself in plain text), as well as the reports submitted via devices linked to your account (see above). The purpose is solely to provide the account and the "My Reports" feature. The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR). This data is retained for as long as your account exists and is removed upon account deletion (see below).
Instead of email/password, you can optionally sign in via Google. You will be redirected to Google's sign-in page; after a successful sign-in, we receive your name and email address from Google in order to create or match your Rastplatz.app account. Google LLC is a third-party provider based in the USA; using this sign-in option may involve a transfer of data to the USA. Google has committed to appropriate safeguards (e.g. EU Standard Contractual Clauses). The legal basis is your decision to actively use this sign-in option (Art. 6(1)(b) GDPR). For more information, see Google's privacy notices.
The map view on Rastplatz.app is rendered using map tiles, fonts (glyphs), and symbols (sprites) from OpenFreeMap (tiles.openfreemap.org), a service based on OpenStreetMap data. These map tiles are loaded every time the map view is opened. The service requires no API key and sets no cookies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functioning map display).
When signing in and registering, we show a proof-of-work security check (Cap) to make automated abuse attempts more difficult. This service runs on our own infrastructure (cap.noschmarrn.dev) — no data is transmitted to third parties, and no tracking cookies are set. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in securing sign-in and registration against automated attacks).
We use Swetrix, a self-hosted, cookie-less analytics service (katie.noschmarrn.dev), to statistically evaluate the usage of Rastplatz.app. Swetrix does not process any personal data, sets no cookies, and enables no cross-device or cross-site tracking. Since no personal data is processed, no consent banner is required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in anonymous usage statistics to further develop Rastplatz.app).
When you use place or address search, your search term is transmitted exclusively to our own server (/api/geocode) and resolved there by a self-hosted geocoding service based on OpenStreetMap data. No data is transmitted to third parties, and search queries are not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functioning place search).
If you have an account, you can retrieve your stored reports as a data export at any time under "My Reports" (Art. 15 GDPR) and delete your account permanently and on your own (Art. 17 GDPR). When an account is deleted, we remove your account and the device link entirely; your previous reports are retained but are irrevocably anonymized in the process (the device identifier and any stored coarse position are removed) — this preserves the value of your reports for other drivers, without any remaining link to you.