Privacy policy
This policy covers the website explora.tours and the Explora app. It informs you under Articles 13 and 14 GDPR about which personal data we process, for what purpose, on what legal basis and for how long.
This is a translation for convenience. The German version is the legally binding one.
1. Controller
Oliver Seib
Kühlwetterstraße 43
40239 Düsseldorf
Germany
Email: hallo@explora-tours.de
2. Principles
We process personal data only where it is necessary to operate the app and the website. The tours are deliberately built to work offline: after download, audio, map and puzzles live on your device. No location data is transmitted to us during a tour.
3. Visiting the website
Hosting
The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the technically necessary connection data on our behalf. We have concluded a data processing agreement with Vercel under Article 28 GDPR. The transfer to the USA is based on the European Commission's standard contractual clauses and on Vercel's certification under the EU-US Data Privacy Framework.
Server log files
Each time the site is accessed, data transmitted by your browser is recorded automatically: IP address (truncated or stored only briefly), date and time, page requested, referrer URL, browser type and operating system. This data serves to deliver the page, keep it stable and defend against attacks.
Cookies and consent
Strictly necessary storage is used without consent: this includes the
explora_consent_v1 entry in your browser's local storage, which records
your decision about this site. Without it we would have to ask you again on every
visit.
Everything else — measurement and marketing — only starts once you select “Accept all” in the banner at the bottom of the screen. If you choose “Only necessary”, those services stay switched off. Until you decide, the categories analytics_storage, ad_storage, ad_user_data and ad_personalization are set to “denied” under Google Consent Mode v2.
Withdraw or change your consent — this forgets your decision, brings the banner back and returns the categories above to “denied”. Withdrawal takes effect for the future; processing carried out beforehand remains lawful.
Google Tag Manager
We use Google Tag Manager, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to control these services. Tag Manager itself sets no analytics or advertising cookies; it is the administration layer that loads the tools below once you have consented. Loading the container transmits your IP address to Google.
Google Analytics 4
Once you consent, we use Google Analytics 4 (Google Ireland Limited) to measure how the website is used: pages viewed, time spent, approximate location and device. Google truncates your IP address in the process. We use these reports to improve our content and our offering; the data is not combined with your Explora account.
Google Ads
Once you consent, tags from Google Ads (Google Ireland Limited) tell us whether a visit came from one of our ads and build audiences for remarketing. This sets cookies and transmits events to Google.
Meta pixel
Once you consent, we embed the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It reports visits and events on this site to Meta so that we can measure the effect of our ads on Facebook and Instagram and build audiences. For this processing we and Meta are joint controllers under Art. 26 GDPR; Meta provides the corresponding addendum at facebook.com/legal/controller_addendum. Meta also processes the data in the United States.
4. Contacting us
If you write to us, we process your details to handle your enquiry and any follow-up questions. The legal basis is Article 6 (1) (b) GDPR for contract-related enquiries, otherwise Article 6 (1) (f) GDPR. We delete the correspondence once it is no longer needed, at the latest after the statutory retention periods expire.
5. Test crew application
At /testcrew you can apply to test one of our tours. The page is in German, as is the tour. We process only what the form asks for: the tour you picked, your first name, your email address, your group size, your rough timeframe and — optionally — your reason for applying and your social media handle. We do not store your IP address.
The legal basis is your consent under Art. 6(1)(a) GDPR, which you give explicitly in the form; we store the time of that consent as the record required by Art. 7(1) GDPR. You may withdraw it at any time and without giving reasons — a message to hallo@explora-tours.de is enough and we will delete your application.
Applications are stored in our Supabase database and additionally sent by email to hallo@explora-tours.de. Only the operator can access the database; the table cannot be read from outside. We delete applications no later than six months after the respective test round ends, and earlier if you withdraw. We use your details for the test crew only — no advertising, no newsletter, no sharing with third parties.
6. Using the app
Location data
The app needs your location to recognise when you reach a waypoint. The chapter is then ready there; if you wish, it starts by itself. The comparison between your position and the waypoints happens exclusively on your device. Location data is not transmitted to us or to third parties and is not stored on our servers.
On Android the app uses a foreground service with location access while a tour is running, so playback continues with the screen off. You can recognise this by the persistent notification. You can withdraw location permission at any time in your system settings — chapters can still be started manually.
User account and tour unlocks
For an account we process your email address, an encrypted password or the identifier of your sign-in provider, your unlocked tours and your tour progress. This is necessary so you can use purchased tours on several devices and resume an interrupted tour later.
When you finish a tour, we also store which tour it was, when it ended, how many chapters you solved, how long it took, whether you listened on the move or in sofa mode, and your platform and app version. This shows us which tours are heard to the end and where listeners drop off. It does not include your location, device identifiers or your answers. The legal basis is our legitimate interest in improving the tours (Article 6 (1) (f) GDPR).
For the same reason we store when you start or leave a tour: which tour, at which chapter, whether on foot or in sofa mode, whether as a free sample, plus platform and app version. Again without your location and without your answers. We delete these entries after twelve months.
This data is held by Supabase Inc., 970 Toa Payoh North, Singapore, in a data centre within the European Union. A data processing agreement under Article 28 GDPR is in place.
Feedback from the app
Under “Give feedback” in your profile you can send us a message. We process the category you choose, your text, the platform (iOS or Android), the app version and an identifier that lets us tell several messages from the same sender apart — the account identifier for signed-in users, otherwise a random identifier of this installation. We process an email address only if you enter one voluntarily, and solely to reply to you.
The message is stored in our database at Supabase and additionally sent as an email to hallo@explora-tours.de. The table cannot be read from outside; only the operator has access.
Purchases
Tours are purchased through Apple's App Store or Google Play. Payment processing lies entirely with these providers; we do not receive your payment details. We only receive a purchase confirmation, which we verify in order to unlock the tour and prevent misuse.
Push notifications
If you allow push notifications, Firebase Cloud Messaging, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, generates a device identifier (token). We use this token to send you information about new tours and your tour progress. You can withdraw permission at any time in your system settings.
Crash reports
If the app crashes, Firebase Crashlytics (Google Ireland Limited) transmits a technical report: device type, operating system version, app version, timestamp and stack trace, together with a pseudonymous installation ID. We use this solely to find and fix errors.
Usage analytics in the app
Only if you agree on first launch does the app use Google Analytics for Firebase (Google Ireland Limited) to measure how it is used: which tours are viewed, started, finished and bought, where a purchase is abandoned and which prompts are tapped. This comes with device type, operating system, app version, language, a rough country of origin, a pseudonymous app instance ID and the identifier of your account or guest ID. If you tell us your home city, it is carried along as an attribute, as is whether you have ever finished a group tour as a guest and how long ago that was. The coordinates of your location, the content of your answers in the tours and your name are not part of it; the distance to the next waypoint or the nearest tour may be included as a number.
Without your consent none of this is sent. You can withdraw consent at any time in the app settings.
Group mode
When you walk a tour together, we store for the lifetime of the group: which tour it is, the invitation code, the identifiers of up to four participants, which chapter each person has finished and when they were last active. This is needed so that everyone moves on to the next chapter together. The others do not see names. A group expires after 12 hours at the latest; its data is deleted seven days after expiry. Like your account, it is stored with Supabase in the European Union. So that a change reaches everyone at once, the app keeps a connection to Supabase open during the tour; it carries only the signal "state has changed", no content.
If you scan an invitation code before you have installed the app, we carry the code through the installation: on Android the app reads, once on first launch, the install referrer from Google Play, into which our website wrote the code. On iOS the website copies the invitation link to the clipboard when you tap the App Store button; the app reads the clipboard only when you open the code entry, and iOS asks you first. In both cases the app evaluates only the invitation code, on your device.
If you open an invitation link in the browser, our website asks Supabase whether the group is still running, which tour it is and how many places are taken. This transmits the code and, for technical reasons, your IP address.
At the end of a group tour we ask guests for their home city in order to suggest a fitting tour. This is voluntary and stored on your device; it reaches us only as part of usage analytics, if you consented to that. If a welcome discount is running afterwards, the app reminds you once by notification before it ends — provided you allowed notifications; the reminder is created on your device.
Advertising
In free use, the app displays advertising via Google Mobile Ads (Google Ireland Limited). This may involve processing your device's advertising ID, coarse location data and usage data. We only show personalised advertising if you have consented beforehand; you can change your choice at any time in the app settings. Purchased tours contain no advertising.
On iPhone, the app also asks through Apple's system dialog ("App Tracking Transparency") whether Google may use your device's advertising ID (IDFA). Without your permission the advertising ID stays blocked. You can withdraw permission at any time under Settings → Privacy & Security → Tracking.
7. Recipients of your data
We pass on data only where necessary for the purposes described, where you have consented, or where we are legally obliged to do so. Processors act on our instructions on the basis of an agreement under Article 28 GDPR. With your consent, the recipients also include Google Ireland Limited (Tag Manager, Analytics, Ads) and Meta Platforms Ireland Limited (pixel).
8. Transfers to third countries
Some of the providers named also process data outside the EU, in particular in the USA. This is based on the European Commission's standard contractual clauses and, where available, certification under the EU-US Data Privacy Framework. Despite these safeguards, access by authorities there cannot be entirely ruled out.
9. Your rights
Under the GDPR you have the following rights against us:
- Access to the data stored about you (Article 15)
- Rectification of inaccurate data (Article 16)
- Erasure (Article 17)
- Restriction of processing (Article 18)
- Data portability (Article 20)
- Objection to processing based on legitimate interests (Article 21)
- Withdrawal of consent with effect for the future (Article 7 (3))
An informal message to hallo@explora-tours.de is enough for any of these.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the authority where you live or the one responsible for us.
10. Deleting your account
You can delete your account at any time in the app under "Settings → Account", or ask us to do so by email. We then delete all personal data unless a statutory retention obligation applies. Purchase records are kept for tax reasons but separated from your profile.
11. Changes to this policy
We update this policy when the legal situation or our processing activities change. The version published here is the one that applies.