Privacy policy

Last updated: October 2026

Grus is a travel diary: you upload photos and GPS tracks and the diary builds itself from them (timeline, map, route, slideshow). This page says which personal data is processed and why. There is no advertising, no tracking, no analytics service and no AI processing of your content.

1. Controller

Robert Metzner
Willdenowstraße 10
Berlin
Deutschland

Email: grusapp@robertmetzner.com

2. Visiting the website and server logs

When you open the site the server processes, as technically required, your IP address, date and time, the requested address, the status code and your browser type (server log files). This serves safe and stable operation and the defence against abuse; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in operation and security). Logs are kept only as long as that requires. To protect against abuse (for example sign-in attempts) the server also keeps short-lived counters per IP address or account.

3. Account

For an account we store your email address, a name, your password (only as a hash, never in plain text) and the settings you choose (language, time zone, optionally a profile text, profile picture and a private home location used as a route suggestion). If you switch on two-factor sign-in, the (encrypted) secret and recovery codes are added. For the list of your signed-in devices we remember per session the browser/device and a hint of the IP address. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR); for the session list and protecting the account Art. 6(1)(f).

4. Your content

You decide what you upload: photos and videos, GPS tracks, text, places. We store the files with their metadata (for example capture time, camera and, for photos with GPS data, the place where they were taken) and previews generated from them. From the places the service can add place names and the weather at the time (see section 7). The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

Every file is encrypted with its own random key of your account before it is written to object storage (encryption at rest) and is not publicly reachable there. This is not end-to-end encryption: the server decrypts files to deliver them to you, so technically the operator could also access them. We do not do so without cause (for example a report of illegal content or your explicit request for help).

5. Visibility and sharing

Trips are private by default. You can share them with chosen people (invitation), via a secret link, or make them public. Anyone with access sees the photos, text and, if you leave "show locations" on, places and routes. For public trips remember that the content is available to everyone and that people and places in it may be recognisable. You can renew a secret link at any time; the old one then stops working.

6. Emails

We only send mail the service needs: address confirmation, password reset, security notices (for example a changed password), invitations, data export, notices about account deletion and inactivity and, at your request, upgrade requests. There is no advertising; section 6a describes the optional newsletter. The legal basis is Art. 6(1)(b) GDPR.

6a. Newsletter

On the start page you can sign up for an occasional newsletter with news about Grus. Signing up is voluntary; you can use Grus in full without it.

Data: email address, chosen language, the wording of your consent with the time of signup, and the time of confirmation. We store no IP address and no usage data; the emails contain no tracking pixels and no link tracking. To protect the form from abuse the server keeps short-lived counters per IP address and email address (only as an irreversible hash).
Legal basis: your consent (Art. 6(1)(a) GDPR) using double opt-in: after signing up we send you an email with a confirmation link (valid for 48 hours); you only receive the newsletter after you click it. Whoever does not confirm receives nothing, and the unconfirmed signup is deleted after 7 days at the latest.
Withdrawal: You can withdraw your consent at any time with effect for the future. Every newsletter email contains an unsubscribe link (one click; your address is deleted). The lawfulness of the processing until then is not affected.
Retention: until you unsubscribe.
Recipients: The email service provider named in section 9 delivers the emails, only on our instructions.
No link to your account: The newsletter signup is independent of any account; we do not link the address to accounts, and account deletion or data export do not cover it. To have it deleted use the unsubscribe link or write to grusapp@robertmetzner.com.

7. Maps, place names, weather and routes

These features are optional and only active if the operator has switched them on.

Map tiles: your browser loads the map images directly from a map provider (by default OpenFreeMap, or a provider you entered such as MapTiler). For technical reasons the provider sees your IP address and the map section shown, but no data from your account. The legal basis is Art. 6(1)(f) GDPR (displaying the map).
Place names, place search, weather, routes: for these the server (not your browser) sends coordinates and times, but no names, account or file data, to Nominatim (OpenStreetMap), Open-Meteo and a routing service (for example FOSSGIS OSRM), or to a provider whose key you stored yourself. We cache results so they need not be requested again. For your own keys the terms of that provider apply, with whom you have your own contract; your keys are stored encrypted in your account and never shown again.

8. Cookies and storage on your device

Grus only uses cookies and local storage that are needed for operation or for settings you make yourself (§ 25(2) no. 2 TDDDG). There are no advertising or analytics cookies, which is why we show no cookie banner.

Sign-in: a cookie that keeps you signed in (HTTP-only, this website only, ends with the session or when the sign-in expires). The Android app (and an app-only build of the website) keeps a sign-in token in protected app or local storage instead.
Display settings: cookies for view (grid/list), size and visibility of the panels (map, stage, timeline), map options (3D terrain, tracks), slideshow (interval, loop) and info overlay; up to one year.
Language and colour mode: your chosen language and whether the site is light or dark.
Local storage: the place you last had open in a trip ("continue where you left off", at most 90 days), notices you dismissed, the interim state of a running track recording and a small technical log of sign-in events (no password, token or email address) for troubleshooting. This data does not leave your device.
Offline storage (service worker): the web app may cache its own program files so it starts faster; your photos are not part of that.

You can delete cookies and site data in your browser settings at any time; you then have to sign in again and re-set your preferences.

9. Recipients and processors

For hosting, file storage and email delivery we use service providers who support us only on our instructions and under a data processing agreement (Art. 28 GDPR):

Server hosting: Hostinger
File storage (object storage): Intercolo
Email delivery: Zoho

We do not pass data on otherwise unless legally required. Data is transferred to countries outside the EU/EEA only if a map provider you chose is based there or a service provider is; the transfer then relies on an adequacy decision or standard contractual clauses.

10. Retention and deletion

Account data and content stay until you delete them or your account. When you delete the account a grace period (14 days by default) lets you restore it; afterwards the account, content and files are removed for good.
Free accounts nobody has signed in to for a long time are deleted automatically after two warning emails; the period is stated in the warning email and in the terms of use.
Deleted content may remain in backups for a limited time, if the operator keeps any, and is overwritten as they rotate.
Server logs are kept only briefly (section 2).
Newsletter signups stay until you unsubscribe; unconfirmed ones are deleted after 7 days at the latest (section 6a).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Much of this works directly in the app: under Account → Data you export all content as a ZIP archive and delete your account. For anything else write to grusapp@robertmetzner.com.

You can withdraw a consent you gave (newsletter) at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live or where we are based.

12. Obligation to provide data, automated decisions

Without an email address and password we cannot create an account. There is no automated decision-making or profiling under Art. 22 GDPR.

13. Changes

If the app or the law changes we will adapt this policy. The version published here applies.