Archived version of 2026-10-09. No longer in force.
Last updated: 9 October 2026
This policy describes what data the Unbound app and the unbound.guide website process, for what, on what legal basis, for how long, and what rights you have. In short: the app works without an account, your precise location stays on your phone, there are no ads, we do not sell data, and we only count how you use the app if you agree.
Your guides, history, favourites, the photos in your diary and the recordings of your tours stay on your device. Without an account they never leave it.
The app needs your location to choose stories about places near you. This choice is made on your phone, and in the background only while a tour is running.
Only what a story needs goes to our server: which place it is about (name and Wikidata id), roughly how far away it is and in which direction. For the short facts at the start of a tour the app sends the names of the town, district, state and country that your phone's operating system (Apple or Google) derives from your location. For the greeting the app asks for the weather with a position rounded to about one kilometre; our server asks the weather service MET Norway with it, without any link to you. Our server does not store positions.
The map loads its tiles from MapTiler (MapTiler AG, Switzerland), which receives your IP address and the area shown.
You can sign in with Apple or Google, through Firebase Authentication (Google). We receive an identifier, your email address and, if you share it, your name.
With an account we store your profile (name, photo, who may see it), points, levels and badges, your friends, and a backup of your guides, settings, favourites, history and diary photos so that they come back on another phone. After a tour the app sends the points of its recording so that the server can work out distances and how you travelled; only the totals are kept, not the route.
On the start page we show how many explorers were out around you lately, and on the map which areas have been explored. For this the app sends your position, rounded to about one kilometre, with the random device ID to our server when it opens. With an account, the areas your recorded tours pass through count too.
The server does not keep where you were; it only counts: in fields of about one kilometre, each device once a week. So that nobody is counted twice, it keeps a mark for two weeks that cannot be traced back to your device without the server; after that we delete it, and only anonymous numbers remain. Numbers are shown only from three explorers. If your profile is visible to nobody, you are not counted.
The legal basis is our legitimate interest in showing explorers where it is worth going (Art. 6(1)(f) GDPR).
Instead of Apple or Google you can sign in with an e-mail address and a password. This also runs through Firebase Authentication (Google), where your e-mail address and your password are kept, the password only in encrypted form (as a hash); we never see your password. If you forget it, Firebase sends you a link to set a new one on request.
After you create an account we send one welcome mail with a short guide to your account's e-mail address. This is part of providing your account (Art. 6(1)(b) GDPR); it contains no advertising.
You only get news by e-mail (such as new regions or features) if you tick this when signing up or in the settings and then open the link in our confirmation mail (double opt-in, Art. 6(1)(a) GDPR). As proof we keep when you ordered and confirmed it. You can unsubscribe at any time with the link in every mail or in the app; we then delete the address kept for it.
To send mails we use Brevo (Sendinblue SAS, Paris, France) as our processor, with servers in the EU. Brevo receives your e-mail address and the content of the mail. Brevo counts opens and clicks only anonymously, without linking them to you; we do not track whether or when you open a mail or click a link in it.
When you sign up we keep which version of the terms of use you agreed to and when, and the language of the app, so that we write to you in it.
What you share, others see: a shared tour (route and stories heard) is seen by your friends. During a shared tour, everyone listening in sees your position and your route of the last two hours; both are deleted when the tour ends. Places you suggest, their photos, comments and ratings are public with your profile name. You appear as the discoverer of a story only if you switch that on.
Suggested places and profile photos are checked by an AI service (Anthropic) before they are published, and by a person when in doubt. Comments appear at once; the AI service reads them too and only flags serious breaches to a person. Reports by others are reviewed by a person too.
If you allow notifications, we store your Firebase Cloud Messaging (Google) device token to tell you about friend requests or released places, for example. You can switch them off in the app and in your phone's settings.
You choose which notifications you get in the app under Settings › Notifications. Only if you leave “News from your area” on do we store your rough area (a square of some 20 to 40 km) from the last time you opened the app; no exact position and no history. So that we can remind you a day before your pass ends, the server stores when it ends.
So that the trial does not start over when the app is installed again, we store a random device identifier (in the iOS keychain, or the Android ID) with the time used.
Purchases are handled by Apple or Google. RevenueCat (RevenueCat Inc., USA) manages what you bought with an identifier, your account identifier if you have one. We never receive payment details.
Passes given as a present (gift codes and recommendations) are unlocked for your account through RevenueCat. For “Give a Trip, Get a Trip” we store who recommended whom, and the device identifier, so that each recommendation counts only once.
Firebase App Check (with Apple App Attest and DeviceCheck, or Google Play Integrity) confirms to our server that requests come from the genuine app on a real device.
The texts are written by an AI service (Anthropic) from Wikipedia and Wikidata; the voices are made by a speech service of Google (Gemini). These services receive place names, article texts and the stories, no data about you.
You can ask your guide questions, typed or spoken. Spoken questions are turned into text by your operating system's speech recognition (Apple or Google), on the iPhone on the device itself and on Android on the device where possible; we do not receive the recording.
Our server receives the text of your question, the names and distances of places near you, the stories told last, the area (such as "Berlin") and your position rounded to about 100 metres. The server has an AI service (Anthropic) sort and answer the question; for practical questions (such as opening hours or a shop near you) it searches the web. The search then contains the question and the rough area, not your identity.
To check the quality of answers and detect abuse, we keep the question, answer, classification and the random device ID for 90 days, without the position, and then delete them automatically. We count how many questions a device asks to apply the limits of the trial and the passes. The legal basis is providing the feature (Art. 6(1)(b) GDPR) and our legitimate interest in quality and preventing abuse (Art. 6(1)(f)).
Please do not ask questions containing personal data about yourself or others. Answers are generated automatically and may contain mistakes.
For festivals, markets and other events near you, the app sends the names of the town and district that your operating system derives from your location, and your position rounded to about one kilometre, which the server uses to sort events by distance and does not store. Our server searches the web for this once per place and week with an AI service (Anthropic), fetches the event calendars found and stores the result for everyone, without reference to you. The server locates the events with OpenStreetMap's Nominatim service, also without reference to you.
Events come from the third-party pages named. We cannot guarantee that they are correct; the source is always linked.
If you agree, the app counts which features you use, such as when a tour starts or ends, which stories about which places are heard, skipped or rated, how many questions are asked, which screens are opened and which passes are viewed or bought. Your location is not included. The events go to our own server with the random device ID, the app version, operating system and language, and your account ID if you have one; no third-party analytics service is involved. We use them only to improve Unbound, not for advertising.
You are asked once after the first start. Without your consent nothing is counted. You can withdraw it at any time in the settings (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We keep the events for at most 14 months.
If the app crashes, it sends a crash report to Firebase Crashlytics (Google): where in the program the error occurred, device model, operating system, app version and a random installation ID. We use it to find and fix errors (legitimate interest, Art. 6(1)(f) GDPR; strictly necessary for the service within the meaning of Section 25(2) TDDDG). Google deletes the reports after 90 days.
If you write to us through the form in the app or on the website, we store the topic, your message, your e-mail address and, if given, your name. From the app, unless you untick it, technical details come along: app version, device type, operating system and the random device ID, and your account ID if you have one. Screenshots you attach are stored with the message. The message goes by e-mail through Brevo to our inbox; if you gave an address, you receive a confirmation. Our reply appears in the app under Help & feedback, matched by the random device ID or your account, with an account also as a notification, and by e-mail if you gave an address.
We use the details only to answer your request and fix problems (Art. 6(1)(b) and (f) GDPR). To protect the form against automated mass requests, the server briefly counts how many messages come from an IP address or device; this is not stored. We delete messages after two years, sooner if you ask and no retention obligation applies.
Servers, database and files are hosted by Google Cloud and Firebase in Frankfurt am Main (Germany).
The following process data on our behalf (Art. 28 GDPR): Google (Cloud, Firebase, Crashlytics, Gemini speech), Anthropic (texts, answers, review of contributions, web search), RevenueCat (purchases), Brevo (e-mails) and MapTiler (map tiles). Mollie (payments on the website), Apple and Google (store purchases, sign-in, speech recognition) process data as independent controllers. Our server asks MET Norway for weather and OpenStreetMap (Nominatim) for places, without reference to you.
Where data reaches countries outside the EEA, in particular the USA, this is based on an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the recipient is certified) or the Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
Server logs for troubleshooting are deleted after about 30 days.
We process data to provide the app and your account (Art. 6(1)(b) GDPR), with your consent, for location, notifications and being shown as a discoverer for example (Art. 6(1)(a)), and in our legitimate interest in security and protection against abuse, as with App Check and the trial (Art. 6(1)(f)). Visits to the website are counted only if you agree (Art. 6(1)(a)).
If the automatic check rejects a suggested place or a profile photo, we tell you why. You can appeal against a rejected place in the app, otherwise by e-mail, and a person decides. Only a person removes comments. We do not make solely automated decisions with legal effect within the meaning of Art. 22 GDPR.
You are under no legal or contractual obligation to give us data. Without your location, however, the app cannot choose stories near you, and without an account there are no friends, no backup and no contributions of your own.
You can delete your account in the app, in your profile. We then remove your profile, backups and photos, friendships, shared tours and comments. Public places you suggested stay for the community, without your name. What is only on your phone is deleted when you remove the app.
We keep your account data until you delete the account. We keep the trial's device ID and who referred whom for as long as we offer Unbound, as they would otherwise lose their purpose of preventing a second trial or double rewards. Data we are legally required to keep, such as purchase records, is deleted when the period ends.
You have the right of access, rectification, erasure, restriction of processing and data portability, you may object to processing and withdraw consent at any time. Write to us at the address above. You may also lodge a complaint with a data protection supervisory authority, such as the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de), which is responsible for us, or the authority where you live.
Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You may also contact the supervisory authority where you live.
The way of telling for children is meant for families. Accounts are created by adults and are meant for people aged 16 and over.
If you buy a pass as a gift on this website, we process your e-mail address, the order (pass, price, time and your consent to the code being made at once) and the gift code to handle the purchase and send you the code and a receipt (Art. 6(1)(b) GDPR). We send the e-mail through Brevo (Sendinblue SAS, Paris, France).
Payment is handled by Mollie (Mollie B.V., Amsterdam, Netherlands). You enter your payment details directly with Mollie; we do not receive them, only whether and when payment was made. Mollie processes payment data under its own responsibility according to its privacy policy.
We keep order data for ten years because of tax and commercial record-keeping duties (Art. 6(1)(c) GDPR) and delete it afterwards. Once the code is redeemed, it is linked to the account that redeemed it.
The website is served through Firebase Hosting (Google), which processes technically necessary data such as your IP address. If you agree, we count visits with Google Analytics (Google). Google Analytics sets a cookie and receives the page address, the site that linked here, a rough location, and details of the browser and device. The provider is Google Ireland Limited; data may reach Google LLC in the USA, on the basis of the EU-US Data Privacy Framework. Google keeps the data for at most 14 months. You can refuse. Your choice is stored in this browser; you can withdraw or change it at any time with the button at the bottom of this page. Fonts are part of this website and are not loaded from elsewhere.
If the way the app processes data changes, we update this policy. The date above shows the current version.