Privacy policy of the app “Jena für dich” (iPhone and Android)

1. Controller and operator

Valeriia Kravchenko (sole trader; “Jena für dich” is the name of the project)
Fritz-Ritter-Str. 2007747 JenaGermany · E-mail: kontakt@jenafuerdich.de. No data protection officer has been appointed (there is no obligation to do so under § 38 BDSG, the German Federal Data Protection Act).

This policy applies to the app “Jena für dich” for iPhone (App Store) and Android (Google Play). The website is subject to the privacy policy of the website.

2. Overview

The app has no user accounts, no advertising, no audience measurement or analytics tracking and does not integrate any third-party services such as social media plugins or advertising SDKs. I do not sell any data and do not pass on any data for advertising purposes. What you select in the app (favourites, tasks, history, language, appearance, address for bin collection, a location you choose yourself) remains on your device. The app does not send any data to me – with one exception that you switch on yourself: push messages (from version 1.1, section 3a). In addition, the place directory contains business contact details of medical practices, companies and institutions (section 7).

3. What the app does on the device and when it establishes connections

Offline content: The place directory, the map of Jena (based on OpenStreetMap data, prepared with Protomaps), the guides and the collection rules are contained in the app. To display, search and filter them, the app does not need a connection and does not send anything. The map is not loaded from an external map service. The place directory is not updated automatically from a server; new versions arrive with app updates via the App Store or Google Play. The only exceptions are the City of Jena’s “Public toilets” and “Drinking fountains” layers (see “Content from the app’s server”).

Events: When you open events (home screen or “Events”), the app loads the dates for the next few weeks directly from the open interface of the Jena events calendar (JenaKultur) at destination.one GmbH (meta.et4.de, Germany). In doing so, the provider necessarily receives, for technical reasons, the IP address of your device, the time and the technical identifier of the system browser (user agent); the app does not send any cookies, identifiers or information about you. The loaded list is stored only on your device. Without a connection, the app shows the most recently loaded list or the list supplied with the app. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in up-to-date event information). destination.one GmbH is itself the controller for its processing.

Content from the app’s server (since version 1.3): So that news, courses, the “Public toilets” and “Drinking fountains” layers and the “Support” section are updated without an app update, the app loads this content from my own server live.jenafuerdich.de (Cloudflare Workers, Cloudflare, Inc., as my processor). The server itself fetches the content from the sources on a fixed schedule (City of Jena, IIK e.V., map.jena.de). In doing so, the app sends only the address of the content and your app language (e.g. “/v1/news?lang=de”); no cookies, no device identifier, no advertising ID, no location, no information about you. For technical reasons, the server necessarily receives the IP address of your device, the time and the technical identifier of the system (user agent); it uses them only to deliver the response and does not store them – request logs are switched off, and I do not create user profiles or statistics about individual devices. Cloudflare processes the connection data briefly for delivery and for protection against attacks. The app requests new data at most every 30 minutes (news, courses), every 6 hours (“Support”) or every 12 hours (toilets, drinking fountains). If the server cannot be reached, the app works as before. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in up-to-date and reliable information in the app). Since version 1.4 the app also loads “My way to work in Jena” in the same way (at most every 6 hours).

City news: The app shows press releases of the City of Jena from its RSS service (rathaus.jena.de) – in your language if the city offers it, otherwise the English or German version – and announcements of the press office of the City of Jena and of Jenaer Nahverkehr GmbH, which they distribute by e-mail (with their written permission). Only the title, date, a short teaser text, the source and the link to the release are shown; images and attachments are neither taken over nor loaded. The list comes from the app’s server. Only if that server cannot be reached does the app load the press releases directly from the City of Jena; in doing so, the city necessarily receives, for technical reasons, the IP address of your device, the time of the request and the technical identifier of the system (user agent); the app does not send any cookies, identifiers or information about you. The app requests new data at most every 30 minutes. The most recently loaded list is stored only on your device; without a connection, the app shows this list or the list supplied with the app. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in up-to-date information from the city). The City of Jena is itself the controller for its processing.

Courses of IIK e.V.: When you open “German courses”, the app shows the current course and exam offers of the Institut für Interkulturelle Kommunikation e.V. (Institute for Intercultural Communication) in Jena from its RSS service (www.iik.de), loaded from the app’s server. Only if that server cannot be reached does the app load the RSS service directly from the IIK; in doing so, the IIK necessarily receives, for technical reasons, the IP address of your device, the time of the request and the technical identifier of the system (user agent); the app does not send any cookies, identifiers or information about you. At most every 30 minutes; the most recently loaded list remains only on your device. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in up-to-date course information). IIK e.V. is itself the controller for its processing.

Geodata of the City of Jena: Public toilets and drinking fountains come from the open geodata of the City of Jena (map.jena.de, licence CC BY 4.0). One version is built into the app; the app’s server fetches newer versions from map.jena.de at most once a day, and the app takes them over from there. The app itself does not access map.jena.de.

Support (benefits and funding programmes): This section is a directory with our own short explanations and links to the responsible authorities. One version is built into the app; the app loads reviewed new versions from the app’s server (only the app language is transmitted). There is no questionnaire; the app does not ask for any information about income, family or residence and does not send any such information. Official pages and forms open only after you tap (pages of KfW in your device’s browser); from then on, the privacy notices of the respective body apply.

My way to work in Jena (since version 1.4): step-by-step paths (recognition, vocational training, studying, starting a business, work and Jobcenter) with my own short explanations and links to the responsible offices. One version is built into the app; checked new versions are loaded from the app’s server (only the app language is transmitted). There is no questionnaire: the “My situation” choice (e.g. EU or non-EU country) only filters what is shown, stays in the device’s working memory and is neither stored nor sent. Which steps you tick off or skip and which appointments you enter yourself are stored by the app only on your device; reminders for them are local notifications. None of this is transmitted to me or to third parties.

Official warnings: The app does not load or check any warnings. When you tap the bell, it opens the official page warnung.bund.de of the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (Federal Office of Civil Protection and Disaster Assistance); from then on, that office’s privacy information applies.

“Open website”: Before the app opens an official website in the browser window, it checks with a simple request to this website whether it can be reached. In doing so, the operator of the website receives your IP address – just as when the page itself is opened. The check only takes place after you tap.

Location (“Near me”): The app only asks for your location when you tap “Near me”, and only with your permission in the operating system (iOS: “While Using the App”, also with “Precise Location” switched off; Android: “Only while using the app”, also with “Approximate location”). The location is used only on the device to calculate distances and to show nearby places first; it is not transmitted to me or to third parties and is not queried in the background. The most recently determined position remains in the device’s session memory for no more than 10 minutes and is discarded when the app is closed. Instead of your location, you can choose a street or a point on the map yourself; this information remains on your device until you remove it. You can revoke the permission at any time in the settings of iOS or Android. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act).

Reminders and calendar: Reminders (e.g. for bin collection) are local notifications that the operating system (iOS or Android) schedules on your device; no push service is used for this. “Add to calendar” opens the device’s calendar dialog; the app does not read your calendar. Reminders for steps in “My way to work in Jena” are also such local notifications without a push service.

Directory of services: For electricity, gas, water, internet, post and parcels, local public transport, waste and similar services, the app shows central contact details (service phone numbers, service hours, links to forms) that the companies and authorities publish on their own websites. The app does not include the names of individual employees.

Phone, e-mail, maps, official pages: Calling, writing an e-mail, getting directions in Apple Maps or Google Maps and links to authorities open the respective app or website only after you tap. The app does not send anything to me in the process; from then on, the privacy provisions of the respective provider apply. The app only prepares error reports and suggestions as an e-mail in your own e-mail program; only what you send yourself is sent.

3a. Push messages (only if you switch them on)

Under “Settings – Push messages” you can choose topics (Important changes, Jena: city, Waste). Only then does the operating system ask for your permission and a device identifier (push token) is assigned – on the iPhone by Apple, on Android devices by Google via Firebase Cloud Messaging. On my server at Cloudflare (push.jenafuerdich.de), I store exclusively this token, the language of the app, the selected topics and the date of registration or change – no name, no e-mail address, no location, no IP logs. The messages are delivered via the Apple Push Notification Service (Apple Inc.) or Firebase Cloud Messaging (Google Ireland Limited).

Purpose: delivery of the messages you have selected (no more than two per week, not between 10 pm and 8 am; the content is based on official sources). Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Withdrawal: at any time, by switching off all topics – the token is then deleted from the server – or by switching off notifications in the settings of the iPhone or the Android device. Storage period: until you unsubscribe; I delete tokens that Apple or Google reports as invalid during the next sending. Recipients: Cloudflare and – only on Android devices – Google (Firebase Cloud Messaging) as processors (Art. 28 GDPR; possible processing in the USA on the basis of the EU-US Data Privacy Framework, alternatively standard contractual clauses) and Apple for delivery on the iPhone.

4. Storage on your device (§ 25 TDDDG)

The app’s local storage contains only what you select yourself or what is necessary for display without a connection: favourites and recently viewed places and search terms; “My tasks” with date and reminder; language, appearance and text size; street and house number for the collection dates and whether reminders are switched on; preferred map app; ticked-off steps in guides; the most recently loaded list of events; the most recently loaded city news and IIK courses; the news, courses, “Support” entries and City of Jena layers most recently loaded from the app’s server (without information about you); only if push messages are switched on, the selected topics and the push token; whether you have selected “Near me” or “All of Jena”, the radius and – only if you choose it yourself – your location (street or point on the map). Only for the current session: the most recently determined position (for no more than 10 minutes), recently visited screens, scroll position and search term, so that “Back” takes you to the same place. Since version 1.4 also: the version of “My way to work in Jena” last loaded from the server and your progress there – when you started a path, ticked-off and skipped steps, appointments you entered yourself and whether a reminder is switched on for them (no information about your situation).

Storage period: until you change or delete the information – in the app under “Settings – Delete everything on this device” or by deleting the app. This information does not leave your device, is strictly necessary for the function you have requested (§ 25(2) no. 2 TDDDG) and is not used for analytics purposes. If you use the device backup of iOS (iCloud) or Android (Google), the app’s local storage may be included in it; you control this backup in the settings of your device.

5. No disclosure, no sale

I do not sell any personal data, do not pass it on for advertising and do not use it for automated decisions. When events are loaded – and, only if the app’s server cannot be reached, also city news and IIK courses – the providers of these services (destination.one GmbH, Stadt Jena, IIK e.V.) receive your IP address for technical reasons (section 3); they are not processors but controllers in their own right. For the app’s server and for push messages, I use Cloudflare as processor (sections 3 and 3a), for push messages also Apple (iPhone) and Google (Android, Firebase Cloud Messaging); for e-mails to me, Zoho (section 6).

App Store and Google Play: The app is distributed via the App Store (Apple) and Google Play (Google Ireland Limited). When the app is downloaded and updated, Apple or Google process data under their own responsibility in accordance with their privacy policies. I do not receive any information about individual users from them, only aggregated statistics (e.g. the number of installations) and technical crash reports without names.

6. Contact, correction and objection

If you write to me by e-mail, I process your address and message in order to deal with your request (Art. 6(1)(f) GDPR; for requests under the GDPR, Art. 6(1)(c)). I delete the correspondence once the matter has been dealt with; I keep a brief record of data subject requests (date, type, outcome) for three years. E-mail service provider: Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, as processor (Art. 28 GDPR) on the basis of a data processing agreement. The e-mails are stored in Zoho’s EU data centre (Netherlands, backup location Ireland). According to Zoho, in individual cases employees of the Zoho group in India may access the data for technical support and maintenance; this is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Sub-processors: list from Zoho. Press releases by e-mail: E-mails from the press office of the City of Jena and from Jenaer Nahverkehr GmbH (senders with written permission) are automatically forwarded by Zoho to the app’s server; there, only the title, date, a short teaser text without contact details of employees and the link to the release are taken over and stored for no more than 60 days. E-mails from other senders are not forwarded; if one nevertheless reaches the server, it is discarded and not stored.

7. Data from publicly accessible sources (Art. 14 GDPR)

Purpose: People who are new to Jena can find medical practices, schools, authorities, associations and shops in their language. Data: name of the practice, institution or company (which may include the name of the owner or of the doctor), business address, business phone number, website, specialty or activity, opening hours. No private addresses or phone numbers, no reviews, no photos, no information about patients. Sources: OpenStreetMap, open data of the City of Jena (also via the map.jena.de interface, licence CC BY 4.0), of the Geoportal Thüringen and of the Bundesnetzagentur (Federal Network Agency) as well as Wikidata – all publicly accessible. For the place directory, I do not take any information from the websites of the institutions themselves (for the directory of services, see section 3) – with one exception: practices and institutions that have consented in writing to being listed are shown with the details they have confirmed or corrected (name, specialty, address, phone, website, for institutions also e-mail, languages; legal basis in this respect Art. 6(1)(a) GDPR, consent can be withdrawn at any time by e-mail); details in the app under “Settings – Sources”. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is that institutions in Jena can be found in several languages; I use only information that has been published for the purpose of making contact. Recipients: users of the app. Storage period: as long as the institution exists; I remove confirmed closures, and after an objection I delete and permanently block the entry. No automated decision-making within the meaning of Art. 22 GDPR.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An informal e-mail to kontakt@jenafuerdich.de is sufficient; your request will be handled free of charge. You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); in Thuringia, this is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI, Thuringian State Commissioner for Data Protection and Freedom of Information), Häßlerstraße 8, 99096 Erfurt: https://www.tlfdi.de/

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. I will then no longer process the data unless I can demonstrate compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.

You are not obliged to provide personal data. The app works without an account; it uses location, calendar and notifications only if you permit this in each case.