Privacy policy

Last updated: October 2026

Grus is a travel diary: you upload photos and GPS tracks and the diary builds itself from them (timeline, map, route, slideshow). This page says which personal data is processed and why. There is no advertising, no tracking, no analytics service and no AI processing of your content.

1. Controller

Robert Metzner
Willdenowstraße 10
Berlin
Deutschland

Email: info@robertmetzner.com

2. Visiting the website and server logs

When you open the site the server processes, as technically required, your IP address, date and time, the requested address, the status code and your browser type (server log files). This serves safe and stable operation and the defence against abuse; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in operation and security). Logs are kept only as long as that requires. To protect against abuse (for example sign-in attempts) the server also keeps short-lived counters per IP address or account.

3. Account

For an account we store your email address, a name, your password (only as a hash, never in plain text) and the settings you choose (language, time zone, optionally a profile text, profile picture and a private home location used as a route suggestion). If you switch on two-factor sign-in, the (encrypted) secret and recovery codes are added. For the list of your signed-in devices we remember per session the browser/device and a hint of the IP address. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR); for the session list and protecting the account Art. 6(1)(f).

4. Your content

You decide what you upload: photos and videos, GPS tracks, text, places. We store the files with their metadata (for example capture time, camera and, for photos with GPS data, the place where they were taken) and previews generated from them. From the places the service can add place names and the weather at the time (see section 7). The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

Every file is encrypted with its own random key of your account before it is written to object storage (encryption at rest) and is not publicly reachable there. This is not end-to-end encryption: the server decrypts files to deliver them to you, so technically the operator could also access them. We do not do so without cause (for example a report of illegal content or your explicit request for help).

5. Visibility and sharing

Trips are private by default. You can share them with chosen people (invitation), via a secret link, or make them public. Anyone with access sees the photos, text and, if you leave "show locations" on, places and routes. For public trips remember that the content is available to everyone and that people and places in it may be recognisable. You can renew a secret link at any time; the old one then stops working.

6. Emails

We only send mail the service needs: address confirmation, password reset, security notices (for example a changed password), invitations, data export, notices about account deletion and inactivity and, at your request, upgrade requests. There is no newsletter and no advertising. The legal basis is Art. 6(1)(b) GDPR.

7. Maps, place names, weather and routes

These features are optional and only active if the operator has switched them on.

Map tiles: your browser loads the map images directly from a map provider (by default OpenFreeMap, or a provider you entered such as MapTiler). For technical reasons the provider sees your IP address and the map section shown, but no data from your account. The legal basis is Art. 6(1)(f) GDPR (displaying the map).
Place names, place search, weather, routes: for these the server (not your browser) sends coordinates and times, but no names, account or file data, to Nominatim (OpenStreetMap), Open-Meteo and a routing service (for example FOSSGIS OSRM), or to a provider whose key you stored yourself. We cache results so they need not be requested again. For your own keys the terms of that provider apply, with whom you have your own contract; your keys are stored encrypted in your account and never shown again.

8. Cookies and storage on your device

Grus only uses cookies and local storage that are needed for operation or for settings you make yourself (§ 25(2) no. 2 TDDDG). There are no advertising or analytics cookies, which is why we show no cookie banner.

Sign-in: a cookie that keeps you signed in (HTTP-only, this website only, ends with the session or when the sign-in expires). The Android app (and an app-only build of the website) keeps a sign-in token in protected app or local storage instead.
Display settings: cookies for view (grid/list), size and visibility of the panels (map, stage, timeline), map options (3D terrain, tracks), slideshow (interval, loop) and info overlay; up to one year.
Language and colour mode: your chosen language and whether the site is light or dark.
Local storage: the place you last had open in a trip ("continue where you left off", at most 90 days), notices you dismissed, the interim state of a running track recording and a small technical log of sign-in events (no password, token or email address) for troubleshooting. This data does not leave your device.
Offline storage (service worker): the web app may cache its own program files so it starts faster; your photos are not part of that.

You can delete cookies and site data in your browser settings at any time; you then have to sign in again and re-set your preferences.

9. Recipients and processors

For hosting, file storage and email delivery we use service providers who support us only on our instructions and under a data processing agreement (Art. 28 GDPR):

Server hosting: Hostinger
File storage (object storage): Intercolo

We do not pass data on otherwise unless legally required. Data is transferred to countries outside the EU/EEA only if a map provider you chose is based there or a service provider is; the transfer then relies on an adequacy decision or standard contractual clauses.

10. Retention and deletion

Account data and content stay until you delete them or your account. When you delete the account a grace period (14 days by default) lets you restore it; afterwards the account, content and files are removed for good.
Free accounts nobody has signed in to for a long time are deleted automatically after two warning emails; the period is stated in the warning email and in the terms of use.
Deleted content may remain in backups for a limited time, if the operator keeps any, and is overwritten as they rotate.
Server logs are kept only briefly (section 2).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Much of this works directly in the app: under Account → Data you export all content as a ZIP archive and delete your account. For anything else write to info@robertmetzner.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live or where we are based.

12. Obligation to provide data, automated decisions

Without an email address and password we cannot create an account. There is no automated decision-making or profiling under Art. 22 GDPR.

13. Changes

If the app or the law changes we will adapt this policy. The version published here applies.