Privacy Policy — "Where is our car parked?"
Last updated: 6 August 2026
Controller
Stefan Heinsen
Sternstr. 31
39104 Magdeburg, Germany
Email: where.is.it@hidi.rocks
The short version
Your location data is never stored on any server. The parking position is kept only locally on your phone. The app has no accounts, no ads and no analytics/tracking services.
What data does the app process?
- Location: While your phone is connected to your car via Bluetooth, the app measures the position exclusively on the device. When the connection is lost, the last stop is saved as the parking position locally only. No transmission to the developer or third parties takes place.
- Bluetooth device: Name and address of the car device you selected are stored locally only, to detect the connection.
- Sharing (optional): Only if you set up a sharing group, the parking position is transmitted end-to-end encrypted (ChaCha20-Poly1305) to the phones of your group. The key is known exclusively to the devices that scanned your QR code. Transport uses a relay server (Cloudflare Workers) and Google Firebase Cloud Messaging for delivery. Both only see encrypted data and store no position data. The relay stores and logs nothing; transport services technically see metadata (e.g. delivery time, pseudonymous device identifiers used by Firebase).
Map display (Google Maps)
The map inside the app is rendered by Google Maps (Google Ireland Limited). While the map is visible, the app fetches the map tiles you are looking at from Google. Google therefore learns which area you are viewing — and since that area normally contains your parking position and your own location, Google effectively learns both. Google's privacy policy applies (https://policies.google.com/privacy).
This is the only point at which normal use sends data to a third party. It happens only while the map is on screen, and it is independent of how the parking position is stored — that stays local either way.
If you would rather it did not: the map can be switched off in the settings. The app then shows only the arrow and the distance to your car and fetches no maps at all. For walking navigation the app hands over to whichever map app you have set up on your phone — that may be Google Maps, but equally an offline one such as Organic Maps or OsmAnd.
What the app does NOT do
- no storage of geo data on servers
- no accounts, no registration
- no ads, no analytics/tracking SDKs
- no selling of data and no sharing with third parties — with the single exception of the map display described above
Permissions
- Location (including background): required to determine the parking position exactly at the moment you leave the car — the app is closed at that time. While driving, a persistent notification shows that location is active.
- Bluetooth: detects connection/disconnection with your car.
- Notifications: shows "parking position saved" etc.
- Camera (sharing only): exclusively for scanning the QR code when setting up a group.
Other data stored locally
- Earlier parking positions: The app keeps the last three positions per car so that one set by mistake can be taken back. They stay on the device and are never transmitted.
- Queued messages: If there is no network when you park, or the objection period you chose is still running, the already encrypted message is held locally and sent later. It contains the same ciphertext that would be transmitted anyway. It is discarded after 24 hours.
- Origin of shared positions: A received parking position is stored together with the sender's pseudonymous device identifier, so the app can show who parked. The app generates that identifier randomly; it contains no device or personal data.
Rating prompt
After several successful uses the app may show the Google Play in-app review dialog once. That dialog belongs to Google Play; the app is not told whether or how you rated, and transmits no data for it.
Retention and deletion
All data lives locally on your device. You delete it by overwriting the parking position, leaving the group, or uninstalling the app.
The app does not take part in Android's cloud backup. Your parking positions and your group's key are never backed up to Google — uninstalling really does remove them. The trade-off: when you switch phones, you set up the group and the car again.
Your rights
Under the GDPR you have rights to access, rectification, erasure and to lodge a complaint with a supervisory authority. Since the app does not transmit personal data to the developer, the developer holds no data about you that could be disclosed or deleted. Questions: where.is.it@hidi.rocks