Deutsche Fassung

Privacy Policy

Last updated: 20 October 2026

This translation is provided for convenience. Only the German version is legally binding.

This policy covers the Abmarsch app (phone, watch, widget) and the website abmarsch.app.

In short

• Abmarsch works without an account. Then your appointments, places, plans and profile stay on your device.
• You only need an account for the family and to link a subscription to your account.
• Location is only used around planned appointments. Free time does not exist for the app.
• Your live position only leaves the device end-to-end encrypted, only during an active appointment, only within the shared time window and only to family members you also share that appointment with on the live map. We cannot read it.
• If you are under 16, you share nothing in the family until an admin of your family who is of age has consented.
• No ads, no analytics or tracking services, no sale of data.
• You can object to any processing based on our legitimate interest (section 20).

1. Controller

eastfreak Studios, owner Steffen Kilian, Semperstraße 3d, 01069 Dresden, Germany, email: kontakt@abmarsch.app. We have not appointed a data protection officer because there is no legal obligation to do so. For any privacy question, contact us at kontakt@abmarsch.app.

2. Without an account: everything on your device

The app stores this data only locally on your device: places, appointments with legs, times and repetition, routine steps, exceptions, past trips, statistics and badges, settings, your profile (name, birth year if you gave it, country, region, tone, profile photo) and a diagnostics log (14 days). Without an account, none of it is sent to us. Even without an account, the app queries our timetable server (timetable, map, weather and new app version, section 4) and checks via RevenueCat whether a subscription exists (section 11) – in both cases without your appointments, places or profile.

The app sets no cookies and uses no advertising ID. Which identifiers it creates on your device for individual features is described in sections 8, 9 and 11.

• Backup: If your phone's device backup is on (Google account or iCloud), the operating system includes this data. You control this in your phone's settings.
• Export and import: Under "Profile → My data" you can create a file with your data and read it in on a new phone. The file is created on your device and you decide where it goes. It never contains your private key or sign-in data.
• Read aloud: Reading steps aloud uses your operating system's speech output on the device.
• Widget: The home screen widget shows data that is already on your phone.
• Learning suggestions: The app analyses your past trips only on your device to make suggestions (e.g. "Plan 5 more minutes"). The result never leaves the device, and nothing changes without your consent.

3. Location and motion

Purpose: detecting when you leave and arrive, calculating your time buffer and warning you when time gets short.

• Geofences around the start and destination of your routes (managed by the operating system)
• Precise location (GPS) only from the start of a planned trip until arrival; a visible notification runs during this time
• The phone's motion detection (walking, riding, standing still) and – if you use a watch – the watch's steps, so that the leave alarm only ends when you really move

This analysis happens on your device. Location data only leaves the device in the cases described in section 4 (timetable and weather requests) and section 6 (family). On Android the operating system determines your location via Google Play services; whether data goes to Google depends on your phone's location settings (e.g. "Google Location Accuracy"), not on Abmarsch. Legal basis: Art. 6(1)(b) GDPR (providing the app you want to use). You can revoke the permissions at any time in your phone's settings; the app can then no longer detect when you leave.

4. Bus, train, map and weather

For stop search, connections, departures and real-time data, the app queries our own timetable server (Hetzner Online GmbH, data centre Falkenstein, Germany). Search terms, stops, coordinates of start and destination (for "Here" your current location) and the times of the request are transmitted – without any link to your account. Map images also come from our server, and once a day the app checks there whether a new version is available. Legal basis: Art. 6(1)(b) GDPR.

We do not keep access logs. Your IP address is held only briefly in memory to block too many requests within a minute. If a request fails for technical reasons, the server's error log may contain the request with the IP address; we use it only for troubleshooting, and it is deleted automatically after 14 days at the latest. Legal basis for this: Art. 6(1)(f) GDPR (secure operation).

Weather: For the "degrees and weather" display on "Today" and the "Despite the rain" badge, the app likewise only asks our server. It transmits the coordinates of the start or destination of your trip, rounded to two decimal places (about 1 km), and the time – never your GPS position, without any link to your account. Our server fetches the open data of the Deutscher Wetterdienst (German Meteorological Service) via Bright Sky (brightsky.dev); only the rounded place and the time go there, not your IP address. The answer stays on your device for about an hour. Whether it rained during a trip is stored only on your device. Legal basis: Art. 6(1)(b) GDPR.

Data sources: timetable data DELFI e.V. (CC BY 4.0), real-time gtfs.de (CC BY-SA 4.0), maps © OpenStreetMap contributors (ODbL), school holidays OpenHolidays API (ODbL), weather data Deutscher Wetterdienst (CC BY 4.0).

5. Account (optional)

You only need an account for the family and so that a subscription applies to your family. Sign-in:

• Email code: We send you a code by email. The email is sent via our mailbox at STRATO AG (Germany).
• Google or Apple (iPhone only): We receive your email address and an identifier from them, never your password. Google and Apple may also send your name and the address of your profile picture; our sign-in service stores them with the sign-in data. If you have not entered a name in the app yet, the app suggests your first name from it; you can change it. We do not use the profile picture from Google or Apple.
• Password: only exists for individual accounts we created, for example for review by the app stores.

With an account we store: email address and sign-in times, display name, your birth year (once you join a family or enter it in your profile, section 7), country, region, tone, optionally your profile photo, and per device a public key for encryption, the push token, the platform, the app version and when the device last checked in. For each sign-in the sign-in service stores a session with the IP address and a technical identifier of the app (user agent) until you sign out or delete your account. When you sign out, we remove this device's registration (push token and public key) from the server. Your places stay on the device. In addition, our hosting provider keeps technical logs of requests to the server (including IP address, time, function called), which it deletes after a few days (at most 7 days on our plan).

Hosting: Supabase Inc. (USA), data in the Frankfurt am Main data centre (EU), data processing agreement under Art. 28 GDPR. Possible access from the USA (e.g. maintenance by the provider) is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(b) GDPR; for sessions and logs also Art. 6(1)(f) GDPR (protecting your account and our servers against misuse).

6. Family

A family has members and admins. Whoever founds the family is an admin; admins invite and remove members, rename the family and make others admins. There are no fixed roles such as "parent" or "child". Every member can give themselves a label (e.g. "Papa", "Oma"); it is only a name and carries no rights. You can only join by invitation (code, QR code or link, valid for 24 hours, single use) and can leave the family at any time; all sharing in this family then ends. The family is part of Abmarsch Plus. When Plus ends, the family is paused: nothing is shared any more, not even status, and no new agreements or nudges are created. Family data already stored stays until someone leaves the family or deletes their account.

What the family sees and what is stored on our server for this:

• Family name, members, admins, labels, display names and profile photos, and whether a member is under 16 (section 7)
• Sharing: which appointment you share with whom (status or also the live map), in which time window and whether you have paused sharing. You share your own appointments yourself, at the appointment under "Share with"; the other person accepts. Others can ask you with "Ask to share"; nothing is shared until you agree.
• Shared appointments: If you share an appointment, it is stored on the server: name, start and destination with name and coordinates, legs with stops and line geometry, times and repetition, and routine steps. This also applies to appointments you agree on with someone or take over from someone (see agreements). If you are under 16 and an admin of your family has consented, all your appointments are stored on the server (section 7). Your saved places stay on the device.
• Appointment status (only for the people you share it with): planned arrival, left, buffer, arrival forecast, arrived, late, missed train, cancelled with reason. From this the server generates notifications, even if your phone is off (e.g. "has not left", "not on time", "no response").
• Live position (only for the people you also share the appointment with on the live map): Your device encrypts each position individually for each recipient device (X25519, ChaCha20-Poly1305). The server only stores the encrypted text and cannot read it. Your device decides whether anything is shared at all: only during an active appointment, within the shared time window and only to these people. Sharing ends on arrival. A banner always shows you whether and with whom you are currently sharing. You can pause, lower or stop sharing; this takes effect immediately.
• View log: when someone viewed your appointment or position. You can see it at the appointment.
• Agreements: appointment suggestions (the complete appointment; it only applies once the person concerned taps "Accept"), set times and "When should I be there?" questions with place, time and an optional message (up to 80 characters), replies ("Works for me!", "Other time"), "Off?" questions for one day of an appointment, cancellation and rescheduling requests at the alarm with a reason (selection or short text of up to 80 characters) and new time, day exceptions with a note. If you say "Works for me!" or accept a suggestion, the resulting appointment is automatically shared with the person you agreed it with – status only, not the live map. The app tells you this right when you tap.
• History: Whoever an appointment is shared with sees its results for the last 28 days (on time, late, cancelled with reason) – never positions.
• Notification settings: which notifications a member wants to receive per person and event.
• Nudges and requests to share: short messages (up to 80 characters; nudges at most 3 per hour).

Legal basis: Art. 6(1)(b) GDPR for the family features you use. For sharing status and location, your consent under Art. 6(1)(a) GDPR – you give it when you share an appointment, say "Works for me!" or accept a suggestion. For members under 16, consent under Art. 8 GDPR is also required (section 7). Sharing more only happens if you agree; sharing less and revoking work at any time, immediately, in the app.

7. Children and teenagers under 16

• Abmarsch is also aimed at children. Without an account everything stays on the phone (section 2).
• Birth year: When you join a family, the app asks for your birth year once; you can change it under "Profile → Edit profile". We only use it to determine whether you are under 16; the year in which you turn 16 still counts as under 16. It is stored on your device and, if you have an account, in your profile on our server. The family only sees "under 16", not the year. We do not check the age with an ID document or similar. Without a birth year you cannot join a family. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR (we have to know whether sharing requires the consent of a person with parental responsibility).
• Under 16 only after consent (Art. 8 GDPR): A member under 16 shares nothing with the family – no status, no position – until an admin of the family who is of age (at least 18) has consented. Only someone who has parental responsibility for the child or is authorised by the persons who have it may consent; the admin confirms this in their app. We store who agreed to which version and when. We do not check with an ID document or similar whether someone really has parental responsibility, so as not to collect more data than necessary; whoever consents confirms it.
• What is shared afterwards: The child decides which appointments to share with whom (status or also the live map). Appointments the child agrees on with someone ("Works for me!") or takes over from someone ("Accept") are shared with that person as status (section 6). Once an admin has consented, all of the child's appointments are stored on the server; apart from the child, only an admin who has consented can see them – so you can plan together. This admin, too, only sees status and position for appointments the child shares with them.
• The consent can be withdrawn at any time in the family. If nobody else has consented, sharing then ends immediately.
• Calling off at the alarm: If a member under 16 wants to call off an appointment at the alarm, the app asks the family's adult admins; the first answer counts. From 16, everyone calls off on their own.
• Nobody changes a child's appointments, times or sharing directly: suggestions and agreements only apply once the child agrees.
• Whoever shares always sees on their device whether and with whom they are currently sharing.
• From 16, every member decides alone what to share; no consent is needed any more.
• No ads, no tracking, no disclosure of children's data for advertising purposes. Abmarsch does not lock any phone.

8. Notifications (push)

Reminders and alarms for your own trip are created by the app on the device. For notifications from the family and from the server we use Firebase Cloud Messaging of Google Ireland Limited (data processing on our behalf); the device is only registered for this once you use an account. The push token, an installation identifier, technical device data (model, operating system, app version) and the text of the notification are transmitted, for example "Max has left" or a nudge. We do not use Firebase's analytics features. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR; the token and installation identifier on the device are strictly necessary for the family notifications you use (§ 25(2) no. 2 TDDDG). You can turn off notifications in your phone's settings.

We count per hour and channel how many notifications were delivered or failed – without any link to persons (section 13).

9. Camera and QR code

The app only uses the camera when you scan an invitation QR code, and for your profile photo if you take one. On Android, the QR code is recognised by Google ML Kit, which is built into the app, directly on the device; on iPhone, Apple Vision recognises it on the device without sending any data to Google. In both cases: camera images are not transmitted. When scanning on Android, ML Kit creates an installation identifier on the device and sends technical usage data to Google (device model, operating system, app version, performance values, this identifier) so that Google can operate and improve the service. Before your first scan, the app shows you a notice about this and asks whether you want to continue. Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by no longer using the scanner and typing in the code instead; ML Kit is then not used.

10. Watch (Wear OS)

The Wear OS watch app shows your trip on your wrist and reports ticks, cancellations and steps to your phone. The data travels via the operating system's device pairing (Google Play services) only between your own devices. We do not receive this data. The same applies to the Apple Watch app (pairing via iOS).

11. Subscriptions, purchases and store

You buy Abmarsch Plus via Google Play or the App Store. In the EU and the EEA you conclude the purchase contract with the store (in Switzerland with us, see Terms of Use, section 7); the store handles payment and processes your payment data under its own responsibility. We do not see any payment data.

To manage subscriptions we use RevenueCat (RevenueCat Inc., USA, data processing on our behalf). So that the app knows whether Plus is active, it creates a random identifier on your device (with an account: your account identifier) and asks RevenueCat for the subscription status in the background. RevenueCat receives this identifier, purchase data (product, times, store, receipt), technical device data and the IP address – no location or route data. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). So that Plus applies to your whole family, we store on our server whether and until when your account has an active subscription (plan, product, store, expiry date). RevenueCat reports this to our server when your subscription changes. If you create an invitation or join a family and our server does not know your subscription yet (e.g. because you bought it before signing in), our server asks RevenueCat for the subscription status using your account identifier and stores the result. Legal basis: Art. 6(1)(b) GDPR; the identifier on the device is necessary to unlock Plus (§ 25(2) no. 2 TDDDG).

Ratings and updates: If the app asks you for a rating or offers an update, it uses the dialogs of Google Play or the App Store. What you enter there is processed by the store under its own responsibility; we only see public ratings.

12. "Report a problem"

Only if you tap "Report a problem" in the app does the app create a report, and it shows you the complete report first: app version, operating system, device model, plan, state of permissions, the last 10 trips (date, result, causes) and the diagnostics log – never coordinates. It only reaches us if you send it yourself via your email app or share it as a file. We only use it to solve your problem. Legal basis: Art. 6(1)(b) GDPR.

13. Operational data (not personal)

So that we notice outages quickly, our server regularly checks whether all components are running. For this we only store operational values: results of the checks, response times, server load, counters for notifications per hour, an error log of the server functions (identifiers, email addresses and coordinates are removed before saving) and usage figures only as totals (e.g. number of accounts, families, trips per day, share of on-time trips). Never individual persons, names, identifiers or places. If you use the app without an account, you do not appear in it at all. Retention: 35 days. Legal basis, should a personal reference arise after all: Art. 6(1)(f) GDPR (secure and reliable operation).

We do not collect crash reports ourselves. Google and Apple provide us with aggregated crash statistics if you have allowed your phone to share diagnostic data with the manufacturer.

14. This website

The website abmarsch.app runs on our own server at Hetzner Online GmbH in Germany (data processing under Art. 28 GDPR). When you visit it, the server necessarily processes your IP address to deliver the page. We do not keep access logs (for the error log see section 4), set no cookies and use no analytics or tracking services. Fonts, maps and program libraries are hosted on our server; no content is loaded from Google Fonts or other third-party servers. Legal basis: Art. 6(1)(f) GDPR (secure operation of the website).

Planner "When do you need to leave?": Your browser sends the places you enter and the arrival time to our timetable server; we do not store these requests. If you tap "Remember start" or "Remember destination", your browser stores the name and position of that place only locally (localStorage); you remove it with "×" or by clearing the website data. Legal basis: § 25(2) no. 2 TDDDG, because you explicitly request the storage. If you tap "My location", your browser asks for permission; only then is your location sent once to our server for this query and not stored. Legal basis: Art. 6(1)(a) GDPR.

Invitation links: The page abmarsch.app/join only displays the invitation code from the link if the app is not installed. Nothing is stored.

15. Contact by email

If you write to us at kontakt@abmarsch.app, we process your message and address to reply to you. The emails are stored at our mail provider STRATO AG in Germany (data processing on our behalf). We delete them when they are no longer needed, at the latest after 2 years, unless there is a statutory retention obligation (e.g. for business letters). Legal basis: Art. 6(1)(b) GDPR if it concerns your use of Abmarsch, otherwise Art. 6(1)(f) GDPR (answering your enquiry).

16. Recipients and transfers to third countries

• Supabase Inc. (account and family data, Frankfurt data centre) – processor; EU Standard Contractual Clauses for access from the USA
• Hetzner Online GmbH (timetable server, maps, weather, website, Germany) – processor
• STRATO AG (email, Germany) – processor
• RevenueCat Inc. (subscription management, USA) – processor; EU Standard Contractual Clauses
• Google Ireland Limited (Firebase Cloud Messaging) – processor; possible transfer to Google LLC (USA) under the EU-US Data Privacy Framework
• Google (ML Kit, Google sign-in, Google Play) and Apple (Apple sign-in, App Store) – responsible for their own services
• Bright Sky (brightsky.dev, weather data of the Deutscher Wetterdienst) – receives from our server only rounded places and times, nothing that points to you
• Members of your family – only what you share or agree on with them; for members under 16 also their appointments for the admin who consented (section 7)

We do not sell data and do not pass it on for advertising.

17. Retention

• Data on your device: until you delete it or remove the app; diagnostics log 14 days
• Live positions (encrypted): 24 hours
• Trip events: 30 days
• Trips (status and result): 90 days
• View log: 30 days
• Invitations: valid for 24 hours, deleted 7 days after expiry
• Decided agreements and requests: 90 days; day exceptions (e.g. "sick today"): 30 days after the day
• Nudges: 30 days
• Sharing levels and push settings: until changed, until you leave the family or until the account is deleted
• Consents for members under 16: until withdrawn or until the member or the admin who consented leaves the family
• Membership, admin status and label: until you leave the family or delete the account
• Devices that have not checked in for 180 days: deleted
• Sign-in sessions: until you sign out or the account is deleted; technical logs of the hosting provider: at most 7 days
• Error log of the timetable and web server: deleted automatically (section 4)
• Operational data (section 13): 35 days
• Account, profile (including birth year), profile photo, shared appointments and subscription status: until the account is deleted (in the app under "Profile → My data" or at abmarsch.app/konto-loeschen). All data of the account is deleted, as are families that no longer have any members, and your purchase data at RevenueCat. If you signed in with Apple, we also revoke Abmarsch's access at Apple; Apple only receives the sign-in identifier for this.
• Purchase data at RevenueCat without an account: as long as the app needs it to check the subscription; we will have it deleted on request. Store receipts are kept by Google or Apple according to their rules.

18. Mandatory or optional, no automated decisions

You are not obliged to give us any data. Without the location permission the app cannot detect when you leave; without an account there is no family, and without a birth year you cannot join a family. We do not make automated decisions that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). The app calculates learning suggestions only on your device (section 2).

19. Data security

All connections of the app and the website are encrypted (HTTPS/TLS). Live positions are end-to-end encrypted; the private key is kept only in your phone's protected storage (Android Keystore or iOS Keychain) and never leaves it, not even in the export. On the server, access rules in the database ensure that each member only sees the data of their own family.

20. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)), in the app at the appointment under "Share with" or in the family; for QR scanning, by typing in the code (section 9). In the app under "Profile → My data" you can export your data and delete your account. Send all other requests to kontakt@abmarsch.app; we reply within one month.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR – named in sections 4, 5, 13, 14 and 15), you can object at any time on grounds relating to your particular situation. We will then no longer process this data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal message to kontakt@abmarsch.app is enough.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany (post: Postfach 11 01 32, 01330 Dresden), www.datenschutz.sachsen.de. Users in Switzerland can also contact the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

21. Changes

We update this policy when the app or the legal situation changes. You can find the current version in the app and at abmarsch.app/en/privacy.