Privacy Policy — Real World Completionist

Last updated: 25 May 2026

This policy explains what personal data Real World Completionist ("the app") handles, on what legal basis, where it goes, how long it is kept, and what your rights are. It is written to satisfy Article 13 of the EU General Data Protection Regulation (GDPR) as well as comparable disclosure obligations in other jurisdictions.

For the legally-required publisher and contact details (Impressum / § 5 DDG), see the separate Impressum page.

Controller

The data controller within the meaning of Art. 4(7) GDPR is the publisher named in the Impressum linked above. Contact for privacy-related questions: realworldcompletionist@pm.me.

Data Protection Officer

We have not appointed a Data Protection Officer (DPO). Under Art. 37 GDPR and § 38(1) BDSG, designation of a DPO is only mandatory where, inter alia, the controller's core activities consist of large-scale regular and systematic monitoring of data subjects (Art. 37(1)(b) GDPR), the large-scale processing of special categories of data (Art. 37(1)(c) GDPR), or at least 20 persons are permanently engaged in automated processing of personal data (§ 38(1) BDSG). None of these conditions apply to this single-developer, server-less application.

For privacy-related enquiries, please contact the data controller directly via the channels listed at the bottom of this policy.

Summary

• The app reads your precise GPS location only while a walking session is active. Tracking starts when you tap Start and stops when you tap End.
• Location data is stored locally on your device. It is not uploaded to us; we do not operate any server that receives it.
• The app contacts two third-party services for map data and offline tiles. Each call is described in detail below.
• The app contains no analytics, no advertising SDKs, and no crash-reporting services that send data off your device.
• You can export, import, or delete your data at any time from inside the app.
• We do not perform any automated decision-making or profiling within the meaning of Art. 22 GDPR.

What data the app processes

Precise location (GPS)

• What: Your device's coordinates while a walking session is active.
• Purpose: To record which streets you have walked and to render your live position on the map.
• Lawful basis: Your consent (Art. 6(1)(a) GDPR), granted when you accept the operating system's location-permission prompt. You may withdraw consent at any time by revoking the permission in your device's system settings; withdrawal does not affect the lawfulness of processing already carried out.
• Voluntary: Providing location is voluntary. Without it, the core walking-session feature does not work, but you can still use Manual Entry mode to mark streets after the fact and the rest of the app remains usable.

Areas, sessions, and routes you create

• What: The geographic boundaries you draw, the names you give them, your settings, and your walking history. Stored locally in the app's database on your device.
• Purpose: Persistence between app launches.
• Lawful basis: Performance of your use of the app (Art. 6(1)(b) GDPR) and your continued consent.
• Not transmitted. Nothing in this category is uploaded by us.

Background location

• What: Continued GPS access while the session is active and the app is in the background or the screen is locked.
• Purpose: So tracking doesn't stop when your phone is in your pocket mid-walk.
• Lawful basis: Your explicit operating-system-level consent.
• You can revoke this at any time in system settings.

Storage on your device (§ 25 TDDDG)

Some of the data described above — your settings, your saved areas, your session history, and the app's local SQLite database — is stored on your device's local file system. Under § 25 Abs. 1 of the German Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, the German implementation of the ePrivacy Directive), accessing or storing information on a user's terminal device generally requires the user's explicit consent.

We rely on the strictly-necessary exemption in § 25 Abs. 2 Nr. 2 TDDDG: the storage operations performed by the app are unbedingt erforderlich to provide the telemedia service you have expressly requested by installing and using the app — without storing your areas and session history on the device, the core completionist functionality cannot work. No data is stored on your device for analytics, profiling, advertising, or any purpose other than delivering the app's functionality.

What data leaves your device, and when

The app contacts two third-party services. Each is contacted only at specific moments, and each receives only the data described below. The app does not send either of these services your identity, your full session history, your saved areas, or any account information — there is no account.

1. Overpass API (overpass-api.de)

• When: Only when you create a new area, refresh road data for an existing area, or import an area from a backup file.
• What is sent: The bounding-box coordinates of the area you defined.
• What is received: OpenStreetMap road data for that bounding box.
• Why: The app needs the underlying road network to mark streets as walked.
• Operator: Overpass API is operated by volunteers as part of the OpenStreetMap ecosystem. See overpass-api.de.

2. OpenFreeMap (tiles.openfreemap.org)

• When: Whenever the map is rendered, so tiles can be fetched or refreshed.
• What is sent: Tile coordinates derived from the area you are looking at, and your IP address at that moment.
• What is received: Vector map tiles for the requested area.
• Why: OpenFreeMap supplies the visual map background.
• Operator: OpenFreeMap is a community-run free tile host. See openfreemap.org.

Neither of these services is run by us. We do not control what they log, but we send them only the minimum data required for the feature you triggered.

International transfers

The servers operated by the third parties listed above may be located within or outside the European Economic Area (EEA). The data the app sends in each call (bounding-box coordinates for Overpass; tile coordinates for OpenFreeMap) is technical map-data, not personal data within the meaning of the GDPR once detached from your IP address. Your IP address is briefly visible to OpenFreeMap at request time. No adequacy decision (Art. 45 GDPR) or supplementary safeguard (Art. 46 GDPR) is required for the transfer of non-personal map coordinates; the IP address exposure is incidental to ordinary HTTP and is governed by each service's own policy. See the linked operator pages above.

What data we collect ourselves

None. We do not operate any server that receives data from the app. There is no analytics SDK, no crash-reporting SDK, and no advertising SDK that exfiltrates data. We have no user-account system and therefore no user list, no email database, and no usage profile.

How long data is kept

• On your device: until you delete it. You can delete individual sessions, individual areas, or wipe everything via Settings → Data → Erase all data. Uninstalling the app also removes the local database.
• At Overpass / OpenFreeMap: governed by each of those services' own logging and retention policies. See their respective websites.
• By us: nothing. We do not receive your data, so we have nothing to retain.

Your rights under the GDPR

You have the following rights regarding the personal data processed during your use of the app:

• Right of access (Art. 15 GDPR) — your data lives on your device and is exportable any time via Settings → Data → Export backup. The export contains the complete record we hold because we hold none separately.
• Right to rectification (Art. 16 GDPR) — edit area names, delete and re-create sessions, etc., directly in the app.
• Right to erasure / "right to be forgotten" (Art. 17 GDPR) — Settings → Data → Erase all data, or uninstall the app.
• Right to restriction of processing (Art. 18 GDPR) — revoke the location permission in your system settings; the app stops reading location immediately.
• Right to data portability (Art. 20 GDPR) — exported backups are JSON in an open, documented format suitable for transfer to any other system that can read JSON.
• Right to object (Art. 21 GDPR) — withdraw location-permission consent at any time.
• Right to withdraw consent (Art. 7(3) GDPR) — same as the right to object; revoke the permission.
• Right not to be subject to automated decision-making (Art. 22 GDPR) — the app performs no automated decision-making or profiling.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — if you believe our processing of your personal data infringes the GDPR, you may lodge a complaint with your local data protection authority. In Germany, this is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit of the federal state where you live; a list of contacts is published by the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit at bfdi.bund.de.

If you wish to exercise any of these rights against us in writing, contact us via the contact form, by email at realworldcompletionist@pm.me, or at the postal address in the Impressum.

Permissions the app requests

• Location (precise, foreground + background) — required for session tracking. Used only during active sessions.
• Notifications (Android) — required so the foreground-service notification can show while a session is active. The notification displays session status only (elapsed time, distance, coverage); it does not contain location.
• Network — required to fetch road data and map tiles.

You may revoke any of these permissions through your device's system settings at any time. The app degrades gracefully (no tracking, no map tiles) rather than crash.

Children's privacy

The app does not knowingly target users below the age of 13 (US) / 16 (EU, depending on the Member State). The app has no account system and collects no profile data, so it neither knows nor needs to know a user's age. If you believe a child has used the app and you have a privacy concern as their parent or guardian, please contact us at the email above.

Changes to this policy

If we change this policy, the Last updated date at the top changes too. Material changes are additionally noted in the in-app changelog (Settings → About → What's new) so you have a chance to review them.

Open-source attributions

• Map data © OpenStreetMap contributors.
• Map tiles supplied by OpenFreeMap.
• Road data fetched from the Overpass API.

Contacting us

You can reach us through any of the following channels:

• Contact form: https://tally.so/r/rjkJkp (in German)
• Email: realworldcompletionist@pm.me
• Postal address: see the Impressum

If you use the contact form, the form is provided by Tally (Tally BV, Antwerp, Belgium), which acts as our processor under Art. 28 GDPR. Tally receives the data you enter and forwards it to us by email; details of Tally's own processing are in their privacy policy. The lawful basis for processing the data you submit via the form is your consent (Art. 6(1)(a) GDPR), obtained through the consent checkbox on the form itself, and — where applicable — Art. 6(1)(b) GDPR for messages relating to the use of the app. We delete form submissions once your enquiry has been handled, in any case at the latest six months after receipt, unless a statutory retention obligation requires longer storage.