Privacy Policy — Streckenblick

Effective: 23 October 2026

This policy describes which personal data the Streckenblick app (iPhone, Android, Apple
CarPlay, Android Auto, Android Automotive, Apple Watch) and our servers at streckenblick.de
process, for what purpose, on what legal basis and for how long. The German version
(Datenschutzerklärung) is equivalent; this English version is provided for convenience.

1. Controller

Mahdi for Programming and Investment SPC (OmniLeb Tech)
Airport Heights 128, Ghala, Building 128, 6th Floor, Apartment 64, Muscat 1111, Oman
Represented by: Ahmad Berro
Email: ahmdberro50@gmail.com

We are established outside the European Union. Because we offer the service to people in
the European Union, the General Data Protection Regulation applies to our processing
(Art. 3(2)(a) GDPR).

Our representative in the European Union under Art. 27 GDPR:
{{EU_REPRESENTATIVE}}

You and the supervisory authorities may address our representative on any question about
the processing of your data, in addition to us or instead of us.

2. The essentials

- There is no account with a name, email address or password.
- No advertising, no tracking, no third-party advertising or analytics software. We do not
  sell data.
- The app connects only to our server, streckenblick.de, apart from the platform services
  for notifications and the device check (sections 9 and 11). Where other third parties are
  involved, our server asks them, without passing on your IP address.
- We store and process your data on servers in the European Union, in France. The only copy
  kept elsewhere is the encrypted nightly backup on our operator's workstation (section 17).
- Reports, comments and traffic-jam measurements carry no identifier that leads back to you
  or your device.
- Before you accept the Terms of Use, the app sends nothing to our server.
- Crash reports, usage statistics and notifications about new countries and features happen
  only if you switch them on. They are off by default, and you switch them off in the same
  place you switched them on.
- Under Settings → Privacy you can export the data our server holds about your device and
  delete it (section 17).

3. Servers, connection data and logs

Our servers are operated by the hosting provider Contabo GmbH, Germany, in its data centre in
Lauterbourg, France, as our processor (Art. 28 GDPR).

With every connection the server processes your IP address, the time, the requested path,
the status code, the amount of data and the response time. The access log stores the IP
address shortened (IPv4: the first three blocks; IPv6: the first 48 bits). It does not record
request parameters, and map tiles and the identifiers of reports and comments are blanked in
the path, so positions and search terms never appear in it. We keep an error log only for
serious server errors. Both logs are deleted after 14 days. To limit abusive numbers of
requests, the server keeps the IP address (IPv6: the first 64 bits) with a counter in memory
for at most one hour.

Every request from the app is cryptographically signed. The signature proves that a request
comes from a genuine app; our server removes the identifier of the signing device before the
request is processed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable
operation and protection against abuse and overload.

4. Location

The app uses your device's location only with your permission and only while you are using
it; during an active drive also with the screen off (iOS: the "location" background mode;
Android: a foreground service with a visible notification). The app does not request
permanent background location access.

On the device, the location serves the map, route guidance, indications of hazards and
enforcement, and applying the display rules of the country you are in. It is sent to our server
in these cases: to calculate and follow a route (section 5), to show the road ahead and its
speed limit when you drive without a route (section 5), as a hint when you search for a
destination (section 5), to name places for indications ahead of you (section 5), when the app
loads the indications around you — rounded to a grid of about 1.2 km, while driving roughly
every 30 to 46 seconds, and as a subscription to the cells of that grid for live indications —
with your reports and votes (section 6), and for traffic-jam detection (section 7). These
positions are not stored with any identifier of you or your device; we do not store route or
search requests. Only the country you are driving in, not the position, reaches us with a
redeemed referral (section 10) and, if you switched them on, with usage statistics (section
13).

The legal basis is Art. 6(1)(b) GDPR where the position is needed for the function you use,
otherwise Art. 6(1)(f) GDPR (see sections 6 and 7).

5. Map, search and routing

The app loads map tiles, the map style and fonts from our server, which obtains them from
the VersaTiles map service (map data © OpenStreetMap contributors). This provider receives
from our server only the coordinates of the requested tile — neither your IP address nor any
identifier. Satellite images are currently not offered.

Our own search index answers your destination search (search text, language and, where
available, your position as a hint for ranking the results). If it finds nothing or is
unavailable, our server forwards the request to the public Photon search service of komoot
GmbH, Germany — with the search text, the language and a position rounded to about 110 m,
without your IP address. It does the same when the app asks for the name of the road and place
for up to three indications ahead of you; in that case the exact position of the indication is
passed on.

Our own routing service calculates routes. Only if it is unavailable or fails does our server
forward the request (start — usually your current position —, destination, via points,
vehicle type and route options) to the public routing service of FOSSGIS e.V., Germany,
without your IP address. The same applies to a new calculation during guidance. While you
drive without a route, the app asks for the road ahead with your current position, your
direction of travel and a point a short distance ahead; our server answers that request only
with its own routing service and never passes it on. Only app versions before the one that
introduced this change still ask for the road ahead as an ordinary route, which can reach
FOSSGIS in the same way. komoot and FOSSGIS answer such requests under their own
responsibility.

To show the speed limit while you drive without a route, the app sends up to ten of your most
recent positions, at least 25 m apart, to our server, which uses them to determine the road
you are on. During guidance it sends the course of the route for the same purpose, and when
you pick a destination, its position, so that it can be placed on the nearest road. Our server
answers these requests only with its own routing service and never passes them on to anyone
else; if that service is unavailable, the app shows no speed limit and keeps the destination
as picked.

For functions that require Plus, the server uses the account identifier (section 10) to check
whether a trial or a subscription is active; that check is not stored with the request. We
store neither search requests nor routes nor the positions described in this section. The legal
basis is Art. 6(1)(b) GDPR.

6. Reports, confirmations, votes and comments

When you report a hazard or an enforcement check (roadworks, accident, end of a jam,
obstruction, mobile or fixed enforcement), the app sends its kind and position and, if you
choose, the road name and speed limit. The server determines the country from the position.
The report is shown to other users without a name and distributed in real time to devices
nearby. No account or device identifier and no IP address is stored with it.

A report is deleted when it expires: the end of a jam after 30 minutes; roadworks, an
accident or an obstruction after 2 hours; mobile enforcement after 4 hours; and reported
fixed enforcement after 30 days — each counted from the last confirmation by other users.
Copies that other devices have received cannot be recalled; they expire there on the same
schedule.

When you confirm an indication or mark it as gone, we store only the number of answers. So
that one person cannot vote repeatedly, the server stores a hash of the IP address and the
indication, formed with a secret key — for reports until they expire, otherwise for at most
30 days; this value is in no backup.

Comments (up to 280 characters) are shown to other users. No identifier of yours is stored
with a comment. The app receives a delete key, issued once, with which you can delete the
comment on this device at any time; the server stores only its hash. A comment remains
stored until you delete it or we remove it. If three different users flag a comment as
inappropriate, it is hidden until we have reviewed it. Please do not put anything in a
comment that identifies a person, such as names or number plates.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of other users, is
current and reliable indications and protection against manipulation and abuse.

7. Traffic-jam detection

While you drive with the app, it sends the most recent positions with speed and heading to
our server about once a minute, so that standing traffic can be derived from them. The
transmission carries no identifier of any kind. The server rounds each position on arrival
to a grid of about 174 m and keeps only that grid point with speed and heading in memory;
after 15 minutes it is deleted. A journey cannot be reconstructed from it. To show jams on
your route, the app asks with a rounded position and the course of the route; we do not
store that.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of other users, is
warning of the ends of jams.

8. Enforcement data, map data, voice packs and updates

When loading enforcement data, map data and voice packs the app sends only the country or
pack requested; for the update check, the platform and app version. These requests carry no
position. Only the connection data in section 3 applies. The legal basis is Art. 6(1)(b)
GDPR.

9. Device check and abuse prevention

So that we can attribute reports and purchases to genuine devices running an unmodified app,
the app obtains a device-bound signing key. On iOS it uses Apple's App Attest service: iOS
creates a key and has Apple attest it; our server verifies the attestation itself. On
Android it uses Google Play Integrity: the app receives a verdict from Google, which our
server has Google decrypt. A random installation identifier is used for this, which we store
only as a hash.

The server stores the key with its identifier for 14 days and then deletes it; the app
renews it in time. We may refuse or limit more strictly requests without a valid key. The
key itself is held protected in the Keychain (iOS) or encrypted in app storage (Android).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the service and
its users against forged reports, automated access and purchase abuse. Access to your device
is covered by section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data
Protection Act).

10. Trial, Plus and referral codes

You make purchases with the App Store (Apple Distribution International Ltd., Ireland) or
Google Play (Google Commerce Limited, Ireland). They process your account, payment and
billing data for that under their own responsibility and privacy policies. Payment data
never reaches us.

Account identifier. To attribute the trial and purchases, the app creates a random
identifier with no connection to your person. On iOS it is held in the device's Keychain and
remains there even if you delete the app, so that the trial does not restart on reinstall;
on Android it is held in app storage. Our server stores it only as a hash. On iOS it is
passed to Apple at purchase as the account token, so that Apple's notifications about your
subscription can be matched to it. The account identifier is not stored with reports,
positions, routes or traffic-jam detection.

Trial. Against the hash of the account identifier we store when the trial started and ends.
On Android the server also asks Google Play Integrity ("Device Recall") whether a trial has
already begun on the device; for this Google stores a marker for the device and gives us only
the answer, not a device identifier. On iOS the app sends a one-time token from Apple's
DeviceCheck service with the trial request; our server asks Apple with it whether a trial has
already begun on the device, and after a new trial begins has Apple set a marker for the device.
Apple keeps two bits per device for this and gives us only the answer; we store neither the
token nor a device identifier. We keep the trial record for as long as we operate the
service, because its purpose — one trial per device — could not otherwise be achieved. If you
delete your data (section 17), it is replaced for 12 months by a one-way marker: a hash of the
account identifier formed with a secret key, with no other data and no link to the device. It
only stops the same account identifier from starting a second trial, and is then deleted.

Subscription. Apple sends us signed notifications about purchases,
renewals, cancellations and refunds, which our server verifies itself; for Google Play our
server queries the status from Google with the purchase token. Against the hash of the account
identifier we store only the source, product, expiry date, billing retry, revocation,
auto-renewal, whether it was a free test purchase, and time of the last change. We do not
store transaction numbers or purchase tokens in plain text. The record is deleted 180 days
after expiry and the last change.

Referral codes. We store codes only as a hash. When you redeem one, we store against the hash
of the account identifier the duration, times, platform and the country you last drove in.

The legal basis is Art. 6(1)(b) GDPR; for checking whether a device has already used its
trial, and for the marker after a deletion, additionally Art. 6(1)(f) GDPR — our legitimate
interest is that each device receives the trial only once. The identifier on your device and
obtaining the DeviceCheck token are covered by section 25(2) no. 2 TDDDG.

11. Notifications

So that we can send you notifications, the app transmits your device's push address with the
platform, language, the country from your region settings (not from your location), the
channels you chose, the hash of the account identifier and the time the app was last opened. On
both iOS and Android the app registers the push address only after you have allowed
notifications. On Android, Firebase Cloud Messaging in the app then creates an installation
identifier for the app (Firebase installation ID) and sends it, with technical identifiers of
our app, to Google so that Google can issue the push address; this too happens only after you
have accepted the Terms of Use and allowed notifications. Our server stores the push address
encrypted. Notifications are delivered through the Apple Push Notification service (Apple Inc.,
USA) or Firebase Cloud Messaging (Google LLC, USA); for the transfer to the USA see section 20.

There are four channels under Settings → Notifications: "Subscription and payments" (for
example three days before and at the end of the trial) and "Hazards on your usual roads" are
on by default; "Replies to what you report" and "New countries and features" are off until
you switch them on. You can switch each channel off there. Notifications may be addressed to
everyone, to a language or platform, to your account identifier, or — only in the "New
countries and features" channel — to devices on which the app has not been opened for a
certain time.

We delete the push address as soon as Apple or Google report that it is no longer valid, at
the latest when it has not been refreshed for 270 days, and when you delete your data
(section 17). The app shows the notifications of the last 60 days. Notices addressed to your
account identifier are stored until you delete your data.

The legal basis for notices about your subscription, your trial and hazards on your usual
roads is Art. 6(1)(b) GDPR; for "Replies to what you report" and "New countries and features"
it is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG, section 7(2) of the German Act
against Unfair Competition), which you can withdraw at any time with effect for the future by
switching off the channel or notifications.

12. Crash reports

Only if you switch on "Crash reports" under Settings → Privacy: if the app crashes, on the next
launch it sends the platform, app version, error message and an excerpt of the stack trace to
our server, without an identifier or position. Before a report is saved on the device, the app
removes web addresses and longer numbers, such as coordinates, from the error message and the
stack trace. On iOS this includes the crash and hang diagnostics iOS itself provides
(MetricKit). The server keeps the report for 30 days and then deletes it. If you switch crash
reports off, the app sends nothing more and deletes reports not yet sent.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can
withdraw at any time, with effect for the future, with the same switch.

13. Usage statistics

Only if you switch on "Usage statistics" under Settings → Privacy: while the app is in the
foreground it reports, about every five minutes, a random installation identifier, the
platform, the app version and the country you are driving in. The installation identifier is
not an advertising or device identifier and is not linked to any position. For each
installation the server keeps only the first and last report, platform, version and country,
and deletes the entry 35 days after the last report. We use it to count active installations
and versions, plan capacity and introduce security levels step by step. If you switch usage
statistics off, the app deletes the installation identifier.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can
withdraw at any time, with effect for the future, with the same switch.

14. Voice search

When you speak a destination, your device recognises the speech entirely on the device;
audio does not leave it. If your device cannot recognise the chosen language offline, the app
tells you so instead of sending the recording to a recognition service. Only the recognised
text is treated like a typed search (section 5). You allow access to the microphone and speech
recognition in the system dialog.

15. Moderation, notices of illegal content and operations

People who operate the service for us see in our operator console reports, comments, notices
of illegal content, shortened hashes of account identifiers, referrals, device key identifiers
and notifications, to the extent needed for moderation, support and operations. The console is
reachable only over an encrypted connection to the server; sessions expire after 60 minutes of
inactivity and after 12 hours at the latest.

You can submit notices of illegal content (Art. 16 of Regulation (EU) 2022/2065, the Digital
Services Act) with "Report" in the app, with the form at our point of contact
(streckenblick.de/contact-point) or by email. For a notice sent with the form we store the
content concerned, the category, your explanation and, if you give it, your email address, so
that we can tell you our decision; your IP address is used only to limit notices to ten per
hour and is not stored. Decided notices are deleted one year after the decision.

Every decision to hide or remove content, and every change an operator makes to how a
subscription is assigned, is recorded with the time, the name and IP address of the person
acting, the reasons and only an identifier or a hash of what was concerned, and deleted after
one year.

The legal basis is Art. 6(1)(f) GDPR; for handling notices of illegal content and stating the
reasons for decisions, Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation
(EU) 2022/2065.

16. Storage on your device (section 25 TDDDG)

The app stores on your device: your acceptance of the Terms of Use with date and version, your
choices on crash reports, usage statistics and news with date and version, your settings
including home, work and the last six destinations searched, the notification channels chosen,
the delete keys of your comments, the account identifier, the signing key, a cached
subscription status and the encrypted enforcement data; the installation identifier only while
usage statistics are switched on. With your permission it accesses location, notifications and
— for voice search only — the microphone and speech recognition. This is strictly necessary to
provide the functions you use (section 25(2) no. 2 TDDDG); crash reports, usage statistics and
news rest on your consent (section 25(1) TDDDG). Where the operating system asks, you decide
there. On Android the app's data is excluded from backups and device transfers. Deleting the
app removes the data, except the entries in the iOS Keychain (among them the account
identifier and the signing key), which iOS keeps beyond deletion of the app; "Delete all my
data" removes those too (section 17).

17. Exporting and deleting your data

Under Settings → Privacy you can do this yourself:

- "Export my data": the app fetches everything our server holds under your account
  identifier, your installation identifier and your push address — subscription, purchase
  assignments, trial, referrals, push registrations, notices addressed to you and usage
  statistics — and offers it to you as a file to save or send. The export contains no data
  about other people and no internal keys.
- "Delete all my data": in one step our server deletes every record under your account
  identifier, installation identifier and push address: subscription, purchase assignments and
  held store notifications, trial, the link to your referrals, push registrations, notices
  addressed to you and the usage-statistics entry. Only once the server has confirmed this does
  the app withdraw your comments with their delete keys, deregister the push address, and
  delete on the device the account identifier, installation identifier, signing key,
  subscription status, cached data and unsent crash reports. If the deletion on the server does
  not succeed, nothing on the device changes, and the app tells you so.

Both show a ten-character reference. We store it with its kind and time, but without any link
to you, for one year, so that we can confirm it if you write to us about it. A paid
subscription keeps running at the store after a deletion; you cancel it in the subscription
settings of your Apple or Google account, and "Restore purchase" assigns it to the new account
identifier again.

What remains after a deletion, and why (Art. 17(3) GDPR):

- the trial marker for 12 months (section 10), so that the same account identifier cannot
  start a second trial;
- the redemption of a referral code without any link to you, as a count that the code was
  used;
- the records of operator decisions (section 15) for one year, for accountability and the
  defence of legal claims (Art. 17(3)(b) and (e) GDPR);
- purchase and billing data at Apple and Google, which they keep under their own
  responsibility, including under commercial and tax law; the DeviceCheck or Device Recall
  marker (section 10) also stays with them;
- data that carries no identifier and therefore cannot be found: reports, votes, traffic-jam
  measurements, crash reports and logs. They are deleted on the schedules stated in this
  policy. Comments you wrote on another device, or whose delete key was lost with the app,
  cannot be matched to you; tell us which ones they are and we will review them;
- a register of deletions that holds only the time and hashes of the deleted identifiers. It
  makes every deletion run again after a backup is restored, before the server accepts
  requests.

Backups. We back up the database every night, encrypted with a key that is not on the server,
and delete each backup after 30 days. Every night an encrypted copy is also fetched to our
operator's workstation in Germany and deleted there after 30 days as well. The key
that decrypts the backups is held by Ahmad Berro. Deleted data can therefore remain
in an encrypted backup for up to 30 days; if a backup is restored, every deletion made since is
carried out again first.

18. Retention at a glance

- Access and error logs: 14 days.
- IP address for limiting requests: at most one hour, in memory only.
- Reports: 30 minutes to 30 days depending on kind (section 6); vote hashes at most 30 days;
  traffic-jam grid points 15 minutes.
- Device keys: 14 days.
- Trial: for as long as we operate the service; after a deletion, a marker for 12 months.
- Subscription and purchase assignments: 180 days after expiry and the last change.
- Push address: until Apple or Google report it invalid, at most 270 days without refresh.
- Crash reports: 30 days. Usage statistics: 35 days after the last report.
- Notices of illegal content: one year after the decision. Records of operator decisions: one
  year. References: one year.
- Backups: 30 days, on the server and on the operator's workstation.

19. Recipients

- Contabo GmbH, Germany: hosting in its data centre in France (processor).
- Apple Inc., USA: delivery of notifications (Apple Push Notification service: push address
  and content of the notification), App Attest, DeviceCheck (processor).
- Google (Google Ireland Limited, Ireland, and Google LLC, USA): delivery of notifications
  (Firebase Cloud Messaging: push address and content of the notification; on Android also the
  Firebase installation ID, section 11), Play Integrity including Device Recall, verification
  of Google Play purchases (processor).
- Apple Distribution International Ltd. and Google Commerce Limited, Ireland: sale in the
  stores, under their own responsibility.
- komoot GmbH, Germany: fallback search with the search text, language and a position rounded
  to about 110 m, and place names with the exact position of the indication; without your IP
  address (section 5).
- FOSSGIS e.V., Germany: fallback routing with start, destination, via points, vehicle type
  and route options, and, only from app versions before the one that introduced our own
  handling of the road ahead, the road ahead in free drive with your current position and
  direction of travel; without your IP address (section 5). The positions used for the road
  ahead in current versions, for the speed limit and for placing a destination on the road
  are processed only on our own server.
- Other users: reports, confirmation counts and comments, without names.
- VersaTiles receives from our server only tile coordinates, no personal data.
- No third party receives the copy of the backups kept off the server: we keep it ourselves,
  encrypted, on our operator's workstation in Germany (section 17).

20. Transfers to third countries

We store and process your data on servers in the European Union, in France. An encrypted copy
of the nightly backup is kept on our operator's workstation in Germany (section
17).

Apple Inc. (Apple Push Notification service, App Attest, DeviceCheck) and Google LLC (Firebase
Cloud Messaging, Play Integrity) also process data in the USA. Both are certified under the
EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy
decision of 10 July 2023 (Art. 45 GDPR). The stores are themselves responsible for processing
in connection with purchases.

We are established outside the European Union, in a country for which there is no adequacy
decision of the European Commission. When our staff or those acting on our behalf access the
data stored in France from there — for operations, maintenance or moderation, or to fetch the
encrypted nightly backup — our hosting provider makes that data available to us in a third
country; that is a transfer within the meaning of Art. 44 et seq. GDPR. We base it on the
European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module
4: processor to controller) and have assessed the law and practice of the recipient country in
a transfer impact assessment; access takes place over encrypted connections. You can obtain a
copy of the clauses free of charge on request at ahmdberro50@gmail.com. The Commission has
announced separate clauses for recipients who, like us, are themselves subject to the GDPR;
once they are adopted, we will move to them.

The data you send to our server yourself is collected directly from you; that is not a
transfer to a third country.

21. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects
concerning you or similarly significantly affect you (Art. 22 GDPR).

The following are checked automatically: whether a device or an account identifier has already
used its trial (section 10) — if the check is negative, no trial begins, and Plus remains
available on the same terms; whether a request comes from a genuine app (section 9); whether
too many requests come from one address (section 3); and how long an indication is shown,
based on other users' answers (section 6). These checks do not evaluate personal aspects. If
you think a result is wrong, write to us and a person will review it.

22. Whether you have to provide data

You are under no statutory or contractual obligation to provide us with data. Without your
location the app cannot navigate or show indications near you; without the account identifier
it cannot attribute a trial or Plus; without a push address it cannot send notifications.
Crash reports and usage statistics are voluntary; the app works the same without them.

23. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17),
restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You
can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness
of processing before the withdrawal is unaffected.

The quickest way to get a copy or to delete your data is to do it yourself in the app
(section 17). You can also write to us at ahmdberro50@gmail.com; we answer within one month
(Art. 12(3) GDPR). Because we store neither names nor contact details, we can only find data
through something your device knows: give us the reference shown in the app, or run the export
or the deletion in the app. Reports, comments, traffic-jam measurements, crash reports and logs
are stored without an identifier (Art. 11 GDPR).

24. Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds
relating to your particular situation. We will then no longer process the data unless we can
demonstrate compelling legitimate grounds that override your interests, rights and freedoms,
or the processing serves the establishment, exercise or defence of legal claims. Send your
objection informally to ahmdberro50@gmail.com.

25. Right to lodge a complaint

You can lodge a complaint with any data protection supervisory authority (Art. 77 GDPR), in
particular in the member state of your habitual residence, your place of work or the place of
the alleged infringement.

26. Point of contact under the Digital Services Act

Our single point of contact for authorities, the European Commission and users under
Articles 11 and 12 of Regulation (EU) 2022/2065, and the form for notices of illegal content,
are at streckenblick.de/contact-point (German: streckenblick.de/kontaktstelle).

27. Children

Streckenblick is aimed at drivers and not at children. We do not knowingly process data of
people under 16.

28. Changes

If the app or the law changes, we update this policy. The current version is in the app under
Settings → Legal and at streckenblick.de/privacy.