We take the protection of your personal data seriously. Below we explain how personal data is processed when you use the Konvoii community platform.
1. Controller
The controller under the GDPR is the provider named in the “Legal notice” section of the app. For privacy requests, please use the privacy contact email provided there.
2. General information on processing
We process personal data only to the extent necessary to provide a functional platform, perform a contract, based on your consent, based on legitimate interests, or where we are legally obliged to do so.
3. Hosting and infrastructure
The application is hosted and delivered by Vercel Inc. (USA). Technical access data (e.g. IP address, timestamp, requested resource, user agent) may be processed in server or edge logs. Application data is stored in a PostgreSQL database connected via the operator’s hosting/database infrastructure.
The legal basis may be Art. 6(1)(b) GDPR (contract / pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
If data is transferred to a third country (in particular the USA), we rely – where required – on an adequacy decision (e.g. EU-US Data Privacy Framework, if the provider is certified) or appropriate safeguards under Art. 46 GDPR (e.g. EU Standard Contractual Clauses).
4. Account, authentication and profile
Sign-in is provided via Auth.js (NextAuth). When you register with email and password, we process in particular your email address, username, name (if provided) and a password hash (bcrypt). Sessions are maintained as JWT cookies (typical validity: up to 30 days).
Optionally – if configured – magic links via SMTP and OAuth sign-in via Google or Apple may be available. In that case, identity data from the provider (e.g. email, name, profile image URL) may be transmitted to us and stored in the database.
Profile information (e.g. display name, username, image, other optional fields) is stored to provide your account. The legal basis is Art. 6(1)(b) GDPR; for voluntary information, Art. 6(1)(a) GDPR may also apply.
5. Platform content
Konvoii enables, among other things, convoys, meetups, help requests, ride sharing, campsite spot exchange (Platzbörse), Local Voice, as well as messaging, comments and notifications. When you create content or participate, the data required for that purpose (text, locations, routes, participations, messages, moderation reports, etc.) is processed and stored.
Location data may be stored or displayed at different levels of accuracy depending on your settings. Other users may see certain data where the feature requires it (e.g. public listings, map view).
Moderation and audit information may be processed to prevent abuse. The legal basis is Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR (legitimate interest in a safe community) or Art. 6(1)(a) GDPR.
6. Maps and geodata (third parties)
Map display loads tiles from OpenStreetMap (tile.openstreetmap.org). Place search and reverse geocoding use Nominatim (OpenStreetMap), typically via our own API routes. Providers may receive technical data including your IP address.
Leaflet marker assets may be loaded from a CDN (e.g. cdnjs). “Open in map” may link to Google Maps; we do not embed the Google Maps JavaScript API.
Please refer to the privacy notices of the respective providers (OpenStreetMap Foundation / Nominatim usage policy, Cloudflare/cdnjs, Google).
7. Email delivery
Where emails are sent (e.g. magic link, system notices), delivery uses a configured SMTP service. Recipient address and necessary metadata are transmitted to the email provider. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
8. Cookies and similar technologies
We use strictly necessary cookies and similar technologies (session/authentication, language preference, and where applicable CSRF protection). Details are set out under “Cookies”. Legal basis: Art. 6(1)(b) GDPR and, where applicable, Section 25(2) TDDDG.
Your last granted browser location may be held temporarily in your device’s sessionStorage so that other pages do not need to ask for location permission again.
9. Storage period and deletion
We store personal data only as long as necessary for the respective purposes or where statutory retention obligations apply. Account data and related content may be deleted or anonymised after cancellation or deletion of the account unless retention is required by law.
Where provided in the profile, you may request account deletion. Moderation and security logs may have shorter or longer retention periods where required to prevent abuse.
10. Your rights
Subject to legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection (Arts. 15–21 GDPR).
Where processing is based on consent, you may withdraw consent with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority. For Bavaria (Germany), this is typically the Bavarian Data Protection Authority (BayLDA).