Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Jonas Heitzmann
Brestenberg 4
77704 Oberkirch
Germany

Email: squadradar.development@gmail.com
Phone: +49 175 1947667

SquadRadar is run by an individual; no company is registered. No data protection officer has been appointed. For any privacy question, contact us at the email address above.

This privacy policy applies to

• the SquadRadar mobile app for iOS and Android, and
• the website squad-radar.com and its subpages (legal notice, privacy, child safety standards, account deletion, invitation and confirmation pages).

It does not apply to the app stores you download the app from (Apple App Store, Google Play). Apple and Google process data there under their own responsibility; we have no influence on that.

This version fully replaces all privacy policies previously published on squad-radar.com.

SquadRadar shows you spontaneous meetups (“Flares”), planned events (“Beacons”) and groups (“Squads”) near you on a map. To do this, we mainly process:

• your account (email address, password) and your profile (name, date of birth, profile picture, bio),
• your location while the app is open, and the meeting points you set yourself,
• your chat messages, which are deleted automatically a few days after the meetup ends,
• Safe Checks, with which you can report after a meetup if someone behaved unsafely.

Three points you should know in particular:

For each processing activity we state the data, the purpose and the legal basis. “TDDDG” refers to the German Telecommunications Digital Services Data Protection Act.

4.1 Registration, login and email confirmation

Data: email address, password (stored only as a cryptographic hash; we never know it in plain text), time of registration, confirmation status of the email address, login and session data (access tokens).

Purpose: setting up and managing your account, login, confirming your email address, resetting your password, protecting the account against unauthorised access. After registration we send you a confirmation email with a link to squad-radar.com/verified. We do not offer login via third parties (Google, Apple, Facebook).

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement). For storing session data on your device so you stay logged in: Section 25(2) no. 2 TDDDG (strictly necessary for the service you requested).

4.2 Date of birth and age limit

Data: date of birth (required at registration and when editing your profile).

Purpose: SquadRadar may only be used from the age of 18. We check your date of birth in the app and additionally on the server so that the age limit cannot be bypassed. This is based on your own statement; we do not check ID documents.

Display: The app shows other users only your age in years next to your name, not the date. However, the programming interface currently also delivers your full date of birth to logged-in users.

Legal basis: Art. 6(1)(b) GDPR (the age limit is part of the user agreement) and Art. 6(1)(f) GDPR. Our legitimate interest is keeping minors away from an app that leads to real-life meetings with strangers.

4.3 Profile, profile picture and friend code

Data: display name, profile picture, bio (optional), automatically generated friend code, device language, selected search radius.

Purpose: showing your profile to others, recognisability in Flares, Squads and chats, adding friends via friend code, showing the app and push notifications in your language, filtering the map by your search radius.

Visibility: Display name, age, profile picture, bio, level, badges and counters are visible to other logged-in users. Your registration date and your search radius can also be retrieved via the programming interface, even though the app does not display them. Only put in your name and bio what you would share with strangers.

Profile picture: Profile pictures are stored in a public storage area (Supabase Storage) and can be accessed without logging in. The address is made up of your user ID and a fixed file name; anyone who knows your user ID can derive it. Only upload a picture you would also show publicly. The app crops your picture to a square, saves it as a JPEG and removes the metadata of the original file, such as location, time of capture and device model. There is exactly one image file per account; when you change it, the old one is overwritten. It is deleted when you delete your account; if that fails for technical reasons, we delete it manually.

Camera and photos: To take or select a profile picture, the app accesses your camera or photo library, only with your permission and only when you start the action yourself. You can revoke the permission at any time in your system settings; the app remains usable without a profile picture.

Legal basis: Art. 6(1)(b) GDPR. For access to camera and photo library additionally Art. 6(1)(a) GDPR and Section 25(1) TDDDG (your consent given via the system prompt).

4.4 Location data

Location data is the most sensitive type of data in SquadRadar, so here in detail.

a) Your current location while the app is open. As soon as you use the map, the app determines your position with high accuracy via your device’s location services. It is used to show you Flares, Beacons and Squads within your radius and to calculate distances.

b) Your last known position. The most recently determined position is stored in your profile. We need it so that the server can check whether a new Flare, Beacon or Squad is within your radius and then notify you. Only one value is stored and it is overwritten with every update. No location history or movement profile is created. We also store the time of the last update in order to calculate the deletion period.

c) Meeting points. When you create a Flare, a Beacon or a Squad meetup, you publish its meeting point. Depending on the visibility you choose, all users or only your friends can see it.

No background location. The app only requests the “While using the app” permission. Permission for background location access is neither requested nor used. When the app is closed, no location is collected.

Deletion: A daily job on our database server deletes your last known position if it has not been updated for 30 days, and deletes the meeting points of Flares and Beacons 7 days after they end. Meeting points of Squads are deleted together with the Squad (see 4.6).

Legal basis:

• Access to your device’s location services: Section 25(2) no. 2 TDDDG – access is strictly necessary to provide the service you explicitly requested (meetups near you); you additionally grant the permission via your operating system’s prompt.
• Displaying the map, calculating distances and storing your last known position: Art. 6(1)(b) GDPR – the core function of the app cannot be provided without location. The position is stored as soon as the app determines your location, regardless of whether you have allowed push notifications.
• Publishing meeting points: Art. 6(1)(b) GDPR, as you set them yourself.

You can revoke the location permission at any time in your device settings. The map will then no longer be available; the stored position is deleted automatically after 30 days.

4.5 Flares and Beacons

A Flare is a spontaneous meetup with an expiry time. A Beacon is a planned event with a fixed date, which can be up to one year in the future.

Data: title, description, category (“vibe”), meeting point, start or event time, expiry time, participant limit, visibility (public or friends only), ID of the creator, list of participants, times of joining and leaving. When you join or leave, a notice with your name appears in the Flare’s chat (e.g. “Max is in.”). The creator can change the time and the participant limit afterwards; participants are informed about this in the chat.

Purpose: showing the meetup on the map, managing participation, notifying participants, linking the group chat and the subsequent Safe Checks.

Retention: The meeting point is deleted 7 days after the end, the chat 3 days after the end (see 4.7). Title, description and participant list are kept until the creator deletes their account. If you delete your account, you are removed from all participant lists.

Legal basis: Art. 6(1)(b) GDPR.

4.6 Squads, pings and invitation links

Data: name and description of the Squad, member list, role in the Squad, meeting point, expiry time, pings sent and received with timestamp and status (requested, accepted, declined), your vote on a Squad meetup (visible to the other members of your Squad), and joins via invitation links or QR codes.

Purpose: operating the Squad feature, arranging meetups between Squads, joining via invitation links (squad-radar.com/join).

Nearby notification: As soon as your Squad becomes visible, we notify users within its radius by push. The notification contains the name of the person who created the Squad and the Squad’s vibe (e.g. “Max is nearby with a Squad (Vibe: Chill).”). Recipients therefore learn that you are currently nearby. The notification does not contain the exact meeting point (see 4.8).

Retention: A Squad is deleted together with its meeting point and internal chat 3 days after its expiry time. Pings are deleted together with the Squad-to-Squad chat 3 days after they were created. This is done by a daily database job.

Legal basis: Art. 6(1)(b) GDPR.

4.7 Chats

Data: content of your messages, sender ID, chat room, timestamps, read status.

SquadRadar has three kinds of chat: the group chat of a Flare or Beacon, the internal chat of a Squad, and the chat between two Squads after an accepted ping.

Who can read along: In the chat of a Flare or Beacon, all participants see all messages. Anyone who joins later also sees the entire previous history. So do not write anything there that participants joining later should not read.

Automatic deletion: Chats are deleted automatically; we do not keep a permanent chat archive:

• Chat of a Flare or Beacon: 3 days after it ends. For Beacons, messages written before the event are kept until then.
• Internal Squad chat: together with the Squad, 3 days after it expires.
• Chat between two Squads: 3 days after the ping.

Save important information elsewhere in good time.

No end-to-end encryption. Messages are transmitted encrypted (HTTPS) but are stored in plain text in our database. Technically, the operator could read them. This only happens where necessary to handle a report (4.12), to fix errors or because of a legal obligation.

Legal basis: Art. 6(1)(b) GDPR.

4.8 Push notifications

Data: your device’s push token (Firebase Cloud Messaging), language setting, type of notification and related IDs (e.g. Flare or chat ID), and the notification text shown.

Purpose: We notify you about new Flares, Beacons and Squads within your radius, new chat messages, new participants in your Flares and accepted Squad pings.

What the notification contains: For chat messages, the sender’s name and the text of the message are transmitted so that you can read them directly on your lock screen. For new Flares and Beacons, it is the creator’s name and the title; for new Squads nearby, the creator’s name and the Squad’s vibe; for new participants, their name. This content passes through Google’s servers (Firebase Cloud Messaging) and, on iPhones, additionally through Apple’s Apple Push Notification Service. If you do not want this, turn off notifications for SquadRadar or the lock-screen preview in your device settings.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You give consent via your operating system’s prompt and can withdraw it at any time in your device settings.

Deletion: When you log out, we remove your push token from your profile. If Firebase reports a token as invalid, we delete it automatically.

4.9 Safe Check

After a Flare, the app asks you whether all participants behaved safely and respectfully towards you.

“Safe” is not stored. We only record that you completed or skipped the Safe Check for this Flare, so that it does not appear again.

“Not safe” is a report to our moderation. You have to briefly describe what happened. The report is processed like any other report (see 4.12), additionally with the related Flare.

No rating, no automatic ban. There is no score and no rating visible to others. Whether a report has consequences, such as a ban, is decided by the operator after reviewing the individual case. The reported person does not find out who reported them.

Data: Safe Check record (Flare, your ID, time); for “not safe” additionally the report data under 4.12 with your description and the Flare.

Legal basis: for the record Art. 6(1)(b) GDPR; for reports Art. 6(1)(f) GDPR. Our legitimate interest is protecting users when meeting strangers.

4.10 Levels, badges and counters

Data: level, badges awarded, number of Flares created, Flares attended, Squads created and pings accepted. Your level rises with your activity, for example with every Flare you create.

Purpose: game elements and an indication of how experienced someone is in the app. These values are part of your visible profile.

Legal basis: Art. 6(1)(b) GDPR.

4.11 Friends and blocking

Data: friendships (who with whom, since when), friend codes used, block lists. Each direction is stored separately: if someone enters your friend code, a one-sided entry about you is already created. It only counts as a friendship once both directions exist.

Purpose: showing Flares with “friends only” visibility, managing your contacts, hiding content and preventing contact from blocked people.

Legal basis: Art. 6(1)(b) GDPR; for blocking additionally Art. 6(1)(f) GDPR (protection against harassment).

4.12 Reports, moderation and bans

Data: IDs of the reporting and the reported person, reason for the report with an optional free-text addition, for reported messages also the message ID and text, for Safe Check reports the related Flare, time of the report. Please do not enter third-party data in the free-text field that is not needed to handle the report.

Purpose: reviewing and handling reports of inappropriate content or behaviour, enforcing the terms of use, banning accounts, meeting obligations under the Digital Services Act and – where there are indications of criminal offences, in particular child sexual abuse material – passing information to the competent law enforcement authorities.

Process: A report is stored in our database and additionally sent to the operator by email (sent via Resend, received in a Gmail inbox, see section 5). The email contains the data listed above, including the reported message text and the number of previous reports against the reported person. The identity of the reporting person is not disclosed to the reported person.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting users from harassment, abuse and illegal content, and protecting the operator from liability. Where legal obligations apply (in particular under the Digital Services Act), additionally Art. 6(1)(c) GDPR.

4.13 Deleting your account

You can delete your account at any time directly in the app (Profile → Delete account). Alternatively, an informal email to squadradar.development@gmail.com is enough. Instructions are also available at squad-radar.com/delete-account.

What is deleted: your login account with email address and password hash, your profile with name, date of birth, bio, friend code, level, badges and counters, your stored position, your profile picture, your chat messages, your Flares and Squad memberships, your friendships and blocks, and your Safe Check records.

Your chat messages are deleted in all chats, including in other people’s Flares and Squads. This leaves gaps in the conversation for the other participants.

What may remain:

• Report emails in the operator’s inbox about reports others made about you, as long as they are needed for handling, preventing repeat cases or legal defence (see section 7). The reports in our database are deleted with your account. Reports you made about others remain without your ID.
• Messages from other people in chats you took part in, until they are deleted automatically.

Deletion is final and cannot be undone.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR.

4.14 Server and connection data

Whenever our servers and the integrated services are accessed, connection data arises for technical reasons: IP address, date and time, requested resource, and information about the device and app version. Our service providers (Supabase, Google Firebase, CARTO, Komoot) log this data. The app does not perform any logging of its own beyond that.

Purpose: delivering content, operational security, detecting and preventing attacks and abuse, error analysis.

Legal basis: Art. 6(1)(b) and (f) GDPR (legitimate interest in secure, reliable operation).

4.15 Map display (CARTO / OpenStreetMap)

The map consists of map tiles loaded at runtime from CARTO’s servers (basemaps.cartocdn.com); the map data comes from OpenStreetMap. Your IP address is transmitted to CARTO. The requested map sections show which area you are currently viewing, which allows rough conclusions about where you are. CARTO does not receive your exact GPS coordinates.

Legal basis: Art. 6(1)(b) GDPR – the core function of the app cannot be displayed without map tiles.

4.16 Address search (Photon / Komoot)

When you enter an address while creating a Flare, we fetch address suggestions from the “Photon” service of Komoot GmbH (map data from OpenStreetMap). The request starts automatically after three characters.

Data: your search text, your device language, your IP address and the coordinates of the map section currently shown (so that results near you appear first). The service is operated in Germany.

Legal basis: Art. 6(1)(b) GDPR.

4.17 Fonts

The app and website use the “Outfit” font. The font files are delivered with the app or from our own web server. They are not loaded from Google servers.

4.18 Storage on your device

SquadRadar stores some settings only locally on your device: the display mode (light/dark), the time you last read a chat (to mark unread messages), and your login session. This data is removed when you uninstall the app. We store nothing on your device for analytics or advertising.

Legal basis: Section 25(2) no. 2 TDDDG – the storage is strictly necessary for the service you requested.

4.19 Website squad-radar.com

The website is a static site (home page, legal notice, privacy, child safety standards, account deletion, invitation and confirmation pages). It sets no cookies, includes no tracking or analytics services and has no contact forms. If your browser is not set to German, the site redirects you once to the English version and remembers this only for the current browser session (session storage). When you visit, our host Firebase Hosting (Google) processes the usual connection data (see 4.14).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website securely); for the language note in your browser Section 25(2) no. 2 TDDDG.

4.20 Contact by email

If you write to us, we process your email address, your name and the content of your message in order to handle your request. We use a Google (Gmail) mailbox for this.

Legal basis: Art. 6(1)(b) GDPR if your request concerns the use of the app, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

We do not sell data or share it for advertising. Data is only received by the following service providers, who act as our processors under Art. 28 GDPR (the app stores: under their own responsibility), and by authorities where we are legally obliged to share it.

We also transfer data to law enforcement or supervisory authorities where we are legally obliged to do so or where it is necessary to prosecute criminal offences or for legal defence (Art. 6(1)(c) or (f) GDPR).

Some service providers are based in the USA or Singapore. Both are third countries under the GDPR. The level of data protection there differs from the EU, particularly regarding access by authorities; legal protection to European standards cannot be guaranteed in every case.

The transfers are based on the following:

• Google LLC, CartoDB Inc. (CARTO) and Plus Five Five, Inc. (Resend) are certified under the EU-US Data Privacy Framework. The European Commission’s adequacy decision under Art. 45 GDPR applies to them. With Resend we have additionally agreed the European Commission’s Standard Contractual Clauses.
• Supabase is not certified under the Data Privacy Framework. The basis is the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of our data processing agreement with Supabase. The data itself is stored in the EU, but access for support and administration from the USA and Singapore cannot be ruled out.

You can request a copy of the relevant safeguards at squadradar.development@gmail.com.

Automatic deletions are carried out by jobs running daily on our database server (around 03:00 UTC).

Where statutory retention obligations apply, we restrict the data instead of deleting it and no longer use it for any other purpose.

You have the following rights towards us:

• Access (Art. 15 GDPR): which data we process about you, including a copy.
• Rectification (Art. 16 GDPR): you can change many details directly in the app.
• Erasure (Art. 17 GDPR): fastest via the delete function in the app (see 4.13).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): the data you provided to us, in a common, machine-readable format.
• Objection (Art. 21 GDPR): to processing based on legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds.
• Withdrawal of consent (Art. 7(3) GDPR): for push notifications and access to camera and photos, at any time in your device’s system settings. Processing carried out until then remains lawful.

For all requests, an informal message to squadradar.development@gmail.com is enough. We respond without undue delay, at the latest within one month.

Right to lodge a complaint (Art. 77 GDPR): You can also complain to a data protection supervisory authority, in particular in the EU country of your residence, your place of work or the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart)
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

Using SquadRadar is voluntary. For an account, however, we need your email address, password, display name and date of birth; without them we cannot create an account. Without location access we cannot show you meetups near you. Profile picture and bio are optional.

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR and do not carry out profiling. Bans and other measures following a report are always decided by a human.

We protect your data with technical and organisational measures under Art. 32 GDPR, in particular:

• transport encryption (HTTPS/TLS) between app and servers,
• storing passwords only as a cryptographic hash,
• access restrictions at database level (row level security) for all tables, so that each person can only access their own data or data intended for them,
• access rules for profile picture storage under which only you can upload, change and delete your own picture,
• reports cannot be read by users; the identity of the reporting person is determined on the server and not disclosed,
• server functions that can only be called with a valid login token or internal security key,
• server-side checks of security-relevant actions (age limit, joining Flares, reports from the Safe Check),
• automatic deletion after fixed periods (section 7).

No one can guarantee absolute security of data transmission over the internet.

SquadRadar is intended exclusively for people aged 18 and over. The age limit is checked at registration and every time the date of birth is changed, in the app and on the server. We do not knowingly process data of minors. If we learn that an account was created by a minor, we delete it without delay. Please send any indications to squadradar.development@gmail.com. Our child safety standards are available at squad-radar.com/child-safety.

We update this privacy policy when the app, the services used or the legal situation change. The current version is available at squad-radar.com/datenschutz and in the app. We will also inform you in the app or by email about significant changes, such as new recipients or new purposes. If a change requires consent, we will ask for it separately.