Privacy Policy

The controller responsible for data processing on this website is a private individual (not a company); this project is operated on a non-commercial basis:
[Full name]
[Street and house number]
[Postal code and city], Germany
Email: [email address]

This website is password-protected. After a successful login, we set a technically necessary cookie (wander-auth) that stores your login for up to 8 hours. The cookie is httpOnly, meaning it cannot be read via JavaScript, and is not used for marketing or tracking purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service from unauthorized access).

To suggest nearby places, we request permission to use your browser's Geolocation API with your consent. If you decline, or no GPS position is available, we instead determine an approximate location based on your IP address. Coordinates are sent to our server and used to query the Google Places API (see Section 5). We do not permanently store your location data.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via your browser's permission settings.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA ("Vercel"). When you access the site, Vercel automatically processes technical access data (including IP address, date and time, page requested, browser type) in server log files. This serves the technical provision and security of the service (Art. 6(1)(f) GDPR). As Vercel Inc. is a US company, personal data may be transferred to the USA; this transfer is based on the EU Standard Contractual Clauses.

To provide the core functionality of this app, we share certain data with the following processors/third parties:

• Google Places API (Google Ireland Limited / Google LLC, USA): your approximate coordinates are transmitted to find points of interest near you.
• Google Gemini / Google Generative AI (Google Ireland Limited / Google LLC, USA): the name, category, and publicly available background information about the selected place, along with your storyteller and time preference, are transmitted to automatically generate a narration text.
• ElevenLabs (ElevenLabs Inc. / ElevenLabs UK Ltd.): the generated narration text is transmitted to produce a spoken audio version (text-to-speech).
• Vercel Web Analytics: we use Vercel's privacy-friendly, cookie-free analytics feature to collect aggregated, anonymous usage statistics (e.g. page views). No individual profiles are created.

Where data is transferred to countries outside the EU/EEA (in particular the USA), this is based on the EU Standard Contractual Clauses pursuant to Art. 46 GDPR or, where applicable, an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework).

Legal basis: performance of the usage contract (Art. 6(1)(b) GDPR) and our legitimate interest in a functional, performant service (Art. 6(1)(f) GDPR).

Location data and generated stories are processed only for the duration of your session and are not permanently stored on our servers. Server log files at our hosting provider are automatically deleted after a short period required for security purposes.

As a data subject, you have the following rights against us:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with future effect (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for your place of residence.

We will update this privacy policy whenever our data processing or the legal situation changes. The version current at the time of your visit applies.