Your privacy, clearly explained.

We are glad you are using the Red Thread app. Protecting your personal data is important to us. This policy explains how we process your data in our mobile app (iOS/Android) and web app.

The controller responsible for data processing is:
Voltaire Vision UG (haftungsbeschränkt)
Bäckerbreitergang 6
20355 Hamburg
E-mail: privacy@voltaire.vision

1. Account and Authentication
An account is required to use the app's features (tours, progress, purchases).

Registration/Login: We use Firebase Auth. You can sign in via e-mail (magic link) or social login (Google, Apple).

Data processed: UID (User ID), e-mail address, username, referral code. Optional: profile picture and home location (latitude/longitude).

Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract).

2. Location Data (GPS)
The core functionality of our app relies on your location to provide an interactive city experience.

Usage: We collect your GPS data (while the app is in use) to show you nearby tours, navigate you on the map and validate your progress at tour stops.

Storage: Your current position is processed transiently in device memory. Permanent storage only occurs as a "home location" if you voluntarily set one in your profile.

Legal basis: Art. 6(1)(b) GDPR (contract performance) for core features and Art. 6(1)(a) GDPR (consent) for optional location services.

3. Usage Data and Game Progress
To personalise your experience and offer gamification features, we process:

Activities: Tour starts, progress, completions, reviews and comments submitted.

Statistics: Points, badges and progress levels.

Search: Your search terms and recently viewed locations are stored locally on your device and partly on our servers to provide quick access.

Legal basis: Art. 6(1)(b) GDPR.

4. Shared Sessions (Group Tours)
When you use the shared session feature:

Participant data: Your username and status (e.g. current stop, audio position) are visible to other participants in the same session.

Technology: This is handled in real time via Firebase Realtime Database.

Legal basis: Art. 6(1)(b) GDPR.

5. Chat Assistant (AI Context)
Our chat assistant uses OpenAI technology to answer your questions about tours and points of interest.

Data transmission: When you submit a query, context data (tour ID, current stop) and, where applicable, your current location are sent to OpenAI to generate a precise response. We do not transmit real names or e-mail addresses to OpenAI.

Legal basis: Art. 6(1)(b) GDPR.

6. Subscriptions and Purchases
We use RevenueCat to manage in-app purchases and subscriptions.

Data: We process information about your subscription status, purchase receipts (Apple/Google receipts) and the selected plan. Actual payment is processed securely through the Apple or Google app stores; we do not store any credit card data ourselves.

Legal basis: Art. 6(1)(b) GDPR.

7. Marketing & Meta Pixel
With your explicit consent, we use the Meta Pixel and related interfaces provided by Meta Platforms Ireland Limited.

Personalised advertising: We use this data to measure the effectiveness of our ads and to show you personalised advertising on Meta platforms (Facebook, Instagram) based on your usage behaviour.

Data-driven advertising: The data collected (e.g. tour completions or registrations) helps us build audiences for future advertising (lookalike audiences) and manage our campaigns more efficiently.

Withdrawal: You can withdraw this consent at any time in the app settings.

Legal basis: Art. 6(1)(a) GDPR.

8. Device Permissions
The app requests the following permissions as needed:

• Location: For navigation and tour validation.
• Camera: To scan QR codes for shared sessions.
• Photos/Media: For uploading profile pictures (planned).
• Push notifications: For important updates about your tours.
• Tracking (ATT): On iOS we explicitly ask for your permission for cross-app tracking for analytics and marketing purposes.

9. Third-Party Providers and Data Transfers
We work with specialised service providers, some of which are based in third countries (such as the USA). These transfers are safeguarded by the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

• Google Firebase: Hosting, databases and authentication.
• OpenAI: Powering the chat assistant.
• RevenueCat: Subscription management.
• Map services & geocoding: MapTiler, Mapbox, OSM/Nominatim.
• Weather data: WeatherAPI.

10. Tour Creation (User Generated Content)
When you create your own tours, we process the content you enter.

Copyright: We employ technical measures to ensure compliance with copyright. You are responsible for not publishing personal data of third parties in tour descriptions without permission.

Legal basis: Art. 6(1)(b) GDPR.

11. Local Storage and Backup
Device cache: We store tour content, audio files and your consent status locally on your device (Capacitor Preferences/Filesystem) to save data usage and enable offline use.

Cloud backup: Your settings and progress are backed up on our servers (PostgreSQL) so they can be restored when you switch devices.

12. Contact Form
If you contact us via a contact form provided in the app or on our website, the information you provide (name, e-mail address, message) is stored for the purpose of processing the enquiry and in case of follow-up questions.

Legal basis: Processing is carried out for the performance of pre-contractual measures or contract performance (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

13. Storage Period and Your Rights
We store your data only as long as your account is active or as required by statutory retention obligations.

Under the GDPR you have the following rights:

• Access to, correction and deletion of your data.
• Restriction of processing and data portability.
• Withdrawal of consent at any time via the app settings.
• Right to lodge a complaint with a data protection supervisory authority.

14. Contact
If you have questions about data protection, please contact:
Voltaire Vision UG (haftungsbeschränkt)
Bäckerbreitergang 6
20355 Hamburg
E-mail: privacy@voltaire.vision