Logo Loocator
DE EN

Datenschutzerklärung

Last updated: 21.09.2026 ~5 min read

Privacy Policy

1. Controller

mineco.de (Loocator)
Auer Str. 47, 76287 Rheinstetten
Email: info@loocator.org
Represented by: Adam Weiß

2. Overview

Loocator (loocator.org and app.loocator.org) helps you find public toilets. There are no user accounts, no advertising, no analytics or tracking tools and no cookies. We only process personal data as far as it is necessary to operate the service, keep it secure and provide the features you use.

3. Hosting and server log files

The website and the app are hosted by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany, on servers in Germany. A data processing agreement under Art. 28 GDPR is in place with the host.

When you visit the site, the web server processes: IP address, date and time, requested URL, amount of data transferred, HTTP status code, referrer and user agent. Log files are deleted after 14 days.

Legal basis: Art. 6(1)(f) GDPR (security and stability of the service).

4. Location

If you allow location access, your browser determines your location. It is used to display your position on the map and is not sent to our server. Only if you ask for a walking route, the start point (your location) and the destination are sent to OSRM (see section 5).

Legal basis: Art. 6(1)(a) GDPR (consent via the browser prompt, which you can withdraw at any time in your browser).

5. Map, search and routing services (third parties)

When you use the following services, the providers receive your IP address and the requested data for technical reasons:

  • Map tiles: OpenStreetMap tile servers (OpenStreetMap Foundation, United Kingdom) and OpenFreeMap (tiles.openfreemap.org).
  • Place search: Nominatim (OpenStreetMap Foundation). Your search term is transmitted.
  • Walking routes: OSRM (router.project-osrm.org). The start point (your location) and destination are transmitted, only if you request a route.
  • Toilet data (Overpass API): Requests go through our server, which caches the results. Overpass servers only receive map extents, not your IP address. If our server is unavailable, your browser may query the Overpass servers (overpass-api.de, kumi.systems) directly. In that case they receive your IP address.
  • Software libraries: Leaflet and MapLibre are loaded via unpkg.com and cdn.jsdelivr.net (content delivery networks).
  • Navigation links: If you click a link to Google Maps, Google's service opens. From that click on, Google's privacy terms apply. We do not transmit anything to Google before you click.

Legal basis: Art. 6(1)(b) GDPR (the function you request) and (f) (a working map); for transmitting your location to OSRM additionally (a).

6. Ratings

When you rate a toilet (usable/not usable, cleanliness), we store the toilet ID, the rating, the time and the origin (on site, or afterwards via the "Were you there?" prompt). No IP address and no user reference are stored. Ratings are deleted after 90 days.

Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Abuse protection (rate limiting)

To protect against automated abuse (e.g. mass ratings, overload), the server stores for at most 24 hours a shortened hash of your IP address, generated with a secret key, together with the type of request. The IP address itself is not stored for this purpose. Without the key the value cannot be converted back to the IP address. The data is deleted daily.

Legal basis: Art. 6(1)(f) GDPR.

8. Local storage on your device

The app only stores data locally in your browser (localStorage, service worker cache): language, favorites, rating status, karma points, the toilet you opened last, a confirmed visit (for the "Were you there?" prompt) and map data for offline use. This data does not leave your device. Access is technically necessary for the app to work (Section 25(2) no. 2 TDDDG). You can delete the data at any time in your browser settings.

9. Reporting errors (OpenStreetMap notes)

If you report an error or a missing toilet in the app, your text and the coordinates are sent to OpenStreetMap as a public note and are publicly visible there. Please do not enter personal data. The privacy policy of the OpenStreetMap Foundation also applies.

Legal basis: Art. 6(1)(a) GDPR (your report).

10. Landing page: external content and links

  • The GitHub star counter is loaded as an image from img.shields.io. The provider receives your IP address.
  • Links to GitHub and Ko-fi leave our site. From the click on, the providers' privacy terms apply.
  • Fonts (Baloo 2, Caveat) are hosted on our server. No fonts are loaded from Google.

Legal basis: Art. 6(1)(f) GDPR (displaying the page).

11. Recipients and third countries

Recipients are our host (Contabo GmbH) and the providers named in sections 5 and 10, each to the extent described there. Some of them are located in the United Kingdom or the USA. Transfers rely on the applicable adequacy decisions (e.g. the UK adequacy decision, the EU-US Data Privacy Framework) or standard contractual clauses. We do not share data for advertising purposes.

12. Retention

  • Server log files: 14 days.
  • Rate-limit hash: up to 24 hours.
  • Ratings: 90 days.
  • Cache of toilet data on the server: up to 30 days, contains no personal data.
  • Local storage in the browser: until you delete it.

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Please contact info@loocator.org.

Because we do not maintain user accounts and do not link log data to individuals, we can only answer requests if you tell us the time and IP address of your use.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

14. Provision of data, automated decisions, changes

Providing your data is neither required by law nor by contract. Without the technically necessary data (section 3), however, the website cannot be delivered. There is no automated decision-making, including profiling.

We update this privacy policy when the app or legal requirements change. The current version applies.