Privacy policy

Your ID. When you first use the shared map your phone gets a random ID and a secret token. The server keeps the ID, a hash of the token, and which places you added and when. There is no name, email or phone number unless you sign in with an account (see below), but the ID is still personal data under the GDPR, because it links your contributions together. We call it pseudonymous, not anonymous.

Account (optional). If you press "Continue with Google", Google's sign-in script is loaded (Google sees your IP address) and Google tells our server a stable id for your Google account. If you choose "Continue with email", we send a six-digit code to the address you type. Our server stores a keyed hash of the Google id, enough to recognise you next time, and your email address (the one you type, or the verified address Google gives us). We keep the address so we can contact you about places and codes you add, for example if one is reported as offensive or illegal. It is not shown to other users, and it is deleted with "Delete my data". This lets you sign in to the same profile in another browser or on another phone. Without an account you can use the app as a guest: you can see every place and its code and report problems, but adding places and codes and voting need an account.

Profile name (optional). If you choose a name, it is saved with your ID on the server. Only you and the administrator can see it; it is not shown on any place. If you turn on "Show my name on the lists" on the Top list, your name, your rank and your counts (places added, people who got in, votes) are shown to everyone using the app. Your location never is. You can turn it off at any time, and your name disappears from the lists at once.

Profile photo, colour, saved places and settings (only with an account). If you are signed in with Google or email, we keep your profile photo (a small picture), your profile colour, the list of places you saved and the app's look-and-feel settings (language, theme, text size and similar) on our server with your ID, so they come back when you sign in on another phone or after reinstalling. Without an account they stay only on your phone. They are deleted with "Delete my data" and are included in "Download my data".

Your contributions. Places you add (name, code, kind, opening hours, note, position, date), your votes, your code suggestions and your reports, including the optional message in a report. Because a place shows where its toilet is and when you added it, it can show where you were at that time.

Location. Your phone's position is read on the phone to show where you are and to sort nearby places. When you add a place, vote, suggest a code or report a place, your position is sent with the request so the server can check that you are within about 150 m of the toilet. The server uses it for that check and does not store it. Location is off unless you allow it, and you can turn it off at any time in Settings ("Use my location") or in your phone or browser settings. Without it you can still browse the map; only adding and checking codes need it.

Messages. If you send feedback, we store your message and, if you give one, the contact detail you write in "How can we answer?". If the administrator sends you a message, it is stored with your ID so you can see it under Alerts.

Moderation records. If a place is hidden or removed or an ID is blocked, we keep what was decided, why, and when.

Technical data. Your IP address is processed to deliver the service and to limit abuse. Our server writes no access log: the address is held in memory for about an hour for abuse limits and is then forgotten. The providers named below keep their own technical logs.

On your phone. Settings, a copy of the places, your profile photo (which never leaves the phone) and a queue of actions waiting to be sent are stored in your browser's local storage. This is strictly necessary for the app you asked to use, so no cookie banner is needed. We use no analytics and no advertising trackers.

• Running the shared map you asked to use, including your ID, contributions and moderation messages: performance of the service (GDPR Art. 6(1)(b)).
• Keeping the map safe and free of abuse and illegal content (IP abuse limits, reports, moderation records, blocking): our legitimate interest in a usable, lawful service (Art. 6(1)(f)), and our legal duties under the EU Digital Services Act (Art. 6(1)(c)).
• The on-the-spot location check: your consent, given when you allow location (Art. 6(1)(a)). You can withdraw it at any time; this does not affect checks already made.
• Feedback: our legitimate interest in answering you and improving the app (Art. 6(1)(f)).

Where we rely on legitimate interest, you can object at any time (see Your rights).

We do not sell data. These providers are involved:

• Server: Oracle Cloud Infrastructure, Frankfurt, Germany (EU). It stores the server data. Oracle is a US company; any access from outside the EU is covered by the EU–US Data Privacy Framework and/or standard contractual clauses in Oracle's data processing terms.
• Server address: the server is reached through sslip.io, a free DNS service that translates the server's name into its IP address. It handles the name lookup only, not your data.
• App hosting: Vercel Inc., USA. It delivers the web app and sees your IP address when the app loads. The transfer is covered by the EU–US Data Privacy Framework and/or standard contractual clauses in Vercel's data processing terms.
• Map tiles: OpenFreeMap (openfreemap.org), with OpenStreetMap data. It receives your IP address and the map area you look at. It is a free public service; we have no contract with it.
• Sign-in with Google (optional): Google LLC, USA, only if you press Continue with Google. It sees your IP address and that you use LooKey. The transfer is covered by the EU–US Data Privacy Framework and/or standard contractual clauses in Google's terms.
• Emailed codes (optional): the email provider that delivers the code to you (it sees your address and the code email).
• Satellite view: Esri Inc., USA (server.arcgisonline.com). Only if you switch the satellite view on, it receives your IP address and the map area. The transfer is covered by the EU–US Data Privacy Framework and/or standard contractual clauses in Esri's terms.
• Address search: Photon, run by Komoot, Germany (EU), suggests results while you type. OpenStreetMap Nominatim, run by the OpenStreetMap Foundation in the United Kingdom, is asked only when you press Search. They receive what you typed, the map area and your IP address. The transfer to the United Kingdom relies on the European Commission's adequacy decision for the UK.

• Places stay on the map until you, the administrator or a venue's request removes them. When a place is deleted, its votes, suggestions and reports are deleted with it.
• Your ID, profile name, and the link between you and your contributions: deleted when you use "Delete my data", or automatically after 24 months without any activity. After automatic deletion, the places you added stay on the map without any link to you.
• Reports and their messages: deleted 6 months after they are handled.
• Feedback messages and contact details: deleted 12 months after we receive them.
• Moderation records and the ID of a blocked phone: kept while the block lasts, and at most 24 months.
• IP addresses on our server: about one hour, in memory only.
• Data on your phone: until you clear the app's browser data or use "Delete my data".

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on our legitimate interest.

The quickest ways:

• Copy of your data: Settings > "Download my data" gives you a file with everything the server links to your ID.
• Deletion: Settings > "Delete my data" deletes your ID, your profile name, the places you added with their votes and suggestions, your votes and suggestions on other places, your reports, and your alerts from the server, and clears the app on your phone. This cannot be undone.

You can also write to contact@lookey.hu. Because we do not know who you are, we may ask you to prove that you control the ID, for example with a code shown in your app's Settings. We answer within one month.

You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, www.naih.hu, or to the data protection authority of the EU country where you live, or go to court.

The app is only for people aged 16 and over. If we learn that a user is younger, we delete their data.

If we change this policy in a way that matters for you, we tell you in the app before the change takes effect.