Privacy policy

Who is responsible for your data

The controller of your data is Monika Mirek, publisher of the OutPath app and of its website, outpathapp.com. Contact: support@outpathapp.com. The postal address is in the legal notice: https://outpathapp.com/legal-notice/.

What data we collect

Your email address and password when you create an account - the password is stored by Supabase Auth as a hash and never reaches the app or our database in readable form. Supabase Auth also checks on its own server whether your password is known from data breaches. It asks Have I Been Pwned only about the first five characters of a hash of the password - never about the password itself or anything about you - and your phone sends nothing to anyone else for this check. If you change your email address in Settings, the new address is kept with your account until you confirm the change with both links, ask for another change or delete your account, and is deleted automatically once 14 days have passed since the links were sent.

When you create an account: that you accepted the terms of service and this privacy policy and confirmed that you are at least 16, which version of the terms that was, when, and whether it happened in the app or on the website. The same is recorded when you accept a later version of the terms, together with when the app first showed you the notice of that version.

Your @username, which is public, and your display name, bio and profile picture, if you add them. The @username you choose when you create your account stays as it is. An account that does not get a @username of its own choosing - one created with Google, for example, or one whose chosen @username was taken by the time its email address was confirmed - gets a neutral one, "walker" followed by digits, never made from your email address or your name. You can change that one once; after that, your new @username stays. A @username given up this way is never given to anyone else.

The photos you publish, with the coordinates where they were taken and their caption. The coordinates are needed to place a pin on the map - that is what the app is for. We publish them at full precision, so do not add photos from places whose location you do not want to reveal - your own home, for example. A photo you take while recording an activity also keeps an identifier of that recording, so that your profile can show the photos of one activity together as one post.

When you add a photo, the app also checks on your phone whether its position comes from an app that fakes location (mock location), and sends the result of that check to our server with the request to upload the photo. A photo whose position was faked is not published.

When you add a photo or a profile picture or enter a creator code, the app also asks Google Play to confirm that the request comes from a genuine copy of OutPath installed from Google Play, on a device that passes Google's integrity checks (Play Integrity), and sends that confirmation to our server with the request. To give it, Google Play processes information about the request, about the app (its name, version and signing certificate) and its licence from Google Play, and attestation data from your device; the app gets this check ready with Google Play each time it starts. Our server may have Google read the confirmation, and it then keeps the result with your account for 30 days: whether the checks passed, the labels Google gave the app and the device, and the app's version - no device identifiers and no IP address.

Saved activities: the route track, time, distance and elevation gain, and the weight you enter yourself if you want an estimate of calories burned.

Your heart rate, from a connected watch or from Health Connect. It is saved with your activities, together with calories worked out from it, only if you consent to it - see "Heart rate: health data" and "Health Connect" below.

Your age, body weight and sex, if you enter them, are kept with your account - in a separate, access-controlled table that only you can read - so they are not lost if you reinstall the app or change phones. They are used to estimate calories, and sex only together with heart rate. Gear weight is typed fresh for each activity and stays only on your phone; it only affects that activity's calorie estimate.

Your notification settings - which notifications you want and the day and time of your weekly summary - are kept with your account, so they stay the same if you reinstall the app or change phones.

The language you use the app in, or the language of the website page if you create your account there, is kept with your account, so that the emails about your account (such as the link to confirm your address or to set a new password) are in that language. The app updates it when you change its language.

Your history of visited places, likes, comments, the places you save or follow and the users you follow.

Which offline map region a free account has downloaded, and whether its free allowance has been used up - so that the allowance cannot be claimed twice.

The reports you send about other people's content: which photo, comment or profile, the reason you chose and the description you added.

If we take a moderation decision about your content or your account, or on a notice you sent: a record of that decision - what it concerned, the notice without who sent it, what we did and why, when we told the people concerned, and any appeal and its outcome.

Which photos you have already been shown in the feed - on your phone only, so that next time you open the app you see something new.

Whether you have an active subscription. Payments are handled by Google Play through RevenueCat; we do not see or store your card details.

If you use a creator code: the code your account holds, whether you typed it on the Premium screen or it came from a creator's link - Google Play's install referrer included, which the app reads once after it is installed - and when it was applied; every code your account has ever applied; and, after a purchase with the creator offer, its confirmation: the Google Play order number and the plan. A code from a link waits on your phone until your account applies it, and after such a purchase RevenueCat also stores the code with your subscription. The creator learns only how many subscriptions and payments their code brought and the amounts, never who you are.

Every subscription event Google Play reports through RevenueCat - a purchase, renewal, cancellation or refund - with the plan, price, currency, tax, country and transaction numbers; we use it to settle creators' commissions and to check whether an account has ever paid for Premium.

If you buy the Founder Plan: that you are a founder, whether your badge is shown and how you voted in the founder votes.

If you do not have Premium, the app also shows ads - see "Advertising" below for what that means for your data.

Legal basis

We process your account, published photos, comments, ratings and saved activities because without them we could not perform the contract for the service you enter into when you create an account (Art. 6(1)(b) GDPR).

Keeping the service secure, preventing abuse, the automatic checks a photo goes through before it is published, handling content reports and keeping a record of moderation decisions rely on our legitimate interest (Art. 6(1)(f) GDPR). Handling notices of illegal content, and telling the people concerned what we decided and why, is also a legal obligation under the Digital Services Act (Art. 6(1)(c) GDPR). Keeping a record of when you accepted which version of the terms of service, and of when the app first showed you the notice of a change, relies on our legitimate interest in being able to show which terms apply to you and from when (Art. 6(1)(f) GDPR). Using your approximate position to count recent photos near you, as described under "What we do not collect", relies on our legitimate interest in showing you, before you buy, what Premium offers where you are (Art. 6(1)(f) GDPR). Having Google Play confirm that a photo upload or a creator code comes from a genuine copy of the app on a genuine device, keeping the result of that check for 30 days, and checking passwords against known data breaches rely on our legitimate interest in preventing abuse and keeping accounts secure (Art. 6(1)(f) GDPR).

Settling subscriptions and keeping proof of payment follow from legal obligations, including tax law (Art. 6(1)(c) GDPR). Applying a creator code and confirming a purchase made with it serve the contract for the discounted subscription you ask for (Art. 6(1)(b) GDPR); keeping the codes applied, the purchase confirmations and the subscription events to settle and document creators' commissions follows from accounting and tax obligations and from our legitimate interest in paying commissions correctly (Art. 6(1)(c) and (f) GDPR).

Everything we mark as optional is based solely on your consent, which you can withdraw at any time in Settings (Art. 6(1)(a) GDPR).

Heart rate is health data. We save it with your activities, together with calories worked out from it, only on the basis of your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), and we keep a record of that consent because we must be able to prove it (Art. 7(1) and Art. 6(1)(c) GDPR). Exchanging data with Health Connect relies on the permissions you grant there (Art. 6(1)(a) GDPR).

Showing you ads relies on the same idea: in the European Economic Area, the United Kingdom and Switzerland, ads are shown only after you consent through Google's consent form (Art. 6(1)(a) GDPR); elsewhere we rely on our legitimate interest in showing non-personalised ads (Art. 6(1)(f) GDPR).

Heart rate: health data

Your heart rate is data concerning health, one of the special categories of personal data under Article 9 GDPR. It comes from the OutPath watch app or, if you connect it, from Health Connect. During and right after an activity, the app shows it on your phone and can use it to estimate the activity's calories.

We save it with your activities on our servers - the average, the maximum and a heart-rate chart, and the activity's calories when they were worked out from your heart rate - only if you give your explicit consent (Art. 9(2)(a) GDPR). Such calories count as heart-rate data too: together with the activity's duration and your weight, they reveal your average heart rate. The app asks for this consent separately, with nothing pre-selected, before the first activity with heart rate is saved. If you say no, your activities are still saved, just without heart rate and with calories estimated from your weight, speed and climb.

With your consent, heart rate is stored with the activity on our servers in the European Union (Frankfurt, Germany), so you keep it when you change phones. It is visible only to you, even on an activity you show on your profile. We never use it for advertising, never sell it and never give it to advertisers or other users.

You can withdraw your consent at any time in Settings, under "Health data", as easily as you gave it. We then stop saving heart rate and delete it from all your saved activities on our servers; calories worked out from it are replaced by the estimate from your weight, speed and climb, and the rest of each activity stays. If you are offline at that moment, this happens as soon as you are back online. Withdrawing consent does not affect the lawfulness of what was done before.

Health Connect

On Android 9 and newer, OutPath can exchange data with Health Connect, the place on your phone where health and fitness apps share data. It does so only after you connect it in Settings, under "Connected apps", and allow it on Health Connect's own permission screen, where each type of data is a separate permission. You can disconnect OutPath or change those permissions at any time, in OutPath or in Health Connect. The exchange itself happens on your phone.

What OutPath reads: only heart rate - recorded by another watch, a chest strap or another app - for an activity you recorded in OutPath when the OutPath watch app did not record it. Watches and apps often save many hours of readings as a single record in Health Connect, so OutPath asks for the heart-rate records that started during the activity or up to 24 hours before it, keeps only the readings taken during the activity, and discards all the others on your phone straight away - they are never saved or sent anywhere. We use the readings from the activity to show its average and maximum heart rate and a heart-rate chart, and to estimate its calories when the readings cover most of the activity. Heart rate, and calories worked out from it, are saved with the activity on our servers only with your consent, as described in the previous section.

What OutPath writes: after each activity you record, the exercise with its type and time, the route, distance, ascent and active calories, and heart rate only when it came from the OutPath watch app - so that other apps connected to Health Connect can show it. OutPath never writes back data it read from Health Connect. Deleting your OutPath account does not delete what was written to Health Connect; you can delete it there.

Data from Health Connect is used only to provide these features. We never use it for advertising, including personalised ads, never sell it, never pass it to ad networks, data brokers or anyone else unless the law requires it, never use it to decide on credit, insurance or employment, and no person reads it unless you ask us to, for example when you ask for help with a problem. Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

What we do not collect

We do not track your location in the background. We read your position while the map is on screen (to show you where you are), when you add a photo, when the Premium screen shows how many recent photos there are near you, and while an activity you started yourself is being recorded - also with the screen off, always with a notification showing that recording is on. Recording stops when you end the activity.

For that number of recent photos within 50 km of you, the app takes the last position your phone already knows - it does not switch on the GPS for this - and rounds it on the phone to 0.1 degree, that is to a grid cell of about 11 by 7 km. Only that rounded position goes to our server, without your account, and only if you have allowed the app to use your location. The server counts the photos around that point, sends back the number and does not save the position.

When the map is zoomed in, the app asks our server for the photos and places in the part of the map on screen, in squares of a quarter of a degree (about 28 by 18 km). Like every request for photos, it goes with your account, so that you see only the photos you are allowed to see; our database does not record which part of the map you looked at. The squares asked for are part of the address of the request, so they stay, together with your account's identifier, in Supabase's technical logs for 7 days (see "How long we keep data").

The app contains no analytics tool and collects no crash reports. If we ever add one, the app will first ask for your consent, naming the tool and what it is for; without that consent nothing of the kind is turned on.

What the app does count is anonymous: daily totals on our server that hold no account, no device or advertising identifier and no IP address. It adds one each time the Premium screen is shown, so that we can judge whether our offer still works. With Premium, it also adds one each time you start an activity, and counts separately how many of those started within 24 hours of using the fresh photos filter; when you last used the filter is kept only on your phone. Once, after 60 days of Premium, the app may ask you one question: how often fresh photos have kept you from a wasted trip. Answering is optional, and your answer is stored without your account. The app sends the activity counts and the answer signed in only so that our server can check that the account has Premium; the account is not saved with them.

We do not sell your data. We do not give advertisers your account, your photos, your GPS tracks or the places you visit - what the ad networks do receive is listed under "Advertising" below.

The app itself sets no cookies. It keeps your settings and choices on your phone (your notification settings and the app's language also with your account, see "What data we collect"), and ad networks store and read information on your device only as described under "Advertising". Instead of a cookie banner, the app tells you when you first open it what it needs in order to work, and where consent to ads is required, it is asked for in Google's consent form described under "Advertising". The website outpathapp.com is covered by its own section, "This website", in the version of this policy published at https://outpathapp.com/privacy/.

What is public

Your photos, captions, place names, place ratings, comments, @username and display name can be seen by anyone who uses the app, including in guest mode. You can narrow that down: when you create your account, or later under "Profile visibility" in Settings, you can show your photos to your followers only or to nobody but yourself, and a single photo you mark as private is seen only by you, together with its comments and likes. If you answer when creating your account that you are not yet 18, your profile starts out visible to your followers at most. Narrowing who sees your photos hides them in the app and, within minutes, moves their files so that their old links stop working; whoever may still see a photo opens it through a link that works for an hour at most. Marking a single photo as private works the same way. A photo everyone can see stays at its public link, also for someone you block, and we cannot remove a copy someone has already saved. If you have the Founder Plan, a Founding member badge is shown on your profile and next to your name on your photos, unless you turn it off in Settings.

Your email address is visible to no one but you. Your history of visited places is visible only to you, and so is every activity you save unless you choose to show it on your profile; this is enforced by the database itself, not just the interface. An activity you show - with the switch after saving it, on its page or when editing it - can be seen by the same people who can see your photos, according to your profile visibility: its name, type, date, duration, distance, elevation gain and loss, elevation profile and its route on the map, without at least the first and last 200 m of the route, so that where you started and finished is not shown. Its heart rate and calories, your body weight and its notes are never shown to anyone else, and you can hide the activity again at any time. Photos from one recorded activity are shown on your profile together, as one post: whoever may see those photos also sees that they come from the same activity, and each photo still shows where and when it was taken. The activity itself - its recorded route, distance and statistics - is seen only by you, unless you choose to show it on your profile.

Who processes data for us

Supabase - database, accounts and photo storage, servers in the European Union (region eu-central-1).

Google Workspace (Google Ireland Limited) - as our processor, delivers the emails Supabase Auth sends about your account, whether it was created in the app or on the website, such as the link to confirm your email address, the password reset link and the sign-in link, and, when you change your email address, the links that confirm the change, sent to both your current and your new address. For that, Google processes your email address, the content of the email - the link - and data about its delivery. Google keeps the data about the delivery of these emails in the logs of our Google Workspace admin console for 6 months. Our support@outpathapp.com and report@outpathapp.com mailboxes are hosted on Google Workspace too, so Google keeps the messages you send us there on our behalf.

Google Play and RevenueCat - subscriptions.

Google Play (Play Integrity) - as our processor, confirms that a photo upload, a new profile picture or an entered creator code comes from a genuine copy of OutPath on a device that passes Google's integrity checks; see "What data we collect".

Cloudflare - delivers the map. Every map tile passes through Cloudflare's servers, which see your device's IP address and the part of the map being loaded, not your account. Downloading a region for offline use also goes through Cloudflare, with your sign-in token, which is used only to check with Supabase whether the account has Premium or which free region it has chosen. Routes calculated offline never leave your phone. Every request the app sends to OutPath's own search, route and height server (Contabo, below) also passes through Cloudflare's network, which delivers it and protects that server against attacks. Cloudflare therefore sees what the request carries - the text you search for, coordinates, the points of a route or the points of a track sent to look up their heights - together with your device's IP address and the app's name and version, but nothing about your account.

Map data comes from OpenStreetMap contributors, prepared as map tiles by Protomaps. That is only where the data comes from - nothing is sent to them.

Contabo (Contabo GmbH, Germany) - hosts OutPath's own server for place search, for checking that a photo was taken outdoors, for route planning and for the heights of recorded activities; it holds Poland and Switzerland, where the app works for now. The app asks it from your phone, through Cloudflare's network: it receives the place name or coordinates you ask about, or after an activity the points of its track to look up their heights, and, like any server, sees your device's IP address and that the request comes from OutPath (the app gives its name and version). It receives nothing about your account, and the server keeps no record of the searches and routes it answers.

hCaptcha (Intuition Machines) - protects sign-in and sign-up from bots and may process technical data about your device for that purpose.

Google - if you choose to sign in with a Google account, and, if you do not have Premium, also as AdMob, the service that shows you ads.

Meta Audience Network, Unity Ads and AppLovin (in builds that include it) - the mediation networks AdMob works with to fill those ads. For choosing and measuring the ads you see, each acts as an independent controller of your data on its own account, not as our processor; "Advertising" below sets out what they receive.

Transfers outside the European Economic Area

The database, accounts and photos are stored in Frankfurt, in the European Union, by Supabase Pte. Ltd, a company based in Singapore. Supabase staff and its subprocessors may access them from outside the European Economic Area, including from Singapore and the United States, and Supabase's technical logs may be kept outside the European Union; these transfers rely on the European Commission's standard contractual clauses. Google, Cloudflare, hCaptcha, Meta, Unity Technologies and AppLovin (in builds that include it) are US companies, so Google Play's subscription data, the Google Play integrity check, the IP address used to load the map, the requests to OutPath's own search, route and height server (what you search for, coordinates and track points, with your IP address), the bot check and, if you are shown ads, the advertising data described under "Advertising" may be processed in the United States on the basis of the European Commission's adequacy decision (Data Privacy Framework) or its standard contractual clauses. RevenueCat, which handles subscriptions on our behalf, is a US company too; the subscription data it receives may be processed in the United States on the basis of the Commission's standard contractual clauses. Google Workspace, which delivers the emails about your account and hosts our mailboxes, is provided to us by Google Ireland Limited. Where those emails and the messages in our mailboxes are kept is not limited to the European Economic Area: Google may store and process them in data centres of its own and of its subprocessors in various countries, including the United States. They may be transferred to Google LLC in the United States on the basis of the European Commission's adequacy decision (Data Privacy Framework), and to other countries outside the European Economic Area on the basis of the Commission's standard contractual clauses.

How long we keep data

Until you delete it. Deleting a post also deletes its photo from storage. Deleting your account erases your profile, posts and photo files, comments, likes, ratings, visit history and saved activities. Heart rate saved with an activity, and calories worked out from it, are deleted with the activity or the account, and also when you withdraw your consent to it - the activity then keeps the calorie estimate from your weight, speed and climb; the record of when you gave or withdrew that consent is kept while your account exists. A report you send is deleted together with the reported photo, comment or account, and it stops being linked to you when you delete your account. A record of a moderation decision keeps a notice's reason and description but not who sent it, and is kept for 12 months after the decision - the six months you have to appeal, and time to deal with an appeal - and longer only while a dispute, a court case or an authority's request about it is still open. It stays even if the content or the account it concerns has been deleted. The record of when you accepted which version of the terms of service, and of when you were first shown the notice of a change, is kept while your account exists and is deleted with it. The result of the Google Play check of the app and the device is kept for 30 days, and is deleted sooner if you delete your account. An account created with an email address that is never confirmed is deleted automatically after 14 days, together with the address and everything recorded when it was created.

Database backups are overwritten on a rolling basis, so deleted data may survive in them for up to 30 days. Supabase keeps the technical logs of requests to our database, photo storage and server functions and of sign-ins for 7 days, with the IP address, the type of app or browser and the address of the request, and, for a request made while signed in and for a sign-in, also with the account's identifier. Cloudflare keeps the error logs of our map server for 7 days, and for 31 days the statistics of traffic to outpathapp.com addresses - the website, the map and our search, route and height server - including a sample of individual requests with their address and IP address. Billing records for subscriptions are kept by Google for the period tax law requires, regardless of deleting your account with us. The creator code your account holds is deleted with the account. The codes your account has applied, the confirmations of purchases made with a code and the subscription events are accounting records: they remain after you delete your account, no longer linked to your profile or email address, for as long as accounting and tax law requires.

How to delete your account

Settings, at the very bottom: "Delete account". It works immediately, without asking us. You can also delete it on the website: https://outpathapp.com/delete-account/.

Note: deleting your account does not end a subscription. The subscription lives in your Google account, not ours, so cancel it in Google Play first - otherwise Google will keep charging you.

Your rights

You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable form and object to processing, and, where we rely on consent, to withdraw it without affecting what was lawful before. If you have an account, you can download a copy of your data in the app at any time, free of charge: Settings, Your data, Download my data. It is one ZIP file with your profile, your posts and their photos, your activities and the rest of what your account holds, and its README file lists what it leaves out. For anything the copy does not include, and for any other request, write to support@outpathapp.com; we reply within a month. You can also lodge a complaint with the supervisory authority in the country where you live - in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Children

The app is not intended for anyone under 16, wherever they live. In Poland, 16 is the age from which a person can consent to the processing of their data by online services themselves; below it a parent's consent is needed, which we have no way to ask for. We do not knowingly collect data from such people.

Advertising

If you do not have Premium, the app shows ads to keep the free account free - never while an activity is being recorded. Premium removes them entirely. Ads are served by Google AdMob together with the mediation networks it works with to fill them: Meta Audience Network, Unity Ads and AppLovin (in builds that include it). For the ads shown to you, each of these companies acts as an independent controller of your data, not as our processor.

To choose and measure ads, they can receive your advertising identifier, your IP address, the coarse location that can be derived from it, information about your device and your use of the app, and data about how you interact with an ad - which one you saw, tapped or dismissed. They never receive your heart rate or anything from Health Connect.

In the European Economic Area, the United Kingdom and Switzerland, ads are shown only after you give consent through Google's consent form, which also lets you choose non-personalised ads instead of personalised ones. In those regions you can change or withdraw your choice at any time from "Ads and consent" in Settings. Outside those regions we rely on our legitimate interest in showing non-personalised ads. Wherever you are, you can reset or delete your advertising identifier in your phone's system settings, and you can object to non-personalised ads by writing to support@outpathapp.com.

Each network publishes its own privacy policy: Google/AdMob at https://policies.google.com/privacy, Meta at https://www.facebook.com/privacy/policy/, Unity at https://unity.com/legal/privacy-policy and AppLovin at https://www.applovin.com/privacy/.

Changes

We will tell you about significant changes in the app before they take effect. The date at the top shows when this document was last changed.

This website

This section is about outpathapp.com, the website you are reading; the sections above describe the app. The controller, the contact address and your rights are the same. The operator's full details, including the postal address, are in the legal notice.

Cloudflare hosts the website. To deliver each page and protect the site against attacks, its servers process your device's IP address, the address of the page you open and the technical details your browser sends with every request, such as the browser type. Cloudflare keeps the statistics of this traffic, including a sample of individual requests with their address and IP address, for 31 days. This relies on our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

The sign-up and account deletion forms send what you enter, except your answer to whether you are 18 or older, which stays in the form, to Supabase, which runs our accounts (see the list of processors above). While you type a username on the sign-up form, it is checked against the usernames already taken. With the account, the sign-up form sends which version of the terms of service you accepted and the language of the page, so that the emails about your account are in that language. Our server adds the time the account is created and notes that the acceptance came from the website, and we keep this with your account as the record of your acceptance. Supabase then emails you a link to confirm your address; like every email about your account, it is delivered through Google Workspace (see the list of processors above). The password you enter on the deletion form is used only to confirm that the account is yours. Both forms are protected by hCaptcha (Intuition Machines): it loads only on these two pages, once you start filling in the form, and may process technical data about your device and browser to tell people from bots, under hCaptcha's privacy policy. The forms serve the contract for the service (Art. 6(1)(b) GDPR); the bot check relies on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

While the Premium page shows the Founder Plan, it asks our database at Supabase how many of the plan's seats are left, once each time the page opens. The request carries nothing about you; like any server, Supabase sees your IP address and that the request comes from our website. This relies on our legitimate interest in showing the plan's real state (Art. 6(1)(f) GDPR).

The map page loads the map, with the lettering and symbols drawn on it, from OutPath's own map server, tiles.outpathapp.com, which runs on Cloudflare; it sees your IP address and which part of the map is loading. When you search for a place, your browser sends the text you typed and its language setting, once per search, to OutPath's own search server, which runs at Contabo in Germany and covers Poland and Switzerland, where OutPath works for now; like any server, it also sees your IP address and that the search comes from our website. It keeps no record of the searches. On its way there, the search passes through Cloudflare's network, which delivers it and protects the search server against attacks, so Cloudflare also sees the text you typed, your IP address and the technical details your browser sends, such as the browser type. If you press the location button, your browser asks for your permission first; your position then stays in your browser, which uses it to centre the map, and is not sent to us, although the map goes on to load that area from the map server. This relies on our legitimate interest in showing you the map and the search results you ask for (Art. 6(1)(f) GDPR).

If you email us, for example at support@outpathapp.com or, to report content, at report@outpathapp.com, we process your email address, your name if you give it, what you write and anything you attach, including the details of any content you report. We use them to answer you and deal with your matter, and for a notice of illegal content also to examine it and tell you what we decided. Handling notices of illegal content is an obligation under the EU Digital Services Act (Art. 6(1)(c) GDPR); for reports of content that only breaks our terms and for all other messages, we rely on our legitimate interest in answering the people who write to us (Art. 6(1)(f) GDPR). Our mailboxes are hosted on Google Workspace (Google Ireland Limited), which keeps the messages on our behalf as our processor. Where they are kept is not limited to the European Economic Area: Google may store and process them in data centres of its own and of its subprocessors in various countries, including the United States; they may be transferred to Google LLC in the United States on the basis of the European Commission's adequacy decision (Data Privacy Framework), and to other countries outside the European Economic Area on the basis of the Commission's standard contractual clauses. We do not tell the author of reported content who reported it unless that is strictly necessary to explain our decision (Art. 17 of the Digital Services Act), and we pass information to the police or prosecutors only where the law requires it. We keep an email while we deal with the matter and afterwards only as long as questions or claims about it can still arise; for a notice of illegal content, in particular as long as our decision can still be challenged.

The website sets no cookies, keeps nothing in your browser's local or session storage and runs no analytics or advertising scripts, which is why it shows no cookie banner. hCaptcha, once it loads on one of the two forms, works under its own privacy policy linked above.