← Back to the homepage Deutsche Fassung

Privacy Policy

This privacy policy applies to the website halfwayapp.de, the web app app.halfwayapp.de and the Android app “Halfway”. It is a translation of the German version; in case of discrepancies the German version prevails.

1. Controller

Nicolas Jansohn, trading as KikuchiLabs
Am Kastanienberg 55
69151 Neckargemünd
Germany
E-mail: info@kikuchilabs.de

We have not appointed a data protection officer, as we are not required to. Please send any privacy questions to the address above.

2. Overview and provision of your data

Halfway calculates fair meeting points between several starting locations. To do so we process the places you enter and the technical data generated whenever a website is accessed. You can use the website and the app without an account.

Providing your e-mail address is required to register; without it you can only use Halfway's free tier without an account. To make a purchase you need to provide the details our payment partner asks for at checkout. Otherwise you are under no statutory or contractual obligation to provide data; without the places you enter, however, no meeting point can be calculated.

3. Hosting and server logs

Hosting: Our website and app run on a server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, which processes the data on our behalf (Art. 28 GDPR). Route and reachability calculation (OSRM, Valhalla) and statistics (Umami, section 9) run on the same server; this data does not leave the server. Legal basis: Art. 6(1)(f) GDPR (secure, efficient operation) and Art. 6(1)(b) GDPR.

Server logs: When you access our pages our web server stores access data (truncated IP address, date and time, requested URL without search terms, status code, user agent, referrer). Legal basis: Art. 6(1)(f) GDPR (operational security, troubleshooting, abuse prevention). Logs are deleted automatically after 7 days.

4. Using the app

4.1 Meeting point calculation and address search

Your browser sends the places and search terms you enter to our server, which calculates routes and reachability areas with its own OSRM and Valhalla instances. For address search our server forwards the search term to the Photon geocoding service of komoot GmbH (Germany); for finding places such as cafés or restaurants it sends coordinates to the public Overpass API (overpass-api.de, OpenStreetMap data) and – for details, ratings and photos – to the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Photos from Google are fetched by our server and passed on to you. In all of these requests our server contacts the provider; your IP address is not transmitted. Legal basis: Art. 6(1)(b) GDPR.

Calculation results are not stored permanently on our server. To enforce usage limits we count calculations per day (for signed-in users together with the e-mail address); these counters are deleted after 60 days, technical logs of requests to external services after 90 days.

4.2 Live traffic (TomTom)

For the optional “Live Traffic” feature our server sends the route coordinates, but not your IP address, to TomTom International B.V., De Ruijterkade 154, 1011 AC Amsterdam, Netherlands. Legal basis: Art. 6(1)(b) GDPR.

4.3 Map display

To display the map, your browser loads map tiles, fonts and icons directly from OpenFreeMap (tiles.openfreemap.org, delivered via Cloudflare, Inc., USA) or, if selected, VersaTiles (tiles.versatiles.org). Your IP address, the map section and technical browser data are transmitted to the respective provider; the map cannot be shown without this connection. No cookies are set. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working map).

4.4 Shared plans

If you share a plan, we store the plan (places, parameters) on our server under a random identifier so the link works; for signed-in users linked to the e-mail address. Anyone who knows the link can open the plan. Legal basis: Art. 6(1)(b) GDPR. Stored plans are deleted together with your account or on request.

5. User account

5.1 Sign-up and sign-in (Supabase)

For accounts we use Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) as our processor; our database is hosted in the EU region Frankfurt. We process your e-mail address, a password hash or the sign-in data of the chosen provider, the sign-up date and your plan. To keep you signed in, Supabase stores a technically necessary session token in your browser. Legal basis: Art. 6(1)(b) GDPR. For transfers to third countries see section 13.

5.2 E-mail delivery (Mailjet)

System e-mails (sign-up confirmation, password reset) are sent via Supabase using Mailjet (Mailjet SAS, France, part of the Sinch group) acting as our processor. Your e-mail address and the message content are processed. Legal basis: Art. 6(1)(b) GDPR.

5.3 Sign in with Google

You may optionally sign in with your Google account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). You will be redirected to Google; we receive your name, e-mail address and, if applicable, profile picture. Data may be transferred to Google LLC in the USA (see section 13). Legal basis: Art. 6(1)(b) GDPR.

5.4 Deleting your account

You can delete your account in the app at any time; see halfwayapp.de/konto-loeschen for how. We then delete your account data and stored plans. Purchase records are kept by us or our payment partner for as long as commercial and tax law requires.

6. Purchases (Premium)

Web: Purchases in the web app are handled by Lemon Squeezy (Link, LLC, formerly Lemon Squeezy LLC, USA; part of the Stripe group). Lemon Squeezy is the seller (merchant of record) and an independent controller for the payment, billing and tax data you enter at checkout; the Lemon Squeezy privacy policy applies. Only when you click “Buy” do we send your e-mail address and the chosen plan to Lemon Squeezy and redirect you to its checkout page; before that the app loads nothing from Lemon Squeezy. Lemon Squeezy tells us the payment status, an order ID and the plan; we never receive card details. Legal basis: Art. 6(1)(b) GDPR.

Country check: Premium is currently only available in Europe. When you start the checkout, our server determines the country of your IP address locally using the “IP to Country Lite” database by DB-IP (licensed under CC BY 4.0) and passes it to Lemon Squeezy as the pre-selected billing country. Your IP address is not sent to anyone for this and is not stored. Legal basis: Art. 6(1)(b) GDPR.

Android: Purchases in the Android app go through Google Play (Google Ireland Limited). Google tells us a purchase token, the product and the status; we verify the purchase via the Google Play Developer API. Google's privacy policy applies to the payment itself. Legal basis: Art. 6(1)(b) GDPR.

We keep our purchase records (order ID, plan, term, e-mail address) for the duration of the contract and thereafter as required by statutory retention obligations (up to 10 years, Sec. 147 AO, Sec. 257 HGB).

7. Cookies and local storage

The website and the app set no cookies before you sign in. After you sign in, the app stores a session token without which sign-in would not work.

The app keeps the following entries in your browser's local storage so your settings and input are kept for your next visit:

  • theme, language, tileStyle, advancedMode, providerPreferences: appearance, language, map style and calculation settings
  • currentPlan and savedPlans: your current or saved plans, i.e. the start points and destinations you entered, including coordinates and calculation parameters
  • poi-drawer-filters: your filters for the place search
  • umami.disabled: only if you opted out of statistics (section 9)

This data stays on your device until you reset it in the app or clear your browser's site data. Access is strictly necessary for the function you requested (Sec. 25(2) No. 2 TDDDG); the legal basis for the processing is Art. 6(1)(b) GDPR.

8. Embedded YouTube videos

Our homepage embeds short videos from our YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

We use a two-click solution: when the page loads, only a preview image from our own server is shown and no connection to YouTube or Google is made. Only when you click the preview image is the video loaded in privacy-enhanced mode (youtube-nocookie.com). Data such as your IP address, browser and device information and the page visited is then transmitted to Google; Google may also use cookies or similar technologies and transfer data to the USA (see section 13).

The legal basis is your consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG, given by clicking the preview image. You may withdraw it at any time with effect for the future (Art. 7(3) GDPR): without a click no data is sent to Google, and reloading the page disables the video again. More information: Google Privacy Policy.

9. Statistics (Umami)

For statistics we use the open-source software Umami, self-hosted on our server in Germany (analytics.halfwayapp.de). Umami sets no cookies and stores nothing on your device. Your browser sends the page visited, referrer, screen size, language and browser/OS/device type; we also count individual clicks (e.g. on “Open app”) and completed purchases (without payment data). Country, region and city are derived from your IP address; Umami does not store the IP address itself but hashes it together with the user agent and a regularly rotating salt into an identifier. The data is therefore pseudonymous, not anonymous. Data is neither combined with other data nor shared with third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our service). Raw data is deleted after 13 months.

Opt-out: You can switch off the collection for this browser. The setting is stored locally (umami.disabled) and applies separately to the website and the web app.

Disable statistics in the web app

Social media: Our website links to our profiles on Instagram (Meta Platforms Ireland Ltd.) and YouTube (Google Ireland Limited). These are plain links, not social media plug-ins: no data is sent to these providers when you visit our site. Only when you follow a link do you reach the provider's platform, where its privacy terms apply.

Partner offers: The app may show links to Booking.com, CHECK24, GetYourGuide and Quandoo that contain the meeting point location as a search parameter. These, too, are plain links without tracking on our side; no data is transmitted before you click. Where a partner ID is configured, the link contains this fixed Halfway ID but no identifier of you or your session; we may then receive a commission on a booking. After the click the provider's privacy terms apply. Legal basis for showing the links: Art. 6(1)(f) GDPR (legitimate interest in useful recommendations and in funding the service).

11. Contact form and e-mail contact

You can reach us via our contact form or by e-mail to info@kikuchilabs.de. We process your e-mail address, your message and, if provided, your name in order to answer your enquiry. The e-mail address and the message are required because we cannot reply otherwise; the name is optional.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract with us (e.g. your account or a purchase) or steps prior to entering into one; for all other enquiries Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

How your message travels and recipients: The form sends your details to our server (section 3). The server does not store them but immediately forwards them as an e-mail via Mailjet (Mailjet SAS, France; processor, see section 5.2) to our mailbox info@kikuchilabs.de, with open and click tracking switched off. The mailbox is hosted on an e-mail server we operate ourselves. If you write to us directly by e-mail, Mailjet is not involved.

Abuse protection: To prevent mass submissions, our server counts requests per IP address (at most 5 per hour and 20 per day). For this it keeps the IP address only as a check value (hash) in volatile memory and discards it after 24 hours at the latest. The form processing neither puts the IP address into the e-mail nor writes it to a log; the general access logs of the web server are covered in section 3. The form also contains a field that is invisible to humans and a minimum fill-in time; we do not use a captcha or any third-party service. Legal basis: Art. 6(1)(f) GDPR (protecting our service against spam).

Retention: We delete your enquiry once it has been dealt with, at the latest when any statutory retention periods have expired (for example where the correspondence concerns a purchase, Sec. 147 AO, Sec. 257 HGB).

12. Android app test phase (ended)

Before the release on Google Play you could sign up on our home page for a test phase of the Android app. This test phase has ended; new sign-ups are no longer possible.

We still hold the e-mail addresses provided at sign-up and the voucher codes bound to them (Premium codes that can only be redeemed by an account with exactly that address). The codes can be redeemed up to and including 15 October 2026. Once this redemption period has expired, we delete the e-mail addresses and the codes bound to them. Premium that has already been redeemed is not affected.

On 1 October 2026 everyone who had signed up received a one-off closing e-mail about the end of the test phase and the redemption deadline. It was sent from hallo@halfwayapp.de via Mailjet as our processor (section 5.2). We do not send any further e-mails to these addresses; they are not used for advertising and not shared with third parties.

As at sign-up, the legal basis is your consent (Art. 6(1)(a) GDPR); for redeeming the voucher code additionally Art. 6(1)(b) GDPR. You may withdraw your consent at any time by an informal message to info@kikuchilabs.de; we will then delete your address and the associated code early.

13. Transfers to third countries

Transfers to third countries (in particular the USA) may occur with the following recipients:

  • Supabase Pte. Ltd. (Singapore; accounts; hosted in Frankfurt/EU, access from third countries such as Singapore and the USA possible): safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Supabase's data processing agreement.
  • Google LLC (Places search via our server, Google sign-in, YouTube after click, Google Play): adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under it.
  • Cloudflare, Inc. (delivery of OpenFreeMap map tiles): EU-US Data Privacy Framework (Art. 45 GDPR); Cloudflare is certified under it.
  • Lemon Squeezy (Link, LLC, USA) (sale as merchant of record, independent controller): transferring your e-mail address on purchase is necessary to perform the contract you requested (Art. 49(1)(b) GDPR).

Copies of the safeguards are available on request at info@kikuchilabs.de.

14. Retention at a glance

  • Server logs: 7 days, IP address truncated
  • Statistics (Umami): 13 months
  • Usage counters: 60 days; logs of requests to external services: 90 days
  • Android app crash reports (without account data): 90 days
  • Contact enquiries: until dealt with, or until statutory retention periods expire where they apply; counters for the contact form: at most 24 hours in memory
  • Android app test phase: e-mail addresses and bound voucher codes until the redemption period ends on 15 October 2026, then deleted
  • Account, saved and shared plans: until the account is deleted or on request
  • Purchase records: term of the contract plus statutory retention periods (up to 10 years)
  • Data in your browser's local storage: until you delete it

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Just write to info@kikuchilabs.de.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Withdrawal: You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence. The authority competent for us is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

No automated decision-making including profiling (Art. 22 GDPR) takes place.

16. Changes

We update this privacy policy when our service or the law changes.

Last updated: October 2026