Privacy notice

As of October 2026. The German version is authoritative.

1. Who is responsible?

André Hoffmann und Dr. Katrin Hoffmann (Bummly GbR in Gründung), Gartenstraße 4, 64354 Reinheim, email: hallo@bummly.app

2. In short

• This website sets no cookies and uses no tracking, analytics or embedded third-party services. Even the fonts are served from our own server.
• We only store data if you join the waitlist, and only for as long as you want to be on it.

3. Visiting the website

The website runs on the operator's own server in Germany. When you visit, the server processes technically necessary data: IP address, date and time, page requested, browser identifier and referrer. This is needed to deliver the page and fend off attacks (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest. The waitlist application itself does not store IP addresses; to prevent abuse it briefly counts sign-ups per address in memory, as a hash only.

4. Waitlist

What: your email address, the page language, optionally the city and occasions you tick, and the times you signed up and confirmed.

Why: to tell you when Bummly launches in your city or when we are looking for testers. City and occasions help us plan the pilot. We don't share the data and don't use it for third-party advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the box and clicking the confirmation link (double opt-in).

How long: unconfirmed sign-ups are deleted automatically after 30 days. Confirmed sign-ups are deleted when you unsubscribe, or at the latest when we no longer need the waitlist after launch.

Withdrawal: you can withdraw your consent at any time via the "unsubscribe" link in every email or by writing to hallo@bummly.app. Your address is then deleted immediately.

Sending email: we use Brevo (Sendinblue SAS, Paris) to send the confirmation email, under a data processing agreement where required (Art. 28 GDPR).

5. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Just send us an email.

You can also complain to a data protection authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).

6. The app

The future Bummly app will have its own privacy notice. This page only covers the website and the waitlist.

Walk together – show your location: if you turn on "Show my location for 1 hour" when sharing a walk, the app sends your location to our server while Bummly is open on your phone. Why: people you send the link to can see where you are, so you can meet at the start. The server only knows your latest location, only in memory (never in a database) and for one hour at most; when you stop sharing or the hour is up, it is deleted immediately. Recipients: only people who have the link. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with "Stop".

Learn from walks: so that Bummly learns at which traffic lights people wait a long time and which stretches many prefer to walk around, the app sends two kinds of reports to our server after your walks: short stops along the way (location and seconds, only 10 to 180 seconds, not at stops of the walk and not during breaks) and skipped stretches (start and end of the part you walked around). What not: no device or user ID, no trail of your walk, no time of day. Locations are rounded to about 10 metres; the app collects the reports of several walks and sends them shuffled in one batch, at least one hour later. The server stores only location, seconds and the date and deletes everything after 180 days. The reports are only used in aggregate (from five reports at the same spot) to improve walking times and routes for everyone. Legal basis: your consent (Art. 6(1)(a) GDPR). The "Learn from walks" switch in the settings is on by default; if you turn it off, the app sends nothing more and discards reports not yet sent.

My pace: how fast you walk is learned only on your device (only while moving, from one kilometre on). With each route request only the finished value in metres per minute is sent to the server so that the walk fits your pace; it is not stored there. You can turn it off or delete it in the settings.

Sending feedback: In the app you can send us text (praise, a greeting, criticism) or a photo. We store the text, the photo (saved again without location and camera data), language, app version and a random device ID that lets you view and withdraw your feedback. Photos are kept with a storage provider in the EU. Purpose: improving Bummly. An AI (Claude by Anthropic) helps us sort it by summarising texts and photos; bugs go into our task list on GitHub as a short note without your data. Legal basis: your consent by sending it (Art. 6(1)(a) GDPR). Marketing: Only if you tick “You may show this for Bummly” may we show the text or photo free of charge on our website and in social networks, with the name you give, otherwise without a name. For photos with people you confirm that everyone recognisable agrees; we do not show photos with children. Storage and withdrawal: Anything that may not be shown is deleted after 90 days. “Withdraw” in the app deletes text and photo immediately; anything already published is taken down as soon as possible.