Privacy policy

The short version

Looking up playgrounds needs no account. If you create an account we store your email address and either a password hash or your Google identity, plus the playgrounds you save. Your location is used only in your browser to show distances; it is never sent to us. We do not sell data, send marketing email or take payments. Whether analytics cookies are set depends on how this site is set up; see “Analytics and statistics”. Where the playground data comes from is listed under “Data sources”.

Who is responsible

The controller for data processing on this site, within the meaning of the GDPR, is the operator of Spielplatzkompass. You can reach them by email at support@spielplatzkompass.cc or through the contact page. No data protection officer has been appointed.

What we collect

Without an account:

• An anonymous session: a random identifier (kept in the spk_session cookie) and a token that protects forms. The server stores only a hash of the identifier.
• Search words and filters you type appear in the page address, like any web request. The site does not keep a search history.
• A report, if you send one (“Send a report”): the identifier of the playground it refers to, the category, your message (up to 1,000 characters) and the time. It is not linked to your account or session. Please do not include personal information.

With an email account:

• Your email address (stored in lower case) and a salted scrypt hash of your password. We never store the password itself.
• Your language preference, the account creation time and whether the email address is confirmed.
• Confirmation codes and password reset tokens, stored only as hashes (see “How long we keep data”).
• The playgrounds you save and when you saved them. We store the fixed identifier of the entry, not its name. If an entry later disappears from the directory, your account shows it as “no longer listed”.

With Google sign-in:

• Google’s stable identifier for your account and the email address Google reports as confirmed. We request the openid, email and profile permissions but store only those two values; Google tokens are discarded and your name and photo are not stored.
• If an account with the same confirmed email address already exists, the Google identity is attached to it. Otherwise the first Google sign-in creates a new account.

Your location

“Use my location” asks your browser for your position. If you allow it, the position stays in this browser tab (sessionStorage) and is used only to calculate straight-line distances on the page. It is not sent to our server, not stored in your account and not shared. Sorting by distance and “Playgrounds near you” download the coordinates of listed playgrounds and sort them in your browser. “Clear” or closing the tab removes it.

Data sources

Spielplatzkompass shows playgrounds in Germany that are recorded in open data. This section says where the information comes from, under which licence, and what it does not offer.

• OpenStreetMap: the location, name, equipment and other features of the playgrounds (for example water play, surface, operator, age range, opening hours) come from OpenStreetMap. © OpenStreetMap contributors, available under the Open Database Licence (ODbL): https://www.openstreetmap.org/copyright
• Administrative boundaries and postcode areas: the municipality and district boundaries and the postcode areas that we use to assign playgrounds to places and to search by place and postcode also come from OpenStreetMap data (ODbL). They are contributor data and can differ from the administrative boundaries as drawn by the authorities.
• Data extracts: we take the OpenStreetMap data as extracts of the German states, provided by Geofabrik (Geofabrik GmbH, also ODbL).
• Map tiles: OpenFreeMap © OpenMapTiles · Map data © OpenStreetMap contributors. Your browser loads the tiles from tiles.openfreemap.org whenever a map is shown. The credit also appears on the map itself.

What you should know about the information:

• The entries are mapped by people on OpenStreetMap. They can be out of date, incomplete or wrong, and not every playground is recorded.
• Where an entry says “mapped on site” with a month, a contributor recorded the entry on site in that month. That is their statement, not a confirmation by us.
• We show no live opening status. Opening hours appear only as text “according to the entry” when the entry has them. Things can have changed on site, for example through building work or a closure.
• We make no statement about the condition or maintenance of equipment and surfaces, or about whether they meet any standard. Have a look at the playground yourself on site.
• We do not intend to include private playgrounds, for example in nurseries, schools or housing estates, though filtering them out automatically does not succeed in every case. Age range, step-free access and similar details are shown only when recorded (“according to the entry”).
• Images on the site are illustrative images and do not show the playground named.
• We reload the data from new extracts from time to time. Whatever has changed on OpenStreetMap in the meantime appears here only after the next reload.

Reporting a mistake: if a playground is missing or a detail is wrong, use “Send a report” on the playground page or the contact page. We read every report. The data itself comes from OpenStreetMap, where you can correct it for good.

Why we use it

We do not use your data for marketing email. Saving a playground does not notify the playground or anyone else.

• To create and protect your account, sign you in, and send the one-time code or reset link you ask for.
• To keep your saved playgrounds and your language setting.
• To protect the site: rate limits use hashed identifiers, and forms require a token.
• To count aggregate usage (see “Analytics and statistics”) and to read reports by hand.

Legal bases

• Account, sign-in, saved playgrounds and emails with a code or link that you request: Art. 6(1)(b) GDPR (providing the service you want to use).
• Protecting the site (rate limits, form protection, technical request log), reports about entries, daily aggregate counters and loading map tiles: Art. 6(1)(f) GDPR. Our legitimate interest is a working, protected and steadily improving service.
• Google Analytics and the cookies it needs: your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw it at any time with effect for the future.
• Storage and cookies that are strictly necessary to run the site (session, language reminder during Google sign-in, your cookie choice, location in the tab): section 25(2) no. 2 TDDDG.
• Location: you trigger the location request yourself. The position stays in your browser and is not sent to us.

Who processes data

• Mail delivery: to send a confirmation code or password reset link, the site passes your email address and the code or link to the operator’s mail-delivery service (a self-operated mail workbench). It also receives short event messages (for example “registration completed”) that carry an internal account number and no email address.
• Google: if you choose Google sign-in, your browser goes to Google and Google returns your confirmed identity. If analytics is set up and you have not objected or declined, Google Analytics also receives page views. Google handles that data under its own policies and may transfer it outside the EU, for example to the USA; according to Google, protections such as the EU-U.S. Data Privacy Framework or standard contractual clauses apply there.
• Site statistics service: the site can send the operator’s own statistics service one daily aggregate (registration count, total and active accounts) with the site identifier and domain. It contains no email address, user identifier, IP address or page content.
• Maps: when a page shows a map, your browser loads map tiles from tiles.openfreemap.org (OpenFreeMap). OpenFreeMap receives the usual request data (such as your IP address). Your shared location is not sent with these requests. On the map pages your browser asks us for the playgrounds in the visible map area; what is sent is that area (a rectangle of coordinates), not your location, and we do not store it.
• Hosting: the site software can write a technical request log (time, method, path, status, duration, request id; no query string, cookie or IP address). The server or network that hosts it may keep its own standard logs.
• Links to playground operators’ websites and to maps open third-party services with their own privacy policies.

Advertising

Some pages reserve clearly labelled advertising spaces. No advertising network is connected at the moment, so these spaces are not shown and set no cookies. If that changes, this policy will be updated before any advertising is shown.

Cookies and browser storage

These are all the cookies and storage keys the site sets.

Analytics and statistics

Analytics is set up on this site and is switched on by default. Google Analytics then sets cookies in your browser (see the cookie table for names, purpose and duration) and receives page-view data (page path, language, browser and approximate location) to produce visit statistics. You can switch it off in this browser at any time with the control below.

Separately from Google Analytics, the site counts daily aggregates (see “Who processes data”). They contain no personal data.

How long we keep data

• Sessions last 7 days and are deleted when you sign out, reset your password or delete your account. Expired rows are removed by a clean-up that runs every 10 minutes.
• Registration codes are valid for 10 minutes with at most 5 attempts; password reset links are valid for 30 minutes and work once. They are stored only as hashes.
• Mail waiting to be sent holds your address and the code or link until it is delivered, then is deleted. Mail that cannot be delivered, or that has expired, has the address and content erased, and its record is removed after 7 days.
• Your account, saved playgrounds and Google link are kept until you delete the account.
• Reports are kept to be read by hand. Daily aggregate counters contain no personal data and are kept.
• If the operator keeps copies of the database, a deleted account can remain in those copies until they are replaced or deleted.

Your choices and rights

You can delete your account yourself: sign in, open Account, and use “Delete account”. You confirm with your password (or, for an account without a password, by typing your email address within 10 minutes of signing in with Google). Deletion removes your account, sessions, saved playgrounds, codes and reset tokens, your Google link and any waiting mail addressed to you. It cannot be undone.

Under the GDPR you have these rights, where the conditions for each are met:

• access to the data stored about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18), including notice to recipients (Art. 19),
• receiving your data in a common format (Art. 20),
• objection to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21),
• withdrawal of consent with effect for the future (Art. 7(3)), and
• a complaint to a data protection supervisory authority, for example where you live (Art. 77).

For requests about your data, such as a copy or a correction, use the contact page or write to support@spielplatzkompass.cc. No automated decision-making within the meaning of Art. 22 GDPR takes place. Giving us your data is voluntary, but without an email address or Google sign-in you cannot use an account.

You can change your analytics choice at any time with the control in “Analytics and statistics”, and you can clear cookies and tab storage in your browser.

Children

This site is aimed at adults, for example parents and carers, and not at children. Accounts are not designed for children. If you believe a child has an account, contact us through the contact page and we will delete it.

Changes to this policy

We may update this policy when the site changes. The date at the top shows when it was last updated. See also the terms of use.