Privacy Policy

Last updated: June 2026 · wuppit app & landing page

🔒 Summary: wuppit stores data locally, optionally backs it up in the EU, and uses no advertising or trackers. When using Apple or Google sign-in, those providers technically receive information about the sign-in process.

1. Data controller

Digipren GmbH · Wolfgang Oswald
Email: info@digipren.com

2. Account & data storage in the app

wuppit stores your profile, cleanup actions, points, badges and challenge progress by default exclusively on your local device (AsyncStorage).

With your consent, wuppit transmits anonymous usage statistics to Supabase after each cleanup (see section 4 for details). This data contains no user ID, no nickname and no device identifier. Transmission is disabled by default and can be enabled in the app settings.

With the optional account, your progress is additionally backed up in encrypted form at Supabase (data center EU-West, Frankfurt/Main). Access is restricted to your account only via Row Level Security. Legal basis: Art. 6(1)(b) GDPR (contract performance).

3. Sign-in providers (Apple & Google)

You can optionally sign in with your Apple ID or Google account. A connection to Apple or Google is only established once you actively tap the respective button.

Sign in with Apple: Apple only transmits a pseudonymous provider ID and optionally an email address to wuppit. You can hide your real email using Apple's Private Relay address. Apple technically receives the information that your account is used for wuppit. Apple Inc. is therefore an additional data recipient. Apple's privacy information: apple.com/legal/privacy.

Sign in with Google: Google only transmits a pseudonymous provider ID and your Google email address to wuppit. Only the minimum scopes (openid, email) are requested – no calendar, contacts or other data. Google LLC is therefore an additional data recipient. Google's privacy information: policies.google.com/privacy.

Legal basis for using social sign-in: Art. 6(1)(a) GDPR (consent through actively selecting the respective sign-in provider). Consent can be withdrawn at any time by signing out and using a different sign-in method.

4. Anonymous usage statistics

If you enable anonymous statistics in the app settings, the following fields are transmitted to Supabase after each cleanup:

Date of the cleanup (day only, no time)
Number of items collected and categories
Points earned and, if applicable, the active challenge ID
Whether a confirmation was given (yes/no)
App version
Approximate region (city or district level), only if you entered a location in your profile or during the cleanup – no street, no house number
Coordinates rounded to 0.1 degrees – only if you use the GPS button (voluntary). This corresponds to a grid of about 11 km north-south; the maximum deviation is about 5.6 km per axis. Without GPS use, no coordinates are transmitted.

No user ID, device ID, email address, session ID, photos or notes are transmitted. Supabase technically receives the sender's IP address with every HTTPS request; wuppit does not store or process this IP address as an identifier. The data cannot be traced back to a natural person and therefore counts as non-personal data under Art. 4(1) GDPR.

Opt-in (disabled by default): Transmission of anonymous statistics is disabled by default. You can enable or disable it at any time in the app settings (Profile → Settings → Anonymous statistics).

Legal basis: Art. 6(1)(a) GDPR (consent).

5. Groups feature

wuppit lets you create groups and invite other users to join via an invite code. When you join or create a group, the following data is stored in the Supabase database (EU-West, Frankfurt):

Your nickname (self-chosen, no real name required)
A pseudonymous account ID to securely associate your membership
Your aggregated statistics (points, number of items collected, cleanup count)

Groups require a signed-in account. Other group members see neither your email address nor exact location data. The account ID is processed exclusively to authorize your membership and admin rights and is not displayed as plain text to other members.

For tamper-proof group scoring, Supabase stores a local action ID, the date, quantities and categories, disposal confirmation and optionally the terrain type for your cleanups. Group points are calculated exclusively server-side from this data. A successful peer verification is included with the existing bonus. Location, coordinates and notes are not stored for group scoring. Duplicate action IDs are not scored again.

Legal basis: Art. 6(1)(a) GDPR (consent through actively joining a group).

Deletion: You can leave any group via "Leave group" in the app. This permanently deletes your membership and statistics from the group. Alternatively, "Delete all data" under Settings also deletes all your group memberships in Supabase.

6. Account deletion

You can fully delete your wuppit account at any time. The "Delete account" function under Settings → Backup permanently removes:

All local app data (profile, actions, badges, challenge progress)
Your cloud backup in Supabase
All group memberships
Your authentication account (email/Apple/Google link)

After deletion, all data is irrevocably removed. Recovery is not possible. Legal basis: Art. 17 GDPR (right to erasure).

7. Service providers

Supabase Inc. (USA) operates the database infrastructure. wuppit's servers are located in Frankfurt/Main (EU-West). Supabase is certified under the EU-US Data Privacy Framework. More information: supabase.com/privacy.

8. No advertising, no trackers

wuppit uses no advertising networks, no third-party analytics services (Google Analytics, Facebook Pixel or similar) and no tracking cookies. The landing page only loads map tiles from CartoDB/OpenStreetMap for the heatmap display.

9. Live statistics on the landing page

The homepage shows aggregated metrics (number of cleanups, items collected, active regions) and a heatmap from wuppit's operation. This data is fetched once when the page loads directly in the browser via fetch() from the Supabase REST API (data center EU-West, Frankfurt/Main).

No cookies are set and no personal data is transmitted in the process. The anon key (public read-only key) is sent as an HTTP header — it is read-only and only authorizes access to the two aggregated RPC functions (get_wuppit_stats, get_cleanup_heatmap). Only counts and rounded coordinates without personal reference are returned. Your IP address is technically transmitted to Supabase in the process, but not stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing public impact).

10. Map service providers (landing page)

The world map on this page uses Leaflet.js (bundled locally, no CDN call) with map tiles from CartoDB and OpenStreetMap. When map tiles load, your IP address is technically transmitted to the tile servers. Legal basis: Art. 6(1)(f) GDPR. CartoDB privacy policy: carto.com/privacy.

11. Your rights

You always have the right to:

Access the data stored about you (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR) – in the app under Settings → "Delete local data" as well as in the Backup tab → "Delete account" (fully deletes profile, cloud backup, group memberships and authentication account)
Object to the processing (Art. 21 GDPR)
Lodge a complaint with a data protection supervisory authority

Contact for privacy inquiries: info@digipren.com

12. No cookies, no tracking

This landing page sets no cookies and uses no tracking or analytics services. There is no cookie banner because none is necessary. The only connections to external servers are the Supabase data request on page load and the CartoDB map tiles — both technically necessary to display the page, not tracking connections.

13. Data security

Transmission between the app and Supabase happens exclusively over HTTPS/TLS. Account data is secured via Row Level Security so that no other user and no public query can access your data.