This translation is provided for convenience. Only the German version is legally binding.
What data VOXPEERS processes, for what purpose, for how long – and what rights you have.
This Privacy Policy applies to the website voxpeers.com and the app VOXPEERS (group intercom and navigation for cyclists and groups). We process your data in accordance with the Swiss Federal Act on Data Protection (FADP) and — where applicable, in particular for users in the EU/EEA — the General Data Protection Regulation (GDPR).
Summary: We do not sell data, we do not show advertising, and we store as little as possible. Your voice is transmitted in real time and is not recorded by us. Your location is needed for navigation and remains pseudonymous.
VOXPEERS, Inhaber Norbert Mächler
Schönaustrasse 2b
8722 Kaltbrunn
Switzerland
Email: datenschutz@voxpeers.com
No data protection officer has been appointed (not required by law).
We process personal data on the following legal bases (Art. 6(1) GDPR and the FADP respectively):
The website is operated by WPspace (WordPress hosting; provider: Broll IT & Media GmbH, Koblenz) in data centres in Germany. When the website is accessed, server log data are processed for technical reasons (IP address, time, page accessed, browser/device type, referrer). Purpose: delivery and security of the website (legitimate interest). The connection is TLS-encrypted; the certificates are issued by Let’s Encrypt (Internet Security Research Group).
To protect against attacks, we use the security plugin All-In-One Security (AIOS) (PHP firewall and login protection). IP addresses, access data and failed login attempts are processed locally on our server in the website database in order to detect attacks and to block logins after several failed attempts. According to the manufacturer, no data is transmitted to third parties or external servers in the process. Lockout logs are deleted after 90 days by default. Legal basis: legitimate interest in a secure website.
The website does not use any audience measurement or visitor statistics and does not integrate any services from Automattic or WordPress.com (Jetpack). When you open our pages, no data are therefore transmitted to statistics or measurement services.
The website sets no tracking, analytics or marketing cookies and embeds no content from third-party servers for advertising or measurement purposes. We do not load fonts or program libraries from third parties or content delivery networks: since 10 October 2026 they have been served from voxpeers.com itself. The only exception is the map on /touren/: there your browser loads the map tiles directly from Stadia Maps, and Stadia receives your IP address (see section 4.4). Only the following is stored on your device, and only as technically necessary:
| Name | Purpose | Duration | Type |
|---|---|---|---|
pll_language |
Remembers the language you chose for the website (Polylang) | 1 year | Cookie |
| Login session (Supabase Auth) | Keeps you signed in on /konto/, /touren/ and /tourist/guide/ after you sign in | until you sign out or the session expires | localStorage of your browser, only when signed in |
grevo_g_sprache, grevo_t_sprache |
Carry the chosen language over to the areas with their own language switch (/konto/, /tourist/ and others) | until you delete the browser data | localStorage of your browser |
| Browser identifier, listening via the web | Assigns your participation to the tour when listening at /t/ | see section 4.9 | localStorage of your browser, only when listening |
For administering the website, WordPress sets additional session cookies at login; they affect administrators only.
Refusing and legal basis: Because we use only technically necessary storage, we do not ask for consent and do not show a cookie banner. The legal basis is our legitimate interest in a working website or, for signing in, performance of a contract. You can refuse or delete cookies and local storage at any time in your browser settings (notice under Art. 45c of the Swiss Telecommunications Act); without them the website does not remember your language, and signing in on /konto/, /touren/ and /tourist/guide/ does not work. For visitors from Germany and Austria: this storage is strictly necessary for the service you requested and is therefore permitted without consent (Section 25(2) no. 2 TDDDG and Section 165(3) TKG 2021 respectively).
If you sign up for news or for the launch sign-up, we process your email address via Brevo (Brevo SAS, Paris, France; hosting in the EU). Sign-up uses double opt-in (confirmation email); the time of sign-up and the confirmation are logged. Legal basis: consent — which you can withdraw at any time via the unsubscribe link in every email.
The sign-up form is an embedded form provided by Brevo. As soon as you open a page containing the form (e.g. /vorabanmeldung/, /testkreis/ and their language versions), your browser loads the form and the associated scripts and styles from Brevo servers (sibforms.com, brevo.com); for technical reasons, Brevo receives your IP address, browser information and the page visited. Brevo processes these data as our processor in the EU. Legal basis for loading the form: legitimate interest in a functioning sign-up (Art. 6(1)(f) GDPR and Art. 31(1) FADP respectively). You only transmit your email address when you submit the form.
If you write to us by email, we process your details in order to handle your enquiry (performance of a contract or legitimate interest). We also send transactional emails (e.g. confirmations) via Brevo (EU).
Signing in on the website uses the same account as the app (Supabase, see section 4.1). No separate WordPress accounts are created for users.
For your VOXPEERS account, we process your email address, password (encrypted/hashed), profile details (e.g. display name, optionally weight for statistics features, optionally a profile photo), optionally saved places (‘My places’, e.g. home and work, with label and coordinates), groups with group name and optional group photo, subscription status and usage quotas (minutes). Our backend service provider is Supabase (Supabase Inc., USA) — our database runs in the AWS eu-central-2 region, Zurich, Switzerland; your account data are therefore physically stored in Switzerland. Supabase is bound by a data processing agreement incorporating standard contractual clauses (sub-processors include AWS and Cloudflare). Profile and group photos are visible to the members of your groups and are delivered via a web address that does not require sign-in; so only upload photos that others may see. You can change or delete photos and saved places in the app at any time. Legal basis: performance of a contract.
On the first successful sign-in, we store the IP address of your device (signup_ip). Purpose: protection against abuse and fraud (e.g. mass registrations). Legal basis: legitimate interest. The IP address is visible only to us in the admin area and is deleted together with the account.
The core of VOXPEERS is group intercom. For this, the app accesses the microphone — only with your system permission. Voice transmission runs via Agora (Agora Inc., USA) as a processor:
Legal basis: performance of a contract.
For navigation, elevation/ride statistics and tour recording, the app processes your GPS location (system permission required):
tiles-eu.stadiamaps.com (servers in Frankfurt and Paris). Stadia receives the IP address of your device or browser and the coordinates of the map sections requested, without any link to an account; according to Stadia, personal data is removed at the network edge. Stadia’s data processing agreement (DPA) covers the GDPR and the Swiss FADP; because Stadia is based in the USA, any third-country transfer relies on standard contractual clauses. Legal basis: performance of a contract (map function of the app) or legitimate interest in displaying the map (website). In the app, loaded tiles are cached locally on your device (offline maps).hoehe, Supabase) queries the Open-Meteo Elevation API (Open-Meteo, operator based in the EU). Your app does not contact Open-Meteo directly — the request runs via our own server function. Only the coordinates of the queried route points (a maximum of 100 per request) and the time of the request are transmitted — without any link to your account and without identifiers; your device’s IP address does not reach Open-Meteo, as our server acts as an intermediary. Legal basis: performance of a contract (the elevation profile is part of the navigation and tour features). We store the calculated elevation values themselves together with the respective tour in our database (see section 7); to the best of our knowledge, no personal data remain with Open-Meteo.Legal basis: performance of a contract. Your position is not shown live to other group members.
Purchases and subscriptions are handled via the Apple App Store or Google Play; your payment data are processed exclusively by Apple or Google in accordance with their privacy policies — we do not see any payment data. To manage purchase/subscription status, we use RevenueCat (RevenueCat Inc., USA): a pseudonymous app user ID, purchase/subscription status, platform and transaction IDs are processed (transfer to a third country, USA, standard contractual clauses). Legal basis: performance of a contract; billing data are additionally retained on the basis of statutory obligations. RevenueCat is initialised as soon as the app starts, i.e. before you sign in; until then the module works with an anonymous identifier assigned by RevenueCat, which is linked to your pseudonymous app user ID after you sign in.
For notifications such as ‘I’m waiting for you’, we use Firebase Cloud Messaging (Google). A device token (push identifier) is processed; Google may process data worldwide (standard contractual clauses via the Google Data Processing Addendum). Push notifications can be disabled at any time in the system settings. Legal basis: performance of a contract. Firebase is likewise initialised as soon as the app starts, i.e. before you sign in; in the process Google may technically assign an installation identifier to the app installation. The push identifier is assigned to your account only after you sign in (see also section 4.11).
Upon registration and purchases, the operator receives an internal information email (your email address, event type, product) — sent via Brevo (EU). Purpose: operation and support. Legal basis: legitimate interest.
Only for accounts that we have flagged as testers (e.g. field-test team) does the app upload technical diagnostic data at the end of a ride (e.g. connection, rerouting and audio metrics). For regular users, this feature is inactive; no hidden telemetry takes place. Legal basis: consent, which you give as a tester in a dialog in the app when you first start a ride with tester status and which you can withdraw at any time in your profile (Art. 6(1)(a) GDPR and Art. 31(1) FADP respectively).
Anyone who joins a VOXPEERS Tourist guided tour as a guest via QR code or tour code does so expressly without their own VOXPEERS account: there is no registration, no email address is required and no user account is created. This section describes exhaustively what happens to the data of guests without an account. For the guide, the information on the VOXPEERS account (section 4.1) applies instead.
What data we process and why
| Data category | Purpose | Retention period |
|---|---|---|
| Device hash or browser identifier (a pseudonymous identifier generated technically from the device, the browser or the participation; no real name, no permanent device ID) | Assigning the participation to the correct guided tour during the live transmission; basis for billing | 30 days, then automatically anonymised (identifier set to null) |
| Time of joining and leaving (and the participation duration calculated from these) | Displaying the current number of participants to the guide (upper limit as per T&Cs section 4.4); per-minute billing of the listener hours booked by the guide | 30 days; thereafter the identifier is anonymised, and the bare participation duration in minutes is retained without any personal reference for billing purposes |
| Agora connection data (technical connection and quality data of the audio service, e.g. connection status/quality; see section 4.3) | Technical operation of the live transmission; fault analysis in the event of connection/sound problems | 30 days, then anonymised together with the identifier |
| Report data (only if the report function is used, see below) | Prevention of abuse, protection of other listeners and of the guide | 12 months from the report, then automatic deletion (complaint and evidence period); at least until the report has been dealt with |
| Block entry (only if the guide uses the block function, see below): device hash or browser identifier, company account, expiry time of the block | Enforcing a block for all guided tours of the company account concerned | 24 hours from the time of the block, after which the entry is automatically deleted |
| Confirmation of the guest notice: time, version of the notice text displayed, type of access (app/browser) — without device identifier (see below) | Evidence that the guest notice was displayed and confirmed before joining | 12 months from joining, then automatic deletion |
| Rating of the guided tour (voluntary): 1–5 stars without free text, stored with the tour identifier and the device hash or browser identifier | Feedback to the guide on the quality of their guided tour (visible only as an average); protection against multiple ratings of the same participation | Identifier 30 days, then set to null (like the participation); the stars themselves remain, without any personal reference, in the tour’s average |
Transmission takes place in real time; we do not record or store the guide’s commentary (see section 4.3). These data are not linked to an account, a real name or an email address, and no such link is technically provided for. No later than 30 days after participation, the device hash or browser identifier is automatically anonymised (set to null); the bare participation duration is retained without any personal reference for billing purposes, unless a statutory retention obligation (accounting, see section 7) applies. Aggregated tour figures (e.g. total listener hours per guided tour) remain unaffected by this and do not contain any personal data.
Web listening route (browser, without the app): Joining a VOXPEERS Tourist guided tour is also possible without installing the app, directly in the browser, at voxpeers.com/t/<Code>. Technically, instead of the device identifier generated in the app, a likewise pseudonymous identifier stored in your browser’s localStorage performs the same function (assignment to the guided tour, basis for billing, see table above); you can delete it at any time by removing the browser data for voxpeers.com. Audio transmission in the browser runs via the Agora Web SDK of the same provider, Agora (Agora Inc., USA), which also provides voice transmission in the app (see section 4.3) — as our processor, with the same safeguards (EU geofencing for media traffic, Swiss-/EU-U.S. Data Privacy Framework for connection metadata). Data flow: your browser obtains a short-lived access token from our server function (Supabase, Zurich) and uses it to establish an encrypted audio connection directly to Agora’s EU servers; in doing so, Agora receives pseudonymous identifiers/tokens and, for technical reasons, the IP address of your device for establishing the connection, but no real name.
Confirmation of the guest notice: Before you join a guided tour, we show you, in the app and in the browser, a short interstitial page with the most important information (guest notice) as well as references to this Privacy Policy and the T&Cs; joining requires your express confirmation that you have read them. As evidence that the notice was displayed and confirmed before joining, we log exclusively the time of confirmation, the version of the notice text displayed and the type of access (app or browser) — deliberately without your device hash or browser identifier, so that this evidence does not undermine the anonymisation of your participation after 30 days. The entry can be attributed to the guided tour, but not to you personally (for the retention period, see table above). Legal basis: legitimate interest in being able to demonstrate that proper information was provided (Art. 6(1)(f) GDPR and Art. 31(1) FADP respectively).
Legal basis
Report and block functions
Listeners can report an ongoing guided tour or its guide (report of abuse/content); a guide can block individual listeners from an ongoing guided tour. In the event of a report or block, we additionally process: the device hash or browser identifier of the reported or blocked participation, the time and — if provided — a brief reason. These data serve exclusively to prevent abuse and to protect other users. We retain report data for 12 months from the report, after which they are deleted by an automatic daily run; this period corresponds to the time during which a report may still need to be processed, traced and substantiated vis-à-vis the guide concerned. Reports are intended for us as the provider — the reported guide receives neither the identifier nor the wording of the report.
Block list per company account: If a guide blocks a participant, we create a separate block entry for this, consisting of the device hash or browser identifier, the company account concerned and the expiry time. The block applies for 24 hours from the time of the block and, during this period, covers all guided tours of the company account concerned — i.e. also a newly started guided tour and guided tours of other members of the same company account. After the 24 hours have elapsed, the block entry is automatically deleted; no permanent block list or profile of blocked guests is created as a result. Legal basis: legitimate interest (Art. 6(1)(f) GDPR and Art. 31(1) FADP respectively) in a secure, abuse-free platform.
Voluntary rating of the guided tour
After a guided tour has ended, you can rate it voluntarily with one to five stars. No free text is provided for; you therefore cannot enter any information about yourself. Only the number of stars, the identifier of the rated guided tour and your device hash or browser identifier are stored — the latter only so that the same participation cannot submit more than one rating. The identifier is set to null after 30 days together with your participation (see table above); thereafter only the number of stars remains, without any personal reference. The guide never sees individual ratings, only the average and number of ratings for a guided tour. Legal basis: consent through the voluntary submission of the rating (Art. 6(1)(a) GDPR and Art. 31(1) FADP respectively); anyone who does not submit a rating suffers no disadvantage whatsoever as a result. The rating screen itself already informs you of these points: in the app and in the browser, it displays a short notice that the rating is voluntary and anonymous and that the guide only sees the average.
Your rights as a guest without an account
Even without an account, you have the data subject rights described in section 8 (in particular access and erasure). Because, in the absence of an account, we cannot identify you by an account identifier, we need the device hash or browser identifier of your participation, together with details that are as precise as possible regarding the date, time and the guided tour concerned, in order to process your request.
Where to find your identifier:
The identifier changes if you delete the browser data for voxpeers.com or reinstall the app — so it is best to make a note of it while you can still retrieve it. Without these details, we may not be able to clearly attribute a request; in that case, under Art. 11 GDPR and Art. 25 FADP respectively, we are not obliged to obtain additional data solely for the purpose of identification. Please send requests to datenschutz@voxpeers.com.
If a guide sets up a company account or invites further guides as members (see T&Cs section 4.4), we additionally process data for managing this company structure: in their web area (voxpeers.com/konto), the owner of the company account sees the list of invited guides (members) with their display names, the status of the invitation (pending/accepted) and the shared prepaid credit and its consumption per guided tour (listener hours, time, code used) — but not passwords or any other account data of the members beyond this information. Members, for their part, see the codes/guided tours shared with them and the remaining company credit. If the last member of a company account is deleted, the company account is deleted as well, after a prior warning (see T&Cs section 11 and section 7 of this Policy respectively). Legal basis: performance of a contract (management of the shared contractual relationship between the company account and the guides). The email addresses of the members are not displayed to the owner; invitations work via an invitation code, not via a list of addresses.
After you sign in, the app reports technical details about your device to our servers (Supabase, Zurich): platform (iOS/Android), app version and build number, operating-system version, device model, installation source (e.g. Play Store, App Store, TestFlight or a directly installed APK), a randomly generated installation ID (install ID), the time of the first and of the most recent report, and your device's push identifier (token). The report is sent after login and then whenever you return to the app, at most every 6 hours. No location data and no device name assigned by the user are transmitted. In addition, our server checks daily whether the push identifier is still valid; from this we can tell whether the app is still installed. Purpose: operation and support (e.g. troubleshooting by app version and operating system, notice of outdated versions) and checking whether push notifications can still be delivered. Legal basis: performance of a contract or legitimate interest in stable operation and support (Art. 6(1)(b) and (f) GDPR and Art. 31(1) FADP respectively). Retention: 12 months after the last report, then deletion; when your account is finally deleted, the entries are deleted immediately. The data is visible only to us in the admin area.
VOXPEERS uses simple AI features for voice commands (e.g. the wake word ‘vox’). The speech recognition for this runs locally on your device; no voice data are transmitted to AI services for this purpose. VOXPEERS does not use any high-risk AI systems within the meaning of the EU Artificial Intelligence Act (AI Act) and does not make any automated individual decisions with legal effect.
| Service | Purpose | Location of processing | Safeguards |
|---|---|---|---|
| Supabase | Database, account, server functions | Zurich, Switzerland (AWS eu-central-2) | DPA with SCCs |
| Agora | Real-time voice transmission | EU servers (media); USA (metadata) | Swiss-/EU-U.S. DPF, DPA |
| Stadia Maps | Map tiles (app and website /touren/) | EU endpoint (Frankfurt/Paris); provider based in the USA | DPA (GDPR and Swiss FADP) with SCCs |
| OpenRouteService (HeiGIT) | Routing (first choice), place search (fallback service) | Germany | Request only from our server, without user ID and without device IP |
| Stadia Maps | Place search (first choice), routing (fallback service) | EU endpoint; provider based in the USA | DPA (GDPR and Swiss FADP) with SCCs; request only from our server |
| Valhalla (FOSSGIS e.V.) | Routing, last fallback level | Germany | Request only from our server, without user ID and without device IP |
| Photon (komoot) | Place search (fallback service) | Germany | Request only from our server, without user ID and without device IP |
| Overpass API / OpenStreetMap | Speed limit during navigation | Germany | Request only from our server, without user ID and without device IP, position rounded |
| BRouter (brouter.de) | Download of offline routing data | Germany | Area tiles only, no user ID; download at your request |
| Open-Meteo | Elevation data (elevation profile for navigation/tours) | EU | Request runs via our own server function; no disclosure of account/device IP |
| RevenueCat | Subscription management | USA | DPA with SCCs |
| Apple / Google | Purchases, app distribution, push | as per their policies | own controllership / SCCs |
| Brevo | Email sending, newsletter | EU (France) | DPA |
| WPspace | Website hosting | Germany | DPA |
For transfers to countries without an adequate level of data protection, we rely on the safeguards listed (Data Privacy Framework, EU standard contractual clauses including the Swiss addenda).
We store personal data only for as long as is necessary for the stated purposes or for as long as statutory retention obligations (in particular accounting, 10 years) apply.
Account deletion: You can schedule your account for deletion at any time — in the app (Profile → ‘Delete account’) or at voxpeers.com/konto. From the time of scheduling, a period of 30 days runs, during which your account remains usable without change. Once this period has expired, your account and the associated data (profile, group memberships and groups you created, tours and recordings, ride statistics, registration IP and the assignment of your previous purchases) are permanently deleted by an automatic daily run.
Cancelling deletion: Within the 30 days, you can reverse the scheduled deletion at any time. There are three ways to do this:
Merely signing in again does not cancel the scheduled deletion; one of the three ways mentioned is always required.
What remains after deletion: Despite account deletion, we are required or permitted to retain certain data:
We delete or anonymise data that are no longer required once the respective period has expired.
Under the FADP and the GDPR, you have in particular the right to:
To exercise these rights, please contact datenschutz@voxpeers.com. You also have the right to lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the data protection authority of your country of residence.
All connections are encrypted in transit (TLS). Voice transmission (group intercom and VOXPEERS Tourist) is additionally encrypted with AES-256-GCM, using keys issued by our server for each group or guided tour; without a valid key, no connection is established. Passwords are stored only in hashed form. Access to production data is restricted to the minimum necessary.
We will amend this Privacy Policy if services or the legal situation change. The version published on this page at the relevant time applies; we will announce material changes in the app or by email.
Last updated: 14.10.2026
Last updated: 14.10.2026