Privacy notice

This notice covers qvr.surf and the QVR app for iOS and Android.

Who we are

QVR UG (haftungsbeschränkt) i.G., Unternehmergesellschaft (haftungsbeschränkt), in formation, Ferdinand-Porsche-Straße 5, 86825 Bad Wörishofen, Germany is the controller under the General Data Protection Regulation (GDPR). You can reach us at hello@qvr.surf.

Website and beta

When you open qvr.surf, Cloudflare delivers the page and processes your IP address, the requested URL, time and browser details to serve it and to block attacks. These logs are kept for a few days. Public listing, shaper and profile pages show data that sellers and shapers have published; our server reads it from the QVR API, hosted by Railway in an EU region, and photos are served by Cloudflare Images. Search engines and messengers may store their own copies of public pages. Cloudflare Web Analytics counts page views for us: a Cloudflare script reports the page, the referring site, browser and device type, country and load timing, without cookies, without a visitor ID and without storing anything on your device; we see only aggregated numbers. When you click certain buttons on the website, for example “Join the beta”, a store or TestFlight link, a shaper link or the contact link, we add one to a daily counter for the page type, the button, the device class (iPhone/iPad, Android or desktop, read from your browser's user-agent string) and the campaign named in the link you arrived through (utm_campaign, matched against a fixed list). This sets no cookie, stores nothing on your device, keeps no identifier and no IP address, and the counters cannot be linked to a person or an account; our website server forwards each count to the QVR API with a signature so that only it can submit counts. When you open a shared listing or business page, the website server also reports one view to the QVR API together with your IP address so that one visitor counts once per day: the API keeps only a keyed hash of the address for the current day, discards the key the next day and stores daily view counts per listing or business and link source, which the seller sees in the app. Legal basis: Art. 6(1)(f) GDPR, our interest in a working, secure website and in knowing how it is used.

If you join the beta waitlist, we store your lower-case email address, the signup time, a source label and a record ID, nothing else. We use the address only to invite you. Cloudflare Turnstile checks that the submission comes from a person, using browser and connection signals such as your IP address; Cloudflare also uses these signals for its own bot-detection improvements. Our API briefly keeps your IP address or IPv6 prefix in memory to limit repeated attempts. We send invitations ourselves by email through Resend, with no open or click tracking. If we invite you to the iOS beta through TestFlight, we enter your email address and, if given, your name in Apple's App Store Connect; Apple sends the invitation and shows us whether you installed the beta, crash reports and any feedback you send. Apple processes tester data for its own purposes under its TestFlight terms. Legal basis: your consent to be contacted about the beta, Art. 6(1)(a) GDPR; bot check, rate limit and running the beta, Art. 6(1)(f) GDPR; § 25(2) no. 2 TDDDG for the Turnstile widget. Withdraw any time by emailing hello@qvr.surf.

Your account and profile

You sign in with an email address and a password, or with Apple or Google. Clerk handles login, verification codes and sessions for us; we never see or store your password. We keep an internal account ID, your display name, bio, avatar and the place you chose for your profile. Publicly, your profile shows only the place name, not the coordinate. If you run a business or are a shaper, your public storefront or shaper page also shows the business name, logo, address, links, cover and portfolio you provide, and the workshop location you confirm. If we invite you personally to take over a prepared profile, we store your email address and a one-time link valid for 48 hours. Legal basis: Art. 6(1)(b) GDPR, providing the service you signed up for.

Listings, photos, saves and ratings

When you list a board we store the listing details, photos, price, pickup area and status, plus edit history. Photos and videos are hosted by Cloudflare Images and Stream. Private sellers' pickup areas are shown publicly only as an approximate point with a one-kilometre radius; business and shaper addresses are shown exactly, because you publish them as business addresses. Saved listings, saved shapers, saved searches and your last 30 viewed listings are stored on your device as a guest and in your account once you sign in. After a handover, both sides can rate each other; ratings, tags and comments appear on the public profile. Sellers and businesses see daily view and save counts for their listings and storefront in the app, including which part of the app or which kind of shared link the views came from. To count each viewer once per day we keep, for the current day only, a keyed hash of your account ID and the item, or of your IP address if you are not signed in; the key is discarded the next day and no viewer is stored with the counts. Counts are kept for 13 months and deleted with the owner's account. Legal basis: Art. 6(1)(b) GDPR for your listings, saves and ratings; Art. 6(1)(f) GDPR, the community's interest in honest reputation, for keeping received ratings visible, and our and sellers' interest in knowing how listings perform, for the view and save counts.

Premium and Boost purchases

Premium subscriptions and paid Boosts are bought through Apple's App Store or Google Play. The store handles payment; we never receive card or bank details. When you sign in, the app connects to RevenueCat, our purchase service, under a customer ID that we derive from your account ID with a keyed hash, so RevenueCat does not receive your account ID, email address or name, and the app sends it no other details about you. RevenueCat validates purchases and tells us, by webhook and API, the product, store, transaction IDs, purchase, renewal, expiry, cancellation and refund times and the subscription state. We store this subscription and Boost state, the listing a Boost was applied to, and a log of these events; we store no prices. Deleting your QVR account removes your subscription and Boost records and queues the deletion of your RevenueCat customer, which we complete manually; it does not cancel the subscription with the store, so cancel it in your Apple or Google account. Legal basis: Art. 6(1)(b) GDPR.

Messages and contact between users

Messages, photos, reactions and any meeting place you share in a chat are stored on our servers and delivered to the other participant. Deleting a conversation hides it for you; the other side keeps their copy. Messages are not end-to-end encrypted. Typing signals and active-chat status briefly pass through our realtime service. Legal basis: Art. 6(1)(b) GDPR.

Search, map and location

Searches are run on our servers with the text, filters, area and radius you choose. To improve search and supply and understand which offers fit what people look for, we store submitted search texts and the final criteria of executed board searches in QVR's own database. When you are signed in, we link these records to your account for 90 days; we remove that link when you close your account. Records are then kept without the account link until they are deleted after 180 days in total. Text and name values are lowercased, with email addresses and phone numbers masked. Records include the time, interpretation outcome or result count, whether you were signed in and, for executed searches, the country, an area of about 50 km and the chosen radius. The technical metadata we store contains no IP address or exact coordinates; submitted text can still contain personal details. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving search and supply; you can object to this processing by contacting us. When you type a free-text search, the text you submit is sent to OpenRouter and the model provider TypeSafe AI in the United States to interpret it into filters and board names. Do not put personal details into a search. Maps come from the Mapbox map SDK, and address suggestions and geocoding from Mapbox's API; Mapbox receives your IP address, map and tile requests, and the addresses and coordinates you look up. The Mapbox SDK's own usage telemetry is switched off from the next app version; in earlier versions it collected device and app details, map interactions and, with location permission, location data for Mapbox's own purposes, with an opt-out in the map's attribution menu. With location permission, the app uses your foreground position for maps, search, pickup or shared meeting places; Apple/Google geocoders resolve place names. No background tracking. Legal basis for QVR features: Art. 6(1)(b) GDPR; permission controls location access.

Notifications and emails

If you allow push notifications, the app registers a push token with us; we send it through Expo to Apple or Google to notify you about new messages, reactions and rating requests. A notification can contain the sender's name and a listing title. You can switch notifications off in the app or in your system settings. We also send service emails, for example about your account, listings, invitations or moderation decisions, through Resend to the address verified with Clerk. Completed delivery records are kept for 90 days; unresolved deliveries remain until resolved. Legal basis: Art. 6(1)(b) GDPR for messages you asked for; Art. 6(1)(f) GDPR for necessary notices.

Safety, moderation and reports

You can block people and report conversations or messages. We store who blocked whom, the report, your reason and the review outcome. Moderation decisions record the operator, the affected account or content, the before-and-after state and the reason sent to you. Beta reports from the app, including an optional screenshot and your device details, reach us by email. Legal basis: Art. 6(1)(f) GDPR, keeping the marketplace safe and traceable; Art. 6(1)(c) GDPR where law requires us to act.

App statistics

When you are signed in, the app records at most one entry per account and calendar day (Berlin time) when it starts or returns to the foreground: your account ID, the day, the platform (iOS or Android) and the app version. Guests are not recorded. We use this to count active accounts, see which platforms and versions are in use and how many people come back after joining. It stays in QVR's own database and is not shared. Legal basis: Art. 6(1)(f) GDPR, our interest in understanding and improving the app. Entries are kept for 13 months and then reduced to monthly totals without account IDs; deleting your account removes them.

The app no longer sends usage statistics to any provider. Earlier app versions offered two optional statistics, app usage analytics with a random device ID and account product analytics with your account ID, which were sent to Amplitude's EU region only with your consent. The QVR API has stopped forwarding these events: it reports every event from an older app version as not recorded and treats the account setting as declined. An older app version may still show an analytics switch; it has no effect any more. Data Amplitude received earlier under that consent, including the random device IDs, is no longer added to and expires under Amplitude's 12-month retention. The counts QVR keeps itself are described above under website and listings; they contain no device or visitor ID. Questions: hello@qvr.surf.

Error reporting

The app, in its release builds, and the API report crashes and errors to Sentry in its EU region in Germany. An error report contains the error type and stack trace with the error message replaced by a fixed text, app or API version, environment, device model and operating system, limited diagnostic codes and, where available, your internal account ID and the request ID. The app also sends session health, that is whether an app session ended normally or in a crash. No breadcrumbs, screenshots, performance traces or session replays. Native crash reports go through Sentry's native SDK with its standard crash data. Sentry keeps events for up to 90 days. Legal basis: Art. 6(1)(f) GDPR, keeping the app stable.

Email contact

If you email us at hello@qvr.surf, we process your address, message and arrival time to answer you. Our mailbox runs on Google Workspace, provided by Google Cloud EMEA Limited, Ireland. We keep correspondence as long as needed to handle your request, and longer only where retention law requires it. Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR; Art. 6(1)(c) GDPR for statutory retention.

Service providers

These companies process data on our behalf unless marked otherwise. The safeguard column names the mechanism for transfers outside the EEA.

Transfers outside the EEA

Most of our providers are US companies and may process personal data in the United States. Where a European Commission adequacy decision applies, including the EU-US Data Privacy Framework for certified providers, transfers rely on Art. 45 GDPR. Otherwise they rely on the EU Standard Contractual Clauses in the provider's data processing agreement, Art. 46(2)(c) GDPR. You can request a copy of the relevant safeguards at hello@qvr.surf.

How long we keep data

• Account data: until you delete your account. Deletion removes your profile, private drafts, saves, your message content and shared locations, blocks, reports you filed, storefront, shaper application, view and save statistics, subscription and Boost records and consent settings, triggers deletion at Clerk and queues deletion of your RevenueCat customer.
• Kept after deletion: non-personal board facts of published listings, confirmed listing and model media detached from your account, numeric ratings you gave, the other side's messages, moderation decisions, invitation records, purchase event entries with store transaction IDs after the account reference is removed, and a hashed deletion record, without a fixed expiry.
• Beta waitlist: until you are invited, you withdraw, or 12 months after signup, whichever is first. Creating an account does not extend this.
• Statistics: website click counters are daily totals without personal data and are kept without a fixed expiry; Cloudflare shows us only aggregated page counts. View and save counts, 13 months; the daily keys used to count a viewer once, one day. App statistics at Amplitude are no longer collected; the data received earlier expires under Amplitude's 12-month retention.
• Purchases: subscription and Boost records until you delete your account; your RevenueCat customer ID stays in a pending deletion record until we complete the deletion at RevenueCat.
• Error reports: up to 90 days at Sentry.
• Emails sent through Resend: 30 days at Resend.
• Notification delivery records: 90 days after completion; unresolved cases until resolved.
• Invitation links: valid for 48 hours; records remain as described above.
• Technical logs: Cloudflare, a few days; Railway, plan-dependent, up to 90 days.
• Mapbox IP logs: 30 days, longer for security or legal investigations.
• Search providers: retain data as needed for service and legal obligations.
• Correspondence: as long as needed for your request, plus statutory retention.

Cookies and device storage

The website sets no cookies of its own and stores no analytics ID or consent record, so it shows no cookie banner. Your theme choice persists in local storage until cleared; scroll and TV preferences last for the tab session. The app stores login, area, saves, preferences, push registration, pending purchase records and drafts; an older app version may also keep an analytics choice that is no longer used. Account deletion clears account drafts; guest/device settings persist until cleared and secure storage may survive reinstallation. Legal basis: § 25(2) no. 2 TDDDG for strictly necessary storage.

Your rights

You have the right to access your data (Art. 15 GDPR), to correct it (Art. 16), to delete it (Art. 17), to restrict processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you can withdraw it any time; earlier consent-based processing remains lawful. You can delete your account yourself in the app settings. For other requests, email hello@qvr.surf. You can also complain to a data protection supervisory authority, in particular where you live or work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Required information

Providing data is not a statutory obligation. An email or sign-in identity is required for an account; listings and messages need their relevant content. Without these, those features cannot work. Beta signup needs your email; purchases need a store account with Apple or Google; optional profile details are voluntary.