Privacy policy

Lofoten Companion · effective 26 October 2026

Lofoten Companion is a free travel app for Lofoten. It has no accounts, no advertising and no analytics or tracking. This policy explains the little information that does leave your phone, and why, and what happens when you visit our website.

Who is responsible

Amelie Rasch, c/o POSTFLEX PFX-459-920, Emsdettener Straße 10, 48268 Greven, Germany ("we"), a private person.
Contact for anything about this policy: hei@lofotencompanion.com.

What stays on your phone

• Your location. The app asks for it only when you use something that needs it: the location button on the map, "Nearest first" in the list or "Your location" on Today. It uses your position only while the app is open, never in the background. Your position is not sent to us or anyone else, and it is not stored. You can withdraw the permission at any time in your phone's settings.
• Your trip. Saved places, your day plan and your notes are stored in the app on your phone. There is no account and no syncing to our server. If your phone backs up its apps to your Google account, they are included in that backup, so they return on a new phone; that backup is between you and Google. Otherwise they are deleted when you remove the app.
• Saved data. Places, forecasts, ferry times and photos you have loaded are kept on the phone so they stay available without signal. This is public information, not information about you, and it is not included in the backup.

What leaves your phone

The app downloads public information. Like every request on the internet, these requests reveal your phone's IP address, and with it roughly which country or region you are in, to the services that answer them. The app sends no name, account or location with them.

• Our server. Places, photos, ferries, road messages and weather come from our database, run for us by Supabase (Supabase Pte. Ltd., Singapore) in a data centre in Stockholm, Sweden, behind the network provider Cloudflare. Their request logs record the IP address, the country it belongs to, the name and version of the software making the request, and what was requested. They are kept for one day to run the service and keep it secure, and then deleted. We do not use them to identify or follow anyone.
• The map. The map pictures come from the OpenStreetMap Foundation's tile servers, which are delivered through a worldwide network of cache servers. They receive your IP address, which parts of the map you look at, and the app's name and version. When you centre the map on yourself, that shows roughly where you are. The OpenStreetMap Foundation is based in the United Kingdom, for which the EU has an adequacy decision. Pictures you have seen are kept on your phone for a while, so the app doesn't load them again. The OpenStreetMap Foundation's privacy policy: https://osmfoundation.org/wiki/Privacy_Policy. If those servers become unavailable to the app, we can switch the map to Kartverket, the Norwegian Mapping Authority, which then receives the same information instead: https://www.kartverket.no/en/about-kartverket/data-protection-policy.
• Things you open from the app. Directions open in your map app, links open in your browser, phone numbers in your phone app, and Share in the app you pick. What happens there is up to those apps and websites and their own privacy policies.

Our legal basis for the requests and logs above is our legitimate interest in delivering a working and secure app (Article 6(1)(f) GDPR). The map is part of that: the app can't show one without loading its pictures.

You don't have to give us any information. Without the IP address reaching the servers, though, the app can't load places, forecasts or the map. We don't make automated decisions about you or profile you.

Supabase is based in Singapore and Cloudflare in the United States. Where they or their subcontractors process data outside the European Economic Area, this is covered by the EU standard contractual clauses that are part of Supabase's data processing agreement.

This website

This website, lofotencompanion.com, with this policy, the terms of use and the legal notice, is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you open a page, GitHub receives your IP address, the page you asked for and your browser's name and version, and logs the IP address for security purposes. We don't see these logs. The website sets no cookies, has no analytics and loads nothing from other servers.

Our legal basis is our legitimate interest in providing the website securely (Article 6(1)(f) GDPR). GitHub is certified under the EU-U.S. Data Privacy Framework, for which the EU has an adequacy decision. GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.

When you contact us

"Contact support" and "Something wrong?" on a place's page open an email in your own email app, which you can review before sending. A place report contains the place's name, its ID in the app, a map link to the place and what you write. It never includes your position, your saved places or your notes.

If you send it, we receive your email address and your message through our email provider, STRATO GmbH in Berlin, Germany. We use them only to answer you and to correct the app's information, and delete them 12 months after the matter is closed. Our legal basis is our legitimate interest in answering you and keeping the information correct (Article 6(1)(f) GDPR). Please don't include more personal information than the correction needs.

What we don't do

No ads, no analytics or crash-reporting tools, no profiling, no selling or sharing of personal data, no background location, and no account.

Google Play processes data when you install the app, under Google's own privacy policy. Google may show us anonymous statistics, such as the number of installs, and crash reports from phones whose owners allow sharing them with app developers.

Children

The app is made for adult travellers and isn't directed at children. We don't knowingly receive personal information from children.

Your rights

Under the GDPR you can ask us for access to, correction or deletion of personal information about you, ask us to restrict its use or object to it, and ask for a copy of it. We hold very little: usually only emails you have sent us. We cannot link server logs to a person. Write to hei@lofotencompanion.com.

Your right to object. Where we process information on the basis of our legitimate interest (Article 6(1)(f) GDPR), as described above, you can object at any time for reasons arising from your particular situation (Article 21 GDPR). We then stop, unless we have compelling legitimate grounds that override your interests, or need the information to establish, exercise or defend legal claims. Write to hei@lofotencompanion.com.

You can also complain to a data protection authority, in particular in the country where you live or where we are based. Ours is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) in Mainz: https://www.datenschutz.rlp.de.

Changes

When the app starts handling information differently, we update this policy, its date and the app's privacy screen together. The current version is always at https://lofotencompanion.com/privacy.