Privacy policy
In short: no advertising, no analytics, no tracking, no selling of data. Your GPS position stays on your device; only while the map is open is your last position sent to our server, held in memory for a moment to check whether acid paint is within 33 m of you, and never stored. Your paint, artist name and character are public. We store your account, your paint and a random device ID so that the map works and so that we can stop abuse.
1. Controller and contact
Pascal Schwendener (artist name: Pascal Sender)Burghofstrasse 88
40223 Düsseldorf
Germany
Email: support@sprayar.com
We have not appointed a data protection officer because we are not legally required to. For all privacy questions write to the address above.
This policy covers the street map in the browser. The SprayAR iOS app and the sprayar.com website have their own privacy policies.
2. Where the service runs
The map server (accounts, paint, live connection) is operated by us on our own server in Germany. The public address of the street map is delivered through Cloudflare (Cloudflare, Inc., USA, with Cloudflare's European entities), which forwards requests to our server as a proxy and content delivery network and protects it against attacks. Cloudflare processes your IP address and the technical request data for us as a processor under a data processing agreement. Data can be processed in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR), and standard contractual clauses (Art. 46 GDPR) are additionally part of the agreement.
3. What we process, why, and for how long
3.1 Connection data
When you open the map your browser sends technical data: IP address, time, requested address, browser type and language. We use it to deliver the map, to secure it and to limit abuse (for example how many guest accounts can be created per network address per hour). Rate-limit counters exist only in the server's memory. When you sign in, the IP address is stored with the login session until the session ends (at most 30 days). Network addresses we block because of abuse are stored for as long as the block applies. Technical error logs are deleted after 14 days at the latest.
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, working service.
3.2 Location
The map asks for your location so that it can fly you to your street. Your browser only shares it if you allow it; you can refuse and still use the map (acid paint is then not available).
- The position is first used only on your device to centre the map.
- Once the map is loaded, your last position (longitude, latitude, accuracy) is sent over the encrypted live connection to our server: once when the connection opens and then about every five seconds while acid paint is selected.
- The server keeps only the latest position in memory for your current connection, treats it as valid for at most two minutes, and uses it only to check whether acid paint is within 33 m of you and whether the position is plausible. It is not written to the database or to logs and is discarded when the connection ends.
- Good to know: acid paint is stored as "painted on site" at its place on the map. Anyone who sees it knows that whoever painted it was near that place at that time.
Legal basis: your consent through the location permission of your browser (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in your browser's site settings; this does not affect earlier processing.
3.3 Guest and account
For a guest account we create a random name (guest-…). For an account we store your artist name and your password as an argon2id hash (we never know your password). We also store your account colour, role, the time of registration and of your last login, and the login session (stored as a hash, valid for 30 days).
Legal basis: Art. 6(1)(b) GDPR – providing the service under the terms of use. Account data is stored until you delete the account or we delete it under the terms of use.
3.3a Guest trial, Google / Apple sign-in and deleting your account
Guest trial. A guest account can paint for 5 minutes. After that it can only watch until you create an account; creating it keeps everything the guest painted. Guest accounts are not shown on the leaderboard.
Sign in with Google or Apple. If you choose it, Google (Google Ireland Ltd.) or Apple (Apple Distribution International Ltd.) confirms who you are and sends us a signed token. From it we store which provider it was, the provider's user number for you and your email address (with Apple's "Hide My Email" only a relay address). We use your name from Google or Apple only to suggest an artist name, and we never publish your email. We use the email only for messages about your account, for example the confirmation when you delete it. Google and Apple process the sign-in under their own privacy policies. Legal basis: Art. 6(1)(b) GDPR.
Deleting your account. In your profile choose "Delete account" and confirm once. We immediately delete your login sessions, the link to Google or Apple, your profile, character, sketches, friends and messages, your device links, your leaderboard and karma entries and your terms acceptances; your chat messages are emptied and your artist name becomes "deleted-…". Paint you put on the map stays there as anonymous art without your name (paint is part of the shared map, see the terms of use). If we know your email (Google or Apple sign-in) you get a confirmation mail. If an account was blocked for abuse, we keep its link to the Google or Apple account so that signing in again does not create a new account.
Beta access on this web page. Painting on the street web page is open to SprayAR beta testers. The waitlist runs on sprayar.com (email address or Google sign-in, consent, confirmation, approval), see sprayar.com/beta-privacy.html. To keep you signed in, this page stores the cookies sprayar_beta (session) and, after you sign in, sprayar_remember (up to one year); they go only to sprayar.com's beta service.
3.4 Paint, profile and public visibility
When you paint we store the paint on the map (image tiles), which account painted which part and when, your statistics (for example painted area), the places you painted (the painted spot on the map, not your GPS position) and, if you design one, your character, profile picture and sketches.
Visible to everyone: your paint, artist name, account colour, character, leaderboard statistics and, while you are on the map, the area of the map you are currently viewing or painting (live view). This is not your GPS position – but if you paint near your home, others may draw conclusions.
Legal basis: Art. 6(1)(b) GDPR. Paint remains part of the shared map until you, others (by painting over it), moderation or a reset of the map remove it. When you delete your account we delete the account, profile and character and remove the link between you and your paint; the paint itself can remain as an anonymous part of the shared artwork unless you ask us to remove it as well.
3.5 Device ID and storage in your browser
The map stores the following in your browser's local storage (localStorage) and as a cookie:
| Name | Purpose | Duration |
|---|---|---|
sw_session (cookie, HttpOnly, Secure) | keeps you signed in | 30 days or until you sign out |
sprayar.deviceId | random device ID; prevents abuse and makes bans effective | until you clear your browser data |
sprayar.legal.streets | remembers which terms version you accepted | until you clear your browser data |
other sprayar… entries | map settings, cached map data and paint that has not been sent yet | until you clear your browser data |
These entries are strictly necessary to provide the map you requested and to protect it (§ 25(2) no. 2 TDDDG); we do not use them for tracking or advertising. The device ID is sent to our server when you accept the terms and when it is needed to enforce a ban. It contains no information about you or your device hardware. Server-side we store it with the acceptance record (see 3.6) and, if a device ban is imposed, for as long as the ban applies. Legal basis for the server-side processing: Art. 6(1)(f) GDPR – protection of the service and its users against abuse and against bans being bypassed.
3.6 Acceptance of the terms
When you accept the terms we store the version, the area (street map), the time, the device ID and, if you are signed in, your account. This lets us prove which terms applied. We keep the record for as long as you use the service and then for three years (limitation period). Legal basis: Art. 6(1)(f) GDPR.
3.7 Reports, moderation and bans
If you report content or contact us, we process your message, your contact details and our decision. If we take a measure against an account or device (kick, 24-hour ban, permanent ban), we store the account, the device ID or network address, the reason and the time. Temporary bans are deleted after they expire; permanent bans are kept while they apply and reviewed at least once a year. Case files are deleted 12 months after the case is closed unless they are needed longer to defend legal claims. Legal basis: Art. 6(1)(c) GDPR (obligations under the Digital Services Act) and Art. 6(1)(f) GDPR (a safe service).
3.8 Email
If you email us we use your message to answer you. Our mailboxes are hosted by 1blu AG in Germany. We delete the correspondence when it is no longer needed, unless statutory retention obligations apply. Legal basis: Art. 6(1)(b) or (f) GDPR.
3.9 3D street view (where available)
If the 3D street view is available in your version, it loads weather for the displayed place from the Norwegian Meteorological Institute (api.met.no). Your browser connects to it directly, transmitting your IP address and the rounded coordinates of the place shown (not your GPS position). Legal basis: Art. 6(1)(f) GDPR (realistic weather in the scene).
4. What we do not do
No advertising, no analytics or tracking tools, no social media plugins, no selling or renting of data, no profiling for advertising, no automated decisions within the meaning of Art. 22 GDPR. The map tiles, fonts and scripts are delivered by our own server.
5. Recipients
Cloudflare (proxy/CDN, see section 2) and 1blu (email) as processors; Google and Apple, each under its own responsibility, if you sign in with them; other users for everything that is public by design (section 3.4); authorities and courts only if we are legally obliged to. Nobody else.
6. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.
Write to support@sprayar.com. For guest accounts we can only help if you can show that the account is yours (for example from the browser that is signed in).
You can also complain to a data protection supervisory authority, for example the authority responsible for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.
7. Security
All connections are encrypted (HTTPS/WSS). Passwords and session tokens are stored only as hashes. Access to the server is limited to the operator. No system is completely secure, so please do not paint or write anything personal.
8. Children
The map is meant for people aged 16 and over. Younger users need the permission of a parent or guardian. If you think a child has used the map without permission, contact us and we will delete the account.
9. Changes
We update this policy when the service or the law changes. The version identifier changes with every update, and the map shows you the new version before you continue.