Privacy Policy

1. Controller

Controller responsible for data processing in the Magnetic World app:

Magnetic World GmbH
Musterstraße 1, 6800 Feldkirch, Austria
Email: support@magneticworld.app

For full details see the Imprint.

2. What data we process

• Account data: email address, username, first and last name, and optionally date of birth, nationality and profile picture.
• Travel content: trips, destinations (“magnets”), day plans, notes, packing lists, expenses and photos you upload. Photos may contain metadata (EXIF, e.g. GPS coordinates and capture time); we read location and date from it to match photos to your trips.
• Social features: friend list, friend requests and shared trips.
• Technical data: your device's push token, platform (Android/iOS) and time of last activity.

We do not sell your data and do not use advertising or analytics trackers in the app.

3. Purposes & legal bases

We process your data solely to provide the app's features: account management, your travel map and statistics, trip planning and sharing with friends (Art. 6(1)(b) GDPR — performance of contract). Push notifications and access to your photos only happen with your consent (Art. 6(1)(a) GDPR), which you can revoke at any time in your system settings. Securing and stabilising the app is based on our legitimate interest (Art. 6(1)(f) GDPR).

4. Recipients & processors

• Supabase (hosting & database): all account and travel data is stored with our processor Supabase.
• Google Sign-In: if you sign in with Google, Google receives information about the sign-in.
• Firebase Cloud Messaging (Google): a device token is processed for push notifications.
• Booking partners: if you open booking offers (e.g. Trip.com) inside the app, the respective provider's privacy policy applies from that point on and the provider may set cookies. For accommodation search, your search parameters (location, travel dates) are transmitted to the search service.

Data processing agreements pursuant to Art. 28 GDPR are in place with all processors.

5. Data transfers outside the EU

Some of our service providers (in particular Google/Firebase) also process data in the USA. Transfers are based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 46 GDPR).

6. Storage period

We store your data for as long as your account exists. If you delete your account (in the settings or by emailing us), all associated data is deleted unless statutory retention obligations apply. See Delete account for instructions.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may revoke any consent you have given at any time. Simply contact support@magneticworld.app.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

8. Security

Communication between the app and our servers is encrypted via TLS. Access to your data is protected by authentication and server-side access rules (row level security).