Outside — Privacy Policy

Last updated: 2026-06-28

Outside is a small app for letting friends in Berlin know where you're headed for an outing — a playground, park, café, library, or wherever. This page describes what data we collect, why, who we share it with, and your rights under the EU GDPR.

What we collect

• Email address — used to sign you in (with a password, or via Google sign-in).
• Profile — your display name, username, postal code (PLZ), and an optional group name (e.g. "The Chens" if you broadcast as a family).
• Optional family roster — names and ages of the grown-ups and kids in your family, plus a chosen illustrated avatar (a cartoon character you customise, never a photo). Used so friends can recognise your family. You decide whether to add any.
• Landmarks you add — name, category, coordinates, and emoji of the spots you contribute (cafés, playgrounds, etc.).
• Broadcasts — when you announce you're heading somewhere: the landmark, the planned time, an optional short message, and which kid IDs (if any) are coming.
• Friendships — which accounts (or families) you've added as friends, via QR or username search, plus any private note you write about a friend (visible only to you).
• Feedback you send — if you use the in-app feedback form, we store your message and the category you choose.
• Device push token — anonymous identifier from Expo / Apple / Google so we can send you push notifications when a friend broadcasts.
• Location, when you choose — only when you tap "Use my location" while adding a place, or while the in-app map is visible. We do not track your location in the background.

What we don't collect

• Background or continuous location.
• Contacts, photos, microphone, or call data.
• Behavioural analytics or advertising identifiers.
• Any data from children directly — only what you, as the account owner, choose to enter about your kids.

Who sees your data

• You and your account: full access to everything you've created.
• Friends you've added: see your display name, handle, ZIP, group name, kids (if you added any), and broadcasts you publish to them. Security rules at the database layer enforce this — strangers cannot read your data.
• Anyone in the app, within your ZIP: sees landmarks you've contributed (because the landmark catalogue is shared per neighbourhood). Does NOT see who added what.

Third parties we use

• Firebase (Google Cloud) — hosts the database (Cloud Firestore), sign-in, and file storage. Data is stored in the EU (europe-west region). See Firebase's privacy and security information.
• Google Maps Platform — renders the in-app map and powers the "search a place" autocomplete. Coordinates you view are sent to Google. See their privacy notice.
• Expo / Apple / Google push services — deliver push notifications. The push token is an opaque ID; the notification content is generated by our server.
• Visit counter (Cloudflare): this website, not the app, counts visits anonymously. No cookies, no IP addresses stored, only totals like page views, the referring site and the country.

Your rights (GDPR)

• Access — email zach.ermis+outside@gmail.com for a copy of all data tied to your account.
• Delete — use the "Delete account" button in the Me tab. It permanently removes your account, broadcasts, friendships, and any landmarks you created.
• Rectify — edit your profile in-app, or email us for changes you can't make yourself.
• Object / restrict — turn off push notifications in your device settings; stop signing in to stop further collection.
• Complaint — you can file a complaint with the Berlin data protection authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit) at datenschutz-berlin.de.

Retention

Active accounts: data stays until you delete it. Broadcasts auto-expire 2 hours after the planned time. Deleted accounts: all rows are removed immediately by the cascade rules in the database; backups roll out within 30 days.

Children

Outside is intended for adults coordinating outings on behalf of their families. Kids' first names and birth year/month may be entered by the account owner to label broadcasts. No data is collected directly from anyone under 18. If you believe a child has signed up themselves, email us and we'll delete the account.

Contact

Outside is a side project by Ermis Zacharopoulos in Berlin. Reach me at zach.ermis+outside@gmail.com.

This is a plain-English summary. Your data lives in our Firebase (Google Cloud) project under the rules of the EU GDPR and the agreements linked above.