Privacy statement

Last updated: [date of publication]

Who we are

Pub Tiger is an app to organize a pub crawl and enjoy it together. It is made and run by Menno van der Knaap, as a private person in the Netherlands, who is responsible for what happens to your data (the “controller”). Questions about your data go to mennodev2004@gmail.com.

What we keep about you

Pub Tiger works without an account. You join a crawl you were invited to, with only what that evening needs:

• The name you choose (or the one the organizers prepared for you), and a nickname if the organizers make one up for you.
• How you look in the app: your tiger and what it wears, or your initials.
• Your profile photo, if you choose one: a photo everyone in the crawl sees next to your name. We first remove what your phone puts in it, including where it was taken. You can take it off on your profile; we then remove it from our server at once. On the other people’s phones it can stay in the app’s memory until they leave the crawl.
• Photos for challenges, if the crawl has them: here too we first remove what your phone puts in them. The organizers look at them before they reach the feed.
• Your place in the crawl: which pubs you are in, who you walk with, your role if you get one, your points, your votes in polls, and what you tick off or send in for challenges.
• Messages the organizers send in the crawl, including personal messages to you.
• Reports and blocks: if you report a photo, we keep that you reported it, why, and what was decided. If you block someone, we keep that, so you no longer see their photos.
• Data about your phone to recognize you without an account: a secret key (we keep only a version that cannot be traced back), a random number for your installation, the kind of phone, the app version, its language, and whether notifications are on.
• A push address, if notifications are on: the address Apple or Google uses to deliver a notification to your phone.
• Error reports from the app: if the app runs into a problem, it sends us what went wrong and where in the code, with the app version and the kind of phone and operating system. Without your name, your crawl or anything else that tells us it was you.
• Your internet address (IP address): our server uses it briefly to slow down abuse (too many requests in a row). We do not keep it with your data, and it does not go into the server’s logs.

We do not ask for an e-mail address, phone number or password, and we do not track where you are: where you are follows from the evening’s plan. We use no ads, no analytics and no tracking, and we do not build profiles of you.

Who sees what

• The organizers of your crawl (the owner and co-organizers) see everyone taking part, the schedule, the roles and what was reported. They do not see who reported a photo.
• Other participants see your name (or your nickname once revealed), your tiger or profile photo, and your points if the crawl keeps them. They do not see where you go before it is revealed, and no secret roles. Anyone who does not want to see your profile photo can report it or block you.
• Votes in polls are not shown per person; others see only the result.
• Pub Tiger itself only looks when it must: for a reported photo that stays up, or when someone e-mails us. We can then remove a photo or take someone out of a crawl.

Who else receives your data

We do not sell your data or give it to advertisers. Only these parties receive some of it, because the app does not work without them:

• netcup GmbH in Germany: our server runs there and your data is stored there, only on our behalf, under a data processing agreement.
• Apple (iPhone) and Google (Android) deliver notifications to your phone. They receive your push address and a general text, such as “🐯 The tiger has news. Tap to read.” Never a pub, a name, a role or the text of a message. Google does this for us as a processor (Firebase Cloud Messaging).
• OpenFreeMap provides the street map in the app. It sees which part of the map your phone loads and from which internet address, nothing else: no name, no crawl.
• Photon (with OpenStreetMap data): when an organizer searches a pub by name, our server asks Photon. Only the name searched for and a rough area (to about a kilometre) go along, nothing about you.

Apple and Google are US companies. Where data goes to the United States through them, that happens under the EU–US Data Privacy Framework, which both companies have joined.

On your own phone

The app keeps your plan on your phone, so the reveals arrive on time without a signal too, and your secret key in your phone’s secure storage. That data goes when you leave the crawl or when the crawl is gone.

Why we may do this

You take part in a crawl you were invited to; without this data the app cannot run that evening. We process it because it is needed for the service you use yourself and because we have a legitimate interest in the evening going well and safely (Article 6(1)(b) and (f) GDPR). Pub Tiger is for people aged 18 and over; the organizer confirms this when creating a crawl.

How long we keep it

• A finished crawl and everything in it is erased 30 days after it ended. The owner can delete it sooner; then everything is gone at once.
• A crawl that never started is erased 14 days after its planned date; an empty draft after 7 days.
• A profile photo goes at once when you replace or remove it, when you go home, or when the organizers remove it.
• Error reports from the app are erased after 30 days.
• Backups are kept for at most 30 days; after that an erased crawl is gone from them too.

Your rights

You may know what data we hold about you, have it corrected or erased, object, and take it with you. Much of it you can do in the app: you see your own data in the crawl, you can change your name and tiger, remove your profile photo and leave the crawl. For the rest, e-mail mennodev2004@gmail.com; we answer within a month. If you disagree with us, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security

Everything travels encrypted over the internet. We keep secret keys and codes only in a form that cannot be traced back. The server’s logs contain no names, messages or keys. If something goes wrong with your data anyway, we report it to the Autoriteit Persoonsgegevens within 72 hours where required, and tell you if the risk is high.

Changes

If we change this statement, the new version appears here with its date on top. For a big change we let you know in the app.