How FluxMap handles your data

1. Controller

Emil Höffner
Lerchenauer Str. 293
80995 München
Germany
Email: hoeffneremil@gmail.com

FluxMap is a product name, not a company. No data protection officer is appointed. The supervisory authority for this controller is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). You may also complain to the authority in your EU member state of residence.

2. Snapshot

FluxMap records movement on your device. There is no FluxMap account and no FluxMap cloud for tracks. Track data leaves the device when you cause it (export, a sync folder, Android backup) or when you use a network feature (online maps, support email).

Optional diagnostics are three independent purposes in the app: feature usage, technical diagnostics, and crash and freeze reports. They stay off until you give current, purpose-specific consent. Closed Beta always includes the diagnostics transport. There is no extra beta build-enable switch. Data is sent only after current, purpose-specific consent in a Closed Beta (or separately configured Production) build. Publishing this website does not turn diagnostics on in any installed app.

Closed beta is for people 16 or older. FluxMap is not directed at children.

3. Data the app processes locally

When you record or import, FluxMap can store on the device:

• timestamps, coordinates, elevation, speed and accuracy of track points;
• names, descriptions, folders, colours, transport mode;
• detected stops;
• optional Raw GNSS sessions and .fluxraw files;
• waypoints;
• automation rules, geofences and local triggers you create (time, Wi-Fi, Bluetooth, NFC, activity);
• settings.

Legal basis: Article 6(1)(b) GDPR. Device access needed for that function also relies on § 25(2) no. 2 TDDDG. Uninstalling the app does not delete copies in a sync folder or in an Android cloud backup.

4. Android permissions

The app requests permissions when a feature needs them. An Android system dialog is not a GDPR consent.

5. Online maps and platform services

When a map is loaded online or an offline region is downloaded, the map provider receives your IP address and the requested map area (tile coordinates). That is not a diagnostics upload and not a FluxMap cloud, but it does reveal which area you are viewing.

Providers, depending on your settings:

• OpenStreetMap (tile.openstreetmap.org) — default;
• CyclOSM, OpenTopoMap, CARTO, OSM Humanitarian;
• Google Maps (Google SDK);
• Mapbox (Mapbox SDK).

Google Play Services may support location (Fused Location) and geofences. Google Play processes download and account data under its own terms. Legal basis for the map feature you choose: Article 6(1)(b) GDPR.

6. Export, sync and backup

• Sync folder. If you pick a folder through the system picker, FluxMap writes GPX/Raw copies there. If that folder is Drive, Nextcloud or similar, that provider’s rules apply.
• Share/export. You choose the destination in the system sheet.
• Android backup / device transfer. The track database fluxmap_database is included in encrypted cloud backup and device-to-device transfer. Diagnostic queues and diagnostic IDs are excluded.

Legal basis: Article 6(1)(b) GDPR.

7. Optional diagnostics

Diagnostics are not required to record, view, export, or sync tracks. Closed Beta always includes the diagnostics transport. There is no extra beta build-enable switch. Development builds never send. Production has a separate configuration and does not inherit beta project identifiers. Data is sent only after current, purpose-specific consent in a Closed Beta (or separately configured Production) build. Publishing this website does not turn diagnostics on in any installed app.

Consent notice version is 2. Grants recorded under version 1 do not authorise any send. Each purpose is independent, off by default, and not pre-selected. Onboarding and the fallback dialog offer “Share all & continue” and “Continue with selection”. Explicit refusals stay until you change them. Nothing is observed or backfilled from before a current grant.

After a current grant and a working configuration, the app creates a random identifier for that purpose only. The identifier can join events of that purpose across app restarts. It is not an account, advertising ID, or hardware ID. This is pseudonymous product telemetry, not anonymous telemetry.

Legal basis for optional diagnostics: Article 6(1)(a) GDPR. Storing the identifier and local queue on the device also relies on consent under § 25 TDDDG.

7.1 Feature usage (PostHog Cloud EU)

Recipient: PostHog, Inc., via PostHog Cloud EU. The app uses a manual HTTPS capture request. It does not embed the PostHog SDK and does not use autocapture, session replay, heatmaps, web vitals, or dead-click tracking.

If you consent to this purpose, a Closed Beta or separately configured Production build can send:

• an allowed app or feature event name and a timestamp;
• the purpose-specific random identifier;
• app version, build channel, and whether the effective plan is Free or Pro;
• limited feature or outcome fields where the event defines them.

There is no funnel of every installation. first_launch is not exported. Start, pause, and resume of a recording, and Raw GNSS start, are suppressed on export. A finished recording can appear as an event without track content. Not every event name in the source is reachable in the beta build.

7.2 Technical diagnostics (Sentry EU)

Recipient: Functional Software, Inc. doing business as Sentry, using Sentry’s EU ingest and EU data-storage location.

If you consent to this purpose, a Closed Beta or separately configured Production build can send:

• fixed operation and error categories, with coarse count and duration classes;
• app version and build channel;
• Android version, device manufacturer and model;
• available GNSS capabilities as true/false flags, when known.

Examples include GPX import or sync, offline-map download, and recording errors. No GNSS measurements are included. Diagnostics do not request a location permission.

7.3 Crash and freeze reports (Sentry EU)

Same Sentry EU recipient as section 7.2. The app uses Sentry Android core 8.42.0 with FluxMap’s own filter and queue. It does not forward unfiltered SDK envelopes.

If you consent to this purpose, a Closed Beta or separately configured Production build can send:

• cleaned JVM crash or ANR reports;
• exception types and limited source-code stack frames;
• build and device context;
• the crash-purpose identifier and a timestamp.

Native dumps, screenshots, session replay, arbitrary logs, exception message text, and automatic network or file breadcrumbs are not sent. This is not a claim that every crash is captured.

7.4 What diagnostics never include

For all three purposes the app does not put these in the diagnostic payload:

• coordinates, track content, track names, or location history;
• Raw GNSS measurements;
• file paths or URIs;
• credentials, a Google account, or an advertising ID.

That limit applies to diagnostics. It does not describe online maps, a sync folder you choose, Android backup, or files you attach to support mail.

The receiving server still sees the connection IP address as part of HTTPS. It would be false to say that IP addresses are never processed. On the operator’s PostHog EU project, stored-IP discard is on, and the app payload also turns off GeoIP and person profiles. On the operator’s Sentry EU project, “Prevent Storing of IP Addresses” is on, with Sentry’s data scrubber and default scrubbers on. Discarding stored IPs is not the same as the edge never seeing a connection IP.

7.5 Local queues, withdrawal, deletion

Pending events sit in app-owned queues: usage and technical each at most 500 events or 1 MiB; crash at most 20 events or 256 KiB. Queued items expire after at most seven days. That is offline buffering on the device, not the provider retention period.

Identifiers, deletion references, and those queues live outside Android backup, device transfer, and GPX/Raw sync. The track database can still be included in Android backup or device transfer. Local data is therefore not described as never leaving the device.

Withdrawal is in Settings → Privacy & diagnostics. It stops capture and send for that purpose, deletes that purpose’s pending local data, and retires its identifier. A later grant creates a new identifier. Data already received by PostHog or Sentry is not deleted by withdrawal. A request already in flight may have arrived.

The app can show current and previous deletion references and prepare a report you can read before sharing. Email those references to hoeffneremil@gmail.com (see Support). No FluxMap account or identity document is required as a default. Remote deletion is finished only after it is processed and confirmed. Clearing app data can drop the local references. There is no self-service deletion portal.

FluxMap Pro is unlocked for testers without payment. Google Play purchases are not offered in this beta.

8. Support

If you write to hoeffneremil@gmail.com, we process the sender address, your message, and attachments you choose to include (for example a deletion-reference report from the app). Do not send full tracks unless asked. That mailbox is a consumer Gmail inbox, so Google also processes the mail under Google’s own terms.

Legal basis: Article 6(1)(b) and (f) GDPR. Retention: until the request is finished and at most 90 days, unless a legal duty requires longer.

9. Website

This site is served via Cloudflare Pages. Cloudflare processes connection data (IP address, time, requested URL) to deliver the pages. See Cloudflare’s customer documentation and Data Processing Addendum.

These public beta pages do not load FluxMap Studio, third-party map tiles, routing, elevation APIs, remote webfonts, PostHog, Sentry, or other analytics scripts. Studio is not part of the public beta website. There is no FluxMap website account. This site does not use a cookie or consent banner because it does not set optional tracking cookies.

10. Retention

11. Recipients and transfers

EU ingest or EU data-storage is not a promise that every processing step stays inside the EU. PostHog Cloud EU stores customer event data in AWS eu-central-1 (Frankfurt). PostHog, Inc. is established in the United States. Its published DPA states that it will process company personal data outside the EEA, including in the United States and other countries on its subprocessor list (for EU Cloud this includes AWS in Germany, and Cloudflare’s global edge for traffic in transit). The safeguards PostHog publishes for those transfers are participation in the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, with a UK addendum. A DPA can be generated and countersigned in the PostHog organisation. The public DPA text is not itself proof that this beta’s organisation has countersigned it.

Sentry EU stores listed service data (including error events) at rest in Frankfurt. Functional Software, Inc. is established in the United States. Sentry’s documentation states that choosing EU storage does not stop Sentry from accessing and processing data under its agreement, and that some organisation, account, and usage metadata may be stored in the United States regardless of the selected location. Affiliates in Austria, Canada, and the Netherlands, and infrastructure subprocessors including AWS, Google Cloud, and Cloudflare, appear on Sentry’s subprocessor list. Sentry’s published DPA relies on the Data Privacy Framework and, where that does not apply, the EU Standard Contractual Clauses. Acceptance of that DPA in the Sentry organisation has not been confirmed here.

No AI feature has been confirmed as enabled for this beta on either provider. This notice does not describe model training on diagnostics.

Provider documents: PostHog DPA, PostHog data storage, Sentry DPA, Sentry data storage location, Sentry retention periods.

12. Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection to processing based on Article 6(1)(f) GDPR, withdrawal of consent, and the right to lodge a complaint with a supervisory authority.

Local tracks: delete them in the app. Diagnostics still on the device: withdraw the purpose or clear queued data in Settings → Privacy & diagnostics. Diagnostics already received by PostHog or Sentry: send the app’s deletion references as described in section 7.5. There is no FluxMap account, so Google Play’s in-app account-deletion URL does not apply. That does not remove GDPR deletion rights for support mail or for sent diagnostics.

We answer without undue delay, at the latest within one month (Article 12(3) GDPR).

13. Other

The app works without diagnostics. It cannot record meaningfully without a location permission. There is no automated decision with legal effect under Article 22 GDPR.

Changes get a new date and, where consent is affected, a new notice version in the app.

Date: 13 September 2026. This is not a substitute for legal advice.