Privacy Policy

Applies to the website fahrtenbuch.app including the documentation at /docs, the Android app “Fahrtenbuch” (app.fahrtenbuch.mobile) and the server software. Last updated: 29 October 2026

1. Summary

Fahrtenbuch is self-hosted software. That means:

• The developer does not operate a central service through which trip data passes. There is no account with the developer and no developer cloud.
• No hosted server: the server software (Docker) is not offered as a service. Anyone who wants to use server mode runs their own server and is responsible for it (see section 7).
• The app stores data either only on your device (local mode) or sends it to a server whose address you enter yourself (server mode).
• The app contains no advertising, no analytics or tracking SDKs and no crash reporting that sends data to the developer.
• Location data is collected only while a trip is being recorded.

The details – including the few cases in which data may reach third parties – are set out below.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) for this website, the documentation and the publication of the app is:

3. This website and the documentation

Hosting and server log files

This website and the documentation are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit a page, the web server automatically processes technically necessary data transmitted by your browser:

• IP address,
• date and time of access,
• requested page or file, amount of data transferred and HTTP status code,
• browser type, operating system and, where applicable, the referrer URL.

This processing is necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). Log files are deleted after [7] days unless they are needed to investigate a security incident. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

No cookies, no tracking, no external content

This website does not set cookies, does not use analytics tools and does not embed content from third parties (no external fonts, scripts, maps or videos). All files are served from our own web server.

The documentation stores your preferred colour theme (light/dark) in your browser's local storage. This information never leaves your device and is strictly necessary to provide the function you requested (§ 25(2) no. 2 TDDDG).

Contact by email

If you contact us by email, your details (email address, name, content of your message) are processed to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. The data is deleted once your enquiry has been dealt with and no statutory retention obligations apply.

Live demo

The live demo at demo.fahrtenbuch.app is operated by us. When you start a demo, a separate Fahrtenbuch server with sample data is created just for you; other visitors cannot see it. The demo processes your IP address, browser user agent and session data (see section 7) as well as everything you enter. To prevent misuse, your IP address is stored together with your running demo instance (one running instance per address) and kept in memory for at most one hour to limit the number of demo starts. The purpose is to let you try the software; the legal basis is Art. 6(1)(f) GDPR. The demo instance, including all content you entered and the stored IP address, is deleted automatically after 15 minutes. Server logs are deleted after [7] days. Please do not enter real personal data. The demo start page loads its stylesheet and images from fahrtenbuch.app; no other external content is loaded.

Beta testing

The Android app is offered as an open test on Google Play. You join and leave the test directly on Google Play with your Google account; this is handled by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) under its own responsibility. We do not collect any sign-up data and do not receive a list of testers. If you send feedback via Google Play, we receive the content of your feedback together with the information Google makes available to developers. If you send feedback via email or GitHub, the sections “Contact by email” and “GitHub” apply.

GitHub

Source code, releases and the container image are provided via GitHub (GitHub, Inc., USA). The documentation contains “Edit this page” links to GitHub. If you follow a link to GitHub, GitHub's privacy statement applies. Simply visiting this website or the documentation does not transmit any data to GitHub.

4. Android app

4.1 Local mode

If you choose “Only on this device” during setup, vehicles, trips, GPS points and settings are stored exclusively in the app's own database on your phone. Nothing is transmitted to a server. The only exceptions are the map display (section 6.3) and Android system services (section 6).

4.2 Server mode

If you connect the app to a Fahrtenbuch server (via QR code or by entering the address manually), the app sends the following data to that server:

Sign-in tokens (access and refresh token) are stored locally in the app so that you stay signed in. Trips recorded without a network connection are buffered and uploaded as soon as a connection is available again.

Legal basis: If you use the app privately, you are processing your own data. For a server operator, Art. 6(1)(b) GDPR (providing the trip log), Art. 6(1)(c) GDPR (tax record-keeping obligations) or, in an employment context, § 26 of the German Federal Data Protection Act (BDSG) will typically apply. The details are determined by the respective operator.

4.3 Pairing via QR code

The QR code shown in the web dashboard contains the server address, a one-time pairing ID and token, username, email address and expiry time (120 seconds by default). The app reads this data and uses it to sign in to the server. The camera image is only used to recognise the code; it is neither stored nor transmitted.

4.4 Local logs

The app writes technical diagnostic messages to the Android system log (Logcat), e.g. about the recording and sync status. These messages remain on the device and are not sent to the developer.

5. App permissions

Android only asks for sensitive permissions when you use the relevant feature. You can revoke them at any time in Android's settings; the affected feature will then no longer be available.

6. Third-party services in the app

6.1 Google location services

To determine your position, the app uses the “Fused Location Provider” of Google Play services. Depending on your device settings (e.g. “Google Location Accuracy”), Android may send Wi-Fi, mobile network and sensor data to Google in order to determine the position. This processing is carried out by the operating system or Google Play services and is subject to Google's privacy policy. The app itself does not send any trip data to Google.

Addresses on the device (Android geocoder): For trips whose start and destination addresses are not supplied by a server – in particular in local mode – the app determines them with the Android geocoder after the trip ends. To do this, the coordinates of the start and end point (not the whole route) are passed to the geocoding service of the device, which on most devices is provided by Google and requires an internet connection. If no connection is available, the address stays empty and is determined later. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a readable trip log without your own server).

6.2 Passkeys via Android Credential Manager

If you sign in with a passkey, the Android Credential Manager or the password manager you have chosen (e.g. Google Password Manager) manages the key. The private key never leaves your password manager; only a signature is sent to the Fahrtenbuch server.

6.3 Map display (MapLibre & OpenFreeMap)

Maps are drawn directly on your device with MapLibre Native, an open-source map library (maplibre.org). MapLibre is part of the app; it contains no telemetry and does not send any data to the MapLibre project. The route itself is drawn by the app from your own trip data – it is not sent to any map service.

To show the map underneath the route, the app loads vector map tiles, map styles, fonts and icons from OpenFreeMap (openfreemap.org), a free map service based on OpenStreetMap data. This transmits your IP address, the app's identifier as user agent and the requested map sections – from which the approximate region of the displayed trip can be inferred. GPS points or other trip data are not transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a working map display). Tiles are cached on the device, so sections already loaded are not requested again. Map data © OpenStreetMap contributors.

6.4 Backup (Google account and ZIP file)

Google account: Only if you switch it on in the app (Settings › Backup) – it is off by default – the app's vehicles, trips (including GPS points and tags) and settings, including the server address and user name, are included in Android's backup to your Google account. The backup is encrypted, carried out by Android and Google Play services and subject to Google's terms; the developer has no access to it. Login data is never included: access and refresh tokens and the device ID stay on the device, so after restoring on a new device you sign in again. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching the option off. Moving to a new phone with Android's device-to-device transfer copies the same data (without login data) directly between your devices.

ZIP file: You can save a backup as a ZIP file at a location of your choice and restore it later. It contains the same data, again without login data. The file is not encrypted – store it carefully, as it contains your trips and GPS positions.

6.5 Google Play

If you download the app from the Google Play Store, Google processes data related to the download, installation and updates under its own responsibility. Google may provide the developer with aggregated, non-personal statistics (e.g. install counts, crash rates) via the Play Console.

6.6 Profile picture (Gravatar)

In server mode the app can show your profile picture from Gravatar (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA). To do so, the app sends a SHA-256 hash of your email address – not the address itself – and, for technical reasons, your IP address to Gravatar. If no picture is stored there, the app shows your initials; Gravatar does not return a placeholder image.

You can switch this off at any time in your profile (app: Settings › Profile › “Profile picture from Gravatar”; web dashboard: Profile › Units & formats). The setting belongs to your account and applies to the app and the web dashboard; when it is off, no request is sent to Gravatar. The operator of a server can disable Gravatar for all users (GRAVATAR_ENABLED=false). In local mode Gravatar is never used.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a recognisable, personal display of the account); you can object at any time by switching the feature off. Automattic is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). More information: Automattic privacy policy.

7. Server & web dashboard (self-hosted)

The developer does not offer the server as a hosted service: the server software (Docker container) is installed by the respective operator on their own infrastructure. The operator is responsible for the data processed there. For transparency, this section describes what the software does in its default configuration – operators may use it as a basis for their own privacy policy.

Stored data

• User accounts with display name, username, email address, password hash, TOTP secret (encrypted) and registered passkeys,
• sessions with time, IP address and user agent; signed-in devices,
• vehicles, leasing and financing details, trips, GPS points, addresses, saved places, odometer readings and audit history,
• vehicle shares with other users and sharing invitations,
• suggestions for the trip type (type, confidence, short reason, AI provider and model) if AI suggestions are used,
• records of data imports and exports, and database backups,
• HTTP access logs (IP address, time, request, user agent) in the application's container log.

External services in the default configuration

The following services are preconfigured and can be replaced by the operator with self-hosted instances:

• Photon (komoot GmbH, Potsdam, Germany) – The server sends the coordinates of start and end points to determine addresses, as well as search terms for address search. Requests originate from the server, not from the browser or phone.
• Overpass API (overpass-api.de) – The server sends coordinates and a search radius to suggest nearby places.
• Maps – The web dashboard renders maps in the browser with MapLibre GL JS, which is shipped with the application (no CDN, no telemetry). Map tiles are loaded by the server from tile.openstreetmap.org and stored in a local cache, so the browser only talks to the operator's server. Alternatively, a self-hosted Protomaps tile server can be configured; its fonts and icons are fetched by the server from protomaps.github.io (GitHub) unless the operator provides their own asset URL. No user or trip data is included in these server-side requests.
• Gravatar (Automattic Inc., USA) – The web dashboard shows your profile picture from Gravatar. Your browser sends a hash of your email address (SHA-256; MD5 only if the dashboard is opened without HTTPS) and your IP address to Automattic. Each user can switch this off in the profile; the operator can disable it for the whole installation with GRAVATAR_ENABLED=false. Automattic is certified under the EU-US Data Privacy Framework. See also section 6.6.
• Email delivery – For password resets and invitations, the server uses the SMTP server or webhook configured by the operator.

AI suggestions for the trip type (optional)

The server can suggest whether a trip was a business trip, a private trip or a commute. A suggestion never changes a trip by itself; the trip is only classified when the user accepts it. There are two stages:

• Suggestions from your own trips: if you have classified the same route (start and destination close to each other, in either direction) the same way several times, the server suggests that type. This is calculated on the server alone; no data is shared with anyone.
• Suggestions by an AI provider: only if the operator has set up an AI provider (Administration › AI) and you have switched on “AI suggestions for the trip type” in your profile – it is off by default. For each new trip that cannot be decided from your own trips, and when you click “Ask AI”, the server sends the following to the provider: start and destination address, the kind and name of the place at start and destination (e.g. a DIY store, as determined by the address service), weekday, start and end time, duration, distance, the names of your saved places at start or destination, the purpose if you entered one, and type, weekday, time and addresses of your 12 most recently classified trips. GPS points, coordinates and the route are not sent. The answer (type, confidence and a short reason) is stored with the trip.

Which provider receives the data is chosen by the operator; your profile shows it. With Ollama the AI runs on a server operated by the operator themselves, and no data leaves that infrastructure. With Claude (Anthropic PBC, USA) or OpenAI (OpenAI, USA) – or another OpenAI-compatible service configured by the operator – the data is transmitted to that company and processed under its API terms and privacy policy; the operator is responsible for concluding the necessary agreements (e.g. a data processing agreement) and for ensuring a lawful transfer to third countries. The API key is stored encrypted on the server and is never shown to users.

The legal basis for sending data to the AI provider is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching the option off in your profile; no further data is then sent. Suggestions from your own trips are based on Art. 6(1)(f) GDPR (legitimate interest in an easier-to-keep trip log). The feature is currently available in the development version of the server only.

The web dashboard does not set tracking cookies and does not embed analytics services. Signed-in sessions are kept via tokens stored in the browser, which are technically necessary for the service to work (§ 25(2) no. 2 TDDDG).

8. Retention & deletion

• On the device: Data remains stored until you delete it in the app, sign out, clear the app's data in Android's settings or uninstall the app.
• On the server: Data remains stored until you or the operator delete it. Archived trips are permanently deleted automatically after 90 days. Please note that trip logs relevant for tax purposes may be subject to statutory retention periods.
• Device sign-in: A device signed out in the app or web dashboard loses its access; refresh tokens are valid for at most 30 days by default.

9. Security

The app communicates with the server using the protocol set up by the operator. We strongly recommend a connection via HTTPS. The “Disable certificate check” option is intended only for self-signed certificates in your own network and lowers the level of protection. Passwords are stored on the server only as hashes, TOTP secrets are encrypted. Access tokens are short-lived (15 minutes by default) and refresh tokens are rotated on every use.

10. Your rights

You have the following rights against the respective controller:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) – the web dashboard offers an export of your data for this purpose,
• objection to processing based on legitimate interests (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

For data on a Fahrtenbuch server, please contact its operator. For this website, the documentation and the app, you can reach the controller at the address above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is:

11. Changes to this policy

This privacy policy will be updated when the app, the server software or the legal requirements change. The version published on this page applies. Based on: app version 0.5.1, server version 0.6.11 and the current development version of the server (AI suggestions).