Phillip Hartung, individual operator of Fichi, is responsible for your personal data (the “controller” under the GDPR).

• Address: Luisenstraße 61A, 80798 Munich, Germany.

• Email: support@fichi.app.

• There is no phone number and no contact form. The email is the way to reach Fichi directly.

This notice covers the website fichi.app, the web app at app.fichi.app and the Fichi iPhone app.

• You need an account to use Fichi. Your profile, saved places, trips, diary and travel history sync to your account.

• Fichi has no advertising, no advertising ID and no tracking across other apps or sites. We do not sell your data.

• Your device location is never sent to Fichi. The Fichi map asks for it when it first opens. You can refuse.

• Travel Memories (iPhone app) reads only the date and place of your photos, on your iPhone, and only when you start it. Fichi does not open, copy or upload a photo (section 8).

• Your card details go to Stripe (web) or Apple (iPhone). Fichi never sees them.

• Once you have confirmed the Terms, the app sends anonymous counts of how it is used, once a week. Before you sign up, it also counts how many visits reach each step of the sign-up, and after you pay how the first cards are answered, with no account and no device ID. You can switch both off in Settings > Your data > Help improve Fichi.

• Fichi sends news and updates only if you turn on “Keep me posted”. It is off until you turn it on.

• The free trial is once per person. After you delete your account, a one-way fingerprint of your email address is kept for 24 months for that purpose only (sections 5 and 20).

• You can export your data and delete your account in the app.

What we handle.

• Your email address, and your password if you sign in with one.

• How you signed in (email, Google or Apple) and a user ID that Fichi creates for you.

• Your name, if Google or Apple shares it. Apple can share a private relay address instead of your real email.

• The time of your last sign-in.

• A record that you accepted the Terms and acknowledged this notice: the date, the version, the wording and the place in the app where it happened.

How sign-in works. You can sign in with email and password. The app confirms a new email account with a 6-digit code we send you. You can also ask for a sign-in code by email, or sign in with Google or Apple. The Google button on the web loads a script from Google. On the iPhone the Google sign-in sheet is part of the app. Apple and Google then tell Fichi who you are.

Why. To create your account, let you sign in, keep your data safe and show that you accepted the Terms.

Legal basis. Contract (Art. 6(1)(b) GDPR) for the account and the sign-in. Legitimate interest (Art. 6(1)(f) GDPR) for keeping the record of your acceptance as proof.

Who handles it. Supabase runs the account system. Google and Apple handle your sign-in when you choose them. See section 18.

What syncs to your account (when you are signed in). Diary notes, saved places, trips, profile and travel history (visited countries) sync to the account. In detail:

• Profile: your home city, passports (country, and optionally the expiry month and a range for blank pages), travel party, pace, budget level, taste choices, your answers about places (Loved it, Good, Not for me) and the countries you visited. It also holds your answers to a few optional questions near the start: how often you travel, how long you usually go for, what you usually spend on a trip, and whether a trip is coming up (booked, being planned, just dreaming or not yet). Fichi uses these four answers only to choose which news to send to people who turned on “Keep me posted” (section 15). They do not change what the app shows, plans or costs. The answers about places include those you give in the evening check-in and in the question the app may ask once after a dated trip ends (which places you went to, and whether they were worth it). You can skip any question, or switch the question off in Settings > Your data > Ask me after trips.

• Saved places, places you ticked as done, and places imported from posts you shared (with the creator’s handle and the link to the post).

• Trips: title, dates, stays, transfers, chosen beds, stops.

• Diary notes: the text you write.

• Your last 10 searches that you picked, a few start-up flags, and settings (theme, feed, language).

The app sends this as one record about a second after each change, and when you sign in. The record can be up to 4 MB. Fichi reads two things from it on the server: the name in your profile, if there is one (for the greeting in emails), and trip titles and start dates (for the trip reminder in section 9).

Why. To keep your data across devices and to give it back after you log out. Legal basis: contract (Art. 6(1)(b) GDPR).

What stays on your phone. The taste evidence, “not for me” choices, usage counters and roadmap-vote cache stay on the phone. So do your switches for the weekly counts and for questions after trips, the list of trips already asked about, a random string that mixes up the Discover rows, the queue of shared links waiting to be sent, and a local crash log that is never sent anywhere. Fichi works out what you like on your phone, not on a server. The text you type in “In your own words” is read on your phone and is not stored or sent. Visa and entry checks are worked out on your phone. The check itself sends nothing. The trips that Travel Memories finds from your photos are worked out on your phone too (section 8).

Your logged spending. If you log what you paid on a trip, each entry is also sent to Fichi when you are signed in: the amount, currency, category, day, number of people, city, country, the trip and the place. It is not shown back to you in the app. Fichi uses it to keep price estimates up to date. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in better estimates. If you delete an entry, Fichi marks it as deleted. The marked row is removed when you delete your account.

If your membership ends. Your trips, wishlist and diary stay open to read and export. New content needs a membership. Your data stays in your account until you delete it.

Web (Stripe). Stripe processes web checkout and billing. You type your card details into Stripe’s own payment page. Fichi never sees them. Fichi creates a Stripe customer record with your email address and your Fichi user ID. Stripe also collects your name, billing address and payment details as needed for the payment. When the web payment page opens, your browser connects to Stripe’s servers, and Stripe can use its own cookies there. Fichi keeps the Stripe customer and subscription IDs, your plan, status, trial and renewal dates, whether a payment was made and the end of a payment grace period.

iPhone (Apple and RevenueCat). Apple processes the purchase. Fichi does not receive your payment details. RevenueCat relays purchase events from Apple to Fichi. Fichi identifies you to RevenueCat only by your Fichi user ID, never by your email address. The app has RevenueCat’s automatic device-identifier collection and diagnostics switched off. Fichi stores the plan, status, dates and the store’s transaction IDs.

Free access. If you were given a complimentary membership, Fichi keeps your email address, the dates and a short internal note.

Why. To start, run, end and bill your membership and to give you access.

Legal basis. Contract (Art. 6(1)(b) GDPR). Legal obligation (Art. 6(1)(c) GDPR) for invoices and booking records, which German commercial and tax law requires us to keep for 6 to 10 years (for example § 257 HGB and § 147 AO).

Trial and reminder emails. See section 6.

One free trial per person. The free trial is once per person (Terms, section 13). While your account exists, Fichi keeps a record that your email address had the trial. When you delete your account, that record is replaced by a one-way fingerprint of the address (a SHA-256 hash, in which Gmail spelling variants with dots or plus tags count as one address), kept for 24 months and then deleted. It holds the date of the trial and the dates of deletion and expiry, and no name, account number, payment detail or readable address. It stays on Fichi’s server and is read only to answer whether this address already had the trial. See section 20.

Legal basis for the fingerprint. Legitimate interest (Art. 6(1)(f) GDPR) in stopping the free trial from being used again and again. You can object by writing to support@fichi.app, and Fichi then weighs your reasons.

Fichi sends you these emails because they belong to your account or your membership:

• Sign-in codes and password reset links.

• A welcome email after a purchase. For web purchases it confirms the contract and links to the right of withdrawal and the Terms.

• A trial reminder two days before a trial turns into a paid plan.

The emails greet you by first name when Fichi knows it. They come from “Fichi <support@fichi.app>” and are sent through Google Workspace (Gmail) mail servers. The sending mailbox keeps a copy of every email it sends. Sign-in emails use the mail service set in Supabase. Stripe sends you its own receipt for each payment on the web, and Apple sends its own receipt for iPhone purchases.

Legal basis. Contract (Art. 6(1)(b) GDPR). These emails are not marketing. They are separate from the newsletter in section 15.

What you share. You can share an Instagram or TikTok post to Fichi from the iPhone share sheet, or paste its link in Wishlist > Add places. You share a link and the text that comes with it. For an import the app does not read your camera, your photo library or your files. (Travel Memories is a separate feature that you start yourself, section 8.) Fichi sends the link, that text, the app it came from and the time to its server, together with your login.

What Fichi then does. Fichi’s server works with the public post behind the link:

• It retrieves the post data: caption, title, creator name and handle, counts, post time, location tag, tagged accounts and media links. Apify does this retrieval. For some Instagram posts Fichi loads the public embed page from Instagram itself. Instagram and TikTok see the post link and the address of Fichi’s server. They do not see your device.

• It downloads the audio or video of the post (up to 25 MB) and sends it to OpenAI to turn speech into text.

• It reads the pictures of the post (up to 20 slides) and, for a weak video, up to 12 frames cut from it. Anthropic (Claude) reads the text on them. Fichi does not keep the pictures, the frames or the audio.

• Anthropic (Claude) also reads a text made from the location tag, up to 12 tagged accounts, the caption, the speech text and the text from pictures, and lists the places it finds. The note you typed with your share is not included. No account ID or email goes to Anthropic, OpenAI or Apify.

• Fichi searches Google Places for each place by name, city and country, to find the right map entry and photos.

• The places are saved as candidates in your wishlist. If you allowed notifications, Fichi tells you when they are ready.

What Fichi keeps. Your share (link, your typed note, status), the places found, and your choice to keep or dismiss each place stay in your account. Fichi also keeps one shared copy per post link, not tied to your account: caption, creator name and handle, speech text, text from pictures and the places the AI found. It is reused when another traveller shares the same post and is refreshed after 7 days. It stays as long as Fichi uses it, and Fichi removes it when you or the creator of the post ask for that at support@fichi.app. Fichi also keeps a cost record of each provider call (which provider, how many units, the estimated cost, no content). It is linked to your account until you delete the account and is kept without the link afterwards.

Who can see it. For quality and cost checks, the operator can see imports across all accounts, including which account sent them and that account’s email address. Place names, quotes from the post, the creator’s handle and the post link can be given to AI research tools (Claude, Codex) that the operator uses to review places. No account ID goes with them.

Why. To turn the post you shared into saved places.

Legal basis. Contract (Art. 6(1)(b) GDPR) for your own request. Legitimate interest (Art. 6(1)(f) GDPR) for handling the public post data of its creator and for review and cost control.

The Fichi map asks for your device location when it first opens. iOS or your browser asks your permission first. The iPhone text says: “Fichi uses your location to show places close to where you are, on the Fichi map and when you choose Near me.”

• Fichi also asks when you choose “Near me” on Home and when you tap “Use my location” on the map.

• The app uses your position to centre the map, to show a “you are here” point and to sort places by distance.

• The position stays on your phone. It is not saved, not synced and not sent to Fichi.

• The map still asks OpenFreeMap for map tiles of the area it shows (section 10). When the map is centred on you, that area shows roughly where you are.

• You can refuse. Then the map opens on your home city or a default place, and “Near me” and “Use my location” do not work. You can change your choice in your iPhone or browser settings at any time.

• Your home city is different. You pick it from a list of city centres. It is not read from your device.

Legal basis. Your permission in iOS or your browser (Art. 6(1)(a) GDPR).

Travel Memories (iPhone app). In Profile > Travel memories you can ask Fichi to find your past trips from your photos. Nothing is read until you tap “Find my trips”. iOS asks your permission first, and you can share all your photos or only the ones you pick. The iPhone text says: “Fichi reads the date and place of your photos, on this iPhone, to find the trips you have taken. It does not open or upload your photos.”

• Fichi reads two things about each photo and video: the date and the place where it was taken. It does not open the picture. It does not look at what or who is in it, and it recognises no faces.

• This happens on your iPhone. No photo, no date and no place from your library is sent to Fichi or to anyone else. A photo that is stored only in iCloud is not downloaded.

• From the dates and places the app works out your trips: the days you were away from home, the countries and towns, and the Fichi places you were at. For this it uses the home city in your profile, Fichi’s own list of places and a map of country outlines that is stored in the app. No map service is asked.

• The app may ask whether you lived in a place where your photos show a long stay. Your answer is used on your phone to tell a home from a trip.

• Nothing is saved. The trips found and your answers stay in the app’s memory and are forgotten when you close the app. They do not sync to your account. If saving trips is added later, this notice will say so before it starts.

• You can refuse. You can also take the permission back at any time in your iPhone’s Settings > Fichi > Photos. Travel Memories then does nothing, and the rest of Fichi works as before.

Legal basis. Your permission in iOS and your tap to start (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Notifications exist on the iPhone only. The app asks for permission at three moments: when Fichi’s server has accepted a post you shared, when you create a trip with dates, and right after your free trial starts (the app first explains the reminder in one line of its own, and only your tap on its button opens the iOS question). If you allow them, the app sends Fichi:

• the notification token of your phone, your time zone, the app version, and the number of imported places you have not seen yet (for the badge on the icon).

Fichi sends three kinds of notifications through Apple’s push service:

• “Your reel is ready” (or that no place was found).

• “{trip title} starts tomorrow” at 18:00 your local time the day before a dated trip. The trip title is part of the notification text that passes through Apple.

• “Your free trial ends in 2 days”, about two days before a free trial turns into a paid plan. It is sent once, and only if you allowed notifications. The email reminder in section 6 is sent as well.

Log out removes the token from Fichi’s server. You can also switch notifications off in iOS settings.

News and updates. The switch “Keep me posted” (section 15) covers news and updates by email and by notification together. It is off until you turn it on. At the time of this notice, updates are sent by email only; no update is sent as a notification.

Legal basis. Contract (Art. 6(1)(b) GDPR): the notifications are part of the service. You control them with your iOS permission.

• Weather. The app asks Fichi’s server for the weather at your home city (coordinates rounded to about 1 km) and, for a dated trip within 10 days, at the trip’s cities and dates. This uses your home city and trip places, not your device position. Fichi’s server asks MET Norway. MET Norway receives the rounded coordinates and the address of Fichi’s server, but no user ID.

• Exchange rates. While you are signed in, the app asks Fichi once a day for the day’s exchange rates. Fichi gets them from the European Central Bank and ExchangeRate-API. These providers receive no personal data.

• Map tiles. The Fichi map and the trip map load map tiles from OpenFreeMap (tiles.openfreemap.org). With every request OpenFreeMap sees your IP address, your device type and the area you look at.

• Photos. Place photos load from Fichi’s storage at Supabase. That host sees your IP address and the file requested. Photos of some imported places and the city videos on the trips list also come through Fichi’s server.

• Links you tap. Google Maps, a place’s website, WhatsApp, a phone number or a saved post open in your browser or in another app. That app or website then handles your data under its own rules. Fichi does not receive a message when you tap them. The one exception is the anonymous weekly count of how often a place was opened in Maps (section 11).

Why. To show weather, prices in your currency, maps and photos. Legal basis: contract (Art. 6(1)(b) GDPR).

Photos and place details. Photos and place details come from third-party and public sources and are shown for illustration. If you own a photo or a detail and want it removed, write to support@fichi.app.

What they are. Anonymous counts of how the app is used: what was shown, opened, saved, searched with no result, and which filters were used. They contain no name, email, account, device id, location or list of saves. They do not contain the notes you write.

What exactly is counted. On your phone, week by week: which places were seen, opened, saved, put on a trip or opened in Maps (by Fichi’s own place number), how far you went through a place’s photos, which shelf they were on and where, which words you searched for, whether anything was found, whether Fichi understood the words, whether you opened a result and whether you typed a different search a few seconds later, which filters and map chips you used, how long cards stayed on screen (in four rough groups) and which kinds of “not for me” answer you gave. Search words are 40 characters at most. With each word the phone also counts one for itself that week, so a total shows how many different phones searched it; no identifier travels with it. A search that looks like an email address, a number with three or more digits or a link is not counted. There is no list of single events and no time finer than the week.

When they start and how they are sent. They start only after you have confirmed the Terms. They can be switched off in Settings > Your data > Help improve Fichi. The phone sends them once a week, for a finished week, in one request that carries no account, no token, no cookie and no device ID.

What the server does. The server adds the numbers to totals. It does not keep a record per phone. Like every request on the internet, yours arrives with your IP address. Fichi’s code does not read, store or log it for these counts. The hosting platform may keep technical logs of its own. The server keeps the totals for good as anonymous statistics (no time limit). On your phone the counts are kept for the last 8 weeks and cleared by “Erase this device”.

Sign-up step counts. Before you have an account, Fichi also counts how many visits reach each step of the sign-up: the opening, the preview of the app, the free-trial offer, the account step, the membership screen and the tap on checkout. The app sends the name of the step and whether it runs on the web, on iPhone or on Android, once per visit, in one request that carries no account, no token, no cookie, no device ID and no time. The server adds one to that day’s total for that step and platform. Like every request on the internet, it arrives with your IP address. Fichi’s code does not read, store or log it for these counts. The hosting platform may keep technical logs of its own. The server keeps the daily totals for good as anonymous statistics (no time limit). Nothing is stored on your phone for them beyond the visit itself.

When they start. These counts start at once, before you confirm the Terms, because they carry nothing that could identify you. The switch in Settings > Your data > Help improve Fichi stops them as well, but Settings opens only after you have an account; until then you can write to support@fichi.app if you object. Your payment itself is not counted here, because Fichi already knows your membership from your account.

Card counts after you pay. The first cards the app shows after you pay (“Stay in the loop”, “Make Fichi even more yours”, “Is a trip coming up?” and “Fichi will keep getting better”) and any announcement Fichi shows later are counted in the same anonymous way: the name of the card, what happened (it was shown, you continued or opened it, you turned a choice on, or you chose Not now) and whether it runs on the web, on iPhone or on Android, once per visit, in one request that carries no account, no token, no cookie, no device ID and no time. The answers you give on a card are not part of these counts. The switch in Settings > Your data > Help improve Fichi stops them.

Why. To learn what to fix and what to add. The app works the same either way.

Legal basis. Legitimate interest (Art. 6(1)(f) GDPR) in improving the app. You can object at any time with the switch above.

On the Profile > Roadmap page you get 3 votes. A vote is kept with your account. Everyone sees the total number of votes per feature, never who voted. Deleting the account deletes the votes. The phone keeps a copy of your votes and the totals (the roadmap-vote cache). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in learning which features travellers want.

The feedback and support buttons in the app open your mail app with a message ready. Nothing is sent until you send it there. The message holds what you typed and the line “sent from Fichi”. No account details, no location and no ids are added.

When you write to support@fichi.app, Fichi receives your email address, your name as it appears in the email, your message and any attachment you add. Fichi uses them to answer you and to solve the problem. Fichi deletes the messages 3 years after the last message. Mail runs on Google Workspace. Legal basis: contract or steps before a contract (Art. 6(1)(b) GDPR), otherwise legitimate interest (Art. 6(1)(f) GDPR) in answering your question.

On fichi.app you can cancel a web membership (“Cancel contracts here”) or withdraw from a web purchase (“Withdraw from contract”) without signing in.

• Cancellation form. Your account email, an optional Stripe or contract reference, whether it is an ordinary cancellation or one for good cause, the reason (only for good cause), and the end date you choose.

• Withdrawal form. Your name, your email for the receipt, an optional Stripe or contract reference and an optional purchase date.

Fichi’s website server does not save these details in a database. It sends a receipt by email to the address you gave, with a reference number and the time of receipt (UTC), and a blind copy to support@fichi.app. To stop abuse, it counts requests per IP address and per email address (as a hash, in server memory only, for one hour). Nothing else is stored. The operator then processes your declaration by hand and keeps the emails for 3 years after the last message.

Legal basis. Contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR) to confirm a cancellation or withdrawal. Abuse protection: legitimate interest (Art. 6(1)(f) GDPR).

Cancelling in the app (Profile > Subscription) and deleting the account work as described in the Terms and in section 21.

News and updates (new places, new features and occasional offers) are sent only after a separate opt-in. The switch is called “Keep me posted”. It is one switch for email and notifications, it is off by default and it is never turned on for you. You find it on the first card after you pay (“Stay in the loop”, with the sentence “New places and features, by email and notifications. Turn off anytime in Settings.”) and in Settings > Your data > Updates from Fichi. If you turn it on:

• Fichi saves your choice (the wording you read, its version, the time and the place in the app) and sends your email address to Kit with the tag “Fichi Newsletter, opted in”.

• Kit sends the emails. Kit’s emails record whether you open them and which links you click. This tracking cannot be switched off.

• At the time of this notice, updates are sent by email only (see section 9).

How to stop. Turn the switch off in Settings > Your data > Updates from Fichi. Fichi then takes your address off the update audience at Kit and sends you nothing more; your address stays in Kit as a contact without that tag until you delete your account or ask us to remove it. You can also use the unsubscribe link in any email, or write to support@fichi.app at any time. Deleting your account unsubscribes you. Service emails (section 6) continue as long as you have an account.

Legal basis. Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future. Keeping the record of your consent: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

The website fichi.app. The pages need no sign-in. They set no cookies and use no analytics. The fonts are served from Fichi’s own server, not from Google.

Servers and logs. Every request from the app or the website reaches Fichi’s hosting platform with your IP address. Fichi’s own server code writes no access log. An IP address reaches its logs only when the abuse-protection step fails. The platform may keep technical logs of its own. Some log lines of Fichi’s server hold your user ID: sending a notification, payment events and account deletion problems. Technical errors of Fichi’s server are written to the server log. The error-monitoring service Sentry is built into the server code but has no key set on the server, so it is switched off.

Why. To show and secure the website and the service and to find faults. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Essential storage. Fichi’s own code sets no cookies. The web app and the iPhone app store data on your device so that the service you asked for works:

• your login session,

• a local copy of your profile, saves, trips, diary and settings,

• a marker that this device has been signed in before,

• the queue of shared links waiting to be sent, and on the iPhone a handover to the share sheet that holds a short-lived sign-in token,

• your scroll position on a screen (until you close the tab),

• a short note about the plan you picked while you join (30 minutes),

• a random string that mixes up the Discover rows (never sent),

• a local crash log on the iPhone (never sent).

We treat this storage as strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG), so it needs no consent. The app also keeps the weekly counts and your switches for them on your device (section 11). You can switch the counts off in Settings > Your data > Help improve Fichi.

Optional analytics. There are none from third parties. The app and the website have no third-party analytics tool, no advertising tool and no tracking pixel. The only usage statistics are Fichi’s own anonymous weekly counts and sign-up counts (section 11), which you can switch off. Fichi sets no cookies and uses no optional third-party storage, so there is no cookie banner.

Third-party content. The Google sign-in button, Stripe’s payment page and the map may set their own cookies or similar storage.

Providers that run Fichi for us act on our instructions. Others, such as Apple and Google, act under their own responsibility for some of what they do. The list shows what each really receives.

The European Central Bank and ExchangeRate-API receive no personal data. We also give data to authorities, courts and advisers when the law requires it or when we need it to enforce our rights.

Some providers in section 18 are based in the United States or other countries outside the EU/EEA, or process data there. This means your data can leave the EU/EEA. The law allows this with a safeguard, for example an EU adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses. You can write to support@fichi.app and ask about the safeguard for a provider.

MET Norway is in Norway (EEA).

Delete account. In Settings > Your data > Delete Fichi account. Type your email and the word DELETE. You must have signed in within the last 10 minutes. Deleting the account cancels a web subscription at once and ends access. It does not cancel an Apple subscription. Cancel that in Apple ID > Subscriptions. The deletion also:

• unsubscribes your email from the newsletter,

• deletes your synced data, your imports, your spending log, your notification tokens, your roadmap votes, your consent records and your login account,

• deletes the payment records at Stripe and RevenueCat, except invoices the law requires us to keep (German retention rules, 6 to 10 years).

Not deleted: the anonymous usage totals, the cost records without your identity, the shared copy of public posts, a complimentary membership record, the fingerprint that keeps the free trial to once per person (24 months, section 20), and the items in section 20 that name a later date.

Erase this device. Clears the phone and signs you out. The copy in your account stays until the account is deleted.

Log out. Also clears the phone and keeps the account’s copy. It first sends pending changes and removes the notification token from Fichi’s server.

Export. Settings > Your data > Export my data gives you a file with your profile, saves, places done, trips, diary, recent searches, start-up flags and settings. It is also available when your membership has ended. For other data, write to support@fichi.app.

• All Fichi addresses use HTTPS.

• Database rules allow only the signed-in owner to read the synced record of an account. Changes go through a controlled function.

• Card details are entered at Stripe or Apple and never reach Fichi.

• Sign-in uses short-lived tokens. Deleting an account needs a recent sign-in, your email and a typed word.

• Fichi’s internal review tools work only for accounts on a short allow-list. Without a list they stay closed.

• Requests are rate limited to protect against abuse.

• Your device location, your taste evidence, your visa checks and the dates and places of your photos stay on your phone.

No method of storage or transmission is completely secure.

You have the right to:

• Access your data and get a copy (Art. 15).

• Correct wrong data (Art. 16).

• Erase your data (Art. 17).

• Restrict the processing (Art. 18).

• Receive your data in a common format and pass it on (Art. 20). The export in Settings > Your data does this for your account data.

• Object to processing based on legitimate interest (Art. 21). For the weekly counts, use the switch in Settings > Your data.

• Withdraw consent at any time, with effect for the future (Art. 7(3)). For the newsletter, use the unsubscribe link in the email or write to support@fichi.app. For location and notifications, change the iOS or browser setting.

Write to support@fichi.app. We answer within one month. We may ask you to prove who you are. It is free of charge.

Complaint. You can complain to a data protection authority. The authority for the operator is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), in Ansbach, Germany. Its website is lda.bayern.de. You can also complain to the authority where you live or work.

Laws outside the EU may give you more rights. We respect them where they apply to us.

Fichi is for people aged 16 and over. Do not use Fichi if you are under 16. If we learn that someone under 16 has an account, we will delete it. A person under 18 may subscribe only with a parent’s or guardian’s consent, as the Terms explain.

Fichi makes no decisions about you that have legal or similar effects. Fichi orders and picks places on your phone from your own choices. AI reads the public posts you share and proposes places. You decide what to keep.

We will update this page when Fichi or the law changes. The date at the top shows which text applies.

• Phillip Hartung, Luisenstraße 61A, 80798 Munich, Germany.

• Email: support@fichi.app. There is no phone number and no contact form.