Privacy Policy
Last updated: 3 October 2026
- No accounts, no names, no e-mail addresses, no phone numbers.
- Your location is encrypted on your device before it is sent. Our server only stores ciphertext and cannot read your position.
- The key to decrypt it exists only in the share link you hand out (after the
#), which browsers never send to any server. - No cookies, no analytics, no advertising, no tracking.
- Shares end when the time you chose runs out or when you tap “Go dark”. Expired shares are deleted from our database after one month.
1. Who is responsible
This policy applies to the privIsee website and web app (including the share pages at /s/…) and to the privIsee app for iOS, which displays the same web app. The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Im Feldchen 19
53757 Sankt Augustin
Germany
E-mail: app@seleven.de
privIsee is open source. You can check everything described here in the source code.
2. How privIsee works
When you tap Go live and choose a duration (15 minutes up to 24 hours), the following happens:
- Your device generates a random 256-bit AES key. It is placed in the fragment of your share link (
…/s/{shareId}#key=…). Browsers never transmit the fragment to any server, so we never receive this key. - Our server creates a share entry and returns a random share ID and a secret “owner token” that only your device knows. The owner token allows only your device to update or stop the share.
- While sharing is active, your device reads its GPS position, encrypts latitude and longitude with AES-256-GCM and sends only the encrypted result to our server.
- Anyone who opens your full share link downloads the latest encrypted position about every 4 seconds and decrypts it locally in their browser to show it on a map.
Anyone who has the full share link can see your live location for as long as the share is active. Only share the link with people you trust. You can end the share at any time with Go dark.
3. Data we process
3.1 Data stored on our server
For each share our database stores exactly these fields:
| Data | What it is |
|---|---|
| Share ID | Random identifier that is part of the share link. |
| Owner token | Random secret that authorizes your device to update or stop the share. |
| Device ID | A random identifier (UUID) generated by the app on your device the first time you share. It is not derived from your device, phone number or any hardware ID, and it contains no personal information. It lets shares started from the same browser/app be grouped together. |
| Encrypted location | Your latest position as AES-GCM ciphertext plus its initialization vector (IV). Only the latest position is kept; every update overwrites the previous one. No location history is stored. We cannot decrypt it. |
| Timestamps | When the share was created, when it expires and when the location was last updated. |
| Status | Whether the share is active or was stopped. |
We do not store your name, e-mail address, phone number, IP address or any unencrypted location in this database.
3.2 Location data on your device
To share your position, privIsee asks for permission to access your device’s location. Your location is used only while a share is active, only to encrypt it and send the ciphertext as described above. If you deny permission, sharing is not possible; viewing a share does not require location access. You can revoke the permission at any time in your browser or device settings.
3.3 Data stored in your browser / app (local storage)
privIsee does not use cookies. It uses your browser’s local storage for two entries that never leave your device unless stated:
privisee.userId— the random device ID described above (sent to our server when you start a share). It stays until you clear your browser or app data.privisee.activeShare— the details of your currently running share (share ID, owner token, expiry time and the encryption key), so that sharing can continue if you reload the page. It is deleted when you stop sharing or the share has expired.
3.4 Server log files
Like every website, our hosting provider’s web server automatically processes technical data when you access privIsee, for example your IP address, date and time of the request, the requested URL, the HTTP status code, the referrer and the browser/operating system (user agent). Share IDs appear in requested URLs; the decryption key does not, because it is in the link fragment. This data is required to deliver the site and to keep it secure and stable. It is not combined with other data and not used to identify you. Log files are stored by our hosting provider for [30] days and then deleted, unless longer retention is needed to investigate a specific security incident.
4. Third-party services
Some content is loaded directly from third-party servers. When this happens, your browser connects to those servers and they receive at least your IP address and the usual request data (user agent, time, requested file).
4.1 Hosting — IONOS
privIsee is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in data centers within the EU. IONOS processes the data described in sections 3.1 and 3.4 on our behalf under a data processing agreement (Art. 28 GDPR).
4.2 Map tiles — Esri
On the share page, the map background is loaded from Esri’s ArcGIS servers (server.arcgisonline.com; Environmental Systems Research Institute, Inc., 380 New York Street, Redlands, CA 92373, USA). To show the map, the viewer’s browser requests the map tiles around the shared position. This means Esri can infer the approximate area being viewed (but not who is sharing it, and not the exact coordinates). Data may be transferred to the USA. Esri’s privacy statement: esri.com/privacy.
4.3 Map library — unpkg
The share page loads the open-source map library Leaflet from the content delivery network unpkg (unpkg.com), which is operated on the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Data may be transferred to the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Privacy policy: cloudflare.com/privacypolicy.
4.4 Fonts — Google Fonts
The fonts “Space Grotesk” and “Space Mono” are loaded from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. Privacy policy: policies.google.com/privacy.
4.5 Directions and sharing
On the share page you can request directions to the shared position. On Android this opens your device’s map app via a geo: link; on other devices it opens openstreetmap.org (OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) with the position as destination. This only happens when you tap the button, and the position is then handled under the privacy policy of that app or website. When you copy or share your link, your device’s system share sheet or clipboard is used; the link is passed to whichever app you choose.
4.6 Video — YouTube
The start page offers a video hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is not loaded automatically: only when you click “Load video” is it embedded in privacy-enhanced mode from youtube-nocookie.com. From that moment your browser connects to YouTube/Google servers, which receive your IP address and the usual request data and may store information on your device. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. Legal basis is your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG), given by clicking the button; it applies only to the current page view. Alternatively you can open the video directly on youtube.com via the link provided. Privacy policy: policies.google.com/privacy.
5. Purposes and legal bases
- Providing the location-sharing service (sections 3.1–3.3): Art. 6(1)(b) GDPR — performance of the service you request.
- Access to your device’s location: your consent through the operating system/browser permission (Art. 6(1)(a) GDPR; § 25(1) TDDDG), which you can withdraw at any time.
- YouTube video (section 4.6): your consent by clicking “Load video” (Art. 6(1)(a) GDPR; § 25(1) TDDDG). Reload the page to withdraw it for future page views.
- Local storage: strictly necessary to provide the service you explicitly requested (§ 25(2) no. 2 TDDDG).
- Server log files, map tiles, map library and fonts (sections 3.4, 4.2–4.4): Art. 6(1)(f) GDPR — our legitimate interest in a secure, reliable and usable service.
We do not use your data for advertising, profiling or automated decision-making, and we do not sell it.
6. How long we keep data
- Encrypted location: only the most recent position is kept; each update overwrites the previous one. Once a share is stopped or expired, no further updates are accepted and the share page shows it as ended.
- Share records (section 3.1): permanently deleted by an automatic hourly job once they have been expired for more than one month.
- Local storage (section 3.3): until you stop the share (active share) or clear your browser/app data (device ID).
- Server log files (section 3.4): see above.
7. Security
All connections use HTTPS (TLS). Locations are end-to-end encrypted with AES-256-GCM using the cryptography built into your browser/operating system (Web Crypto API), with a fresh random IV for every update. Even someone with full access to our database cannot read your position without the key in your share link. Please keep in mind that anyone who obtains your full share link — for example by forwarding — can see your location until the share ends.
8. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future.
Because privIsee has no accounts, we cannot identify you on our own. To exercise your rights regarding a share, please send us the share link or share ID. You can end a share yourself at any time by tapping Go dark, and remove all local data by clearing your browser or app data.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement.
9. Children
privIsee is not directed at children under 16. Parents and guardians should be aware that the service shares a device’s live location with anyone holding the link.
10. Changes to this policy
We may update this policy when the app or the legal requirements change. The current version is always available at this address, with the date of the last update shown at the top.
11. Contact
For any questions about privacy, contact us at app@seleven.de.
[ ← back to privIsee ]