Privacy statement

Who we are, and what this covers

GeoQuestly is a location-based social app made by Mandrill Software GmbH. This statement covers both this website and the GeoQuestly app, because they are one service to the person using them.

The short version: location sharing is off until you switch it on, you decide who sees you and how precisely, and you can stop at any moment. Following somebody is not the same as seeing where they are — those are two different things in GeoQuestly, and they always have been.

We do not sell personal data, we run no advertising, and there is no tracking across other websites or apps. Everything below was written from the source code and configuration of the product rather than from what a privacy statement usually says.

This website

The website is a set of pages built in advance and delivered by a web server. There is no account, no contact form, no comment function and no shop.

It sets no cookies. It contains no analytics, no advertising and no social-media buttons, and it loads no fonts, scripts or images from anybody else — everything comes from the same address you are reading.

It stores exactly one thing in your browser:

• a single entry named geoquestly.locale, holding a two-letter language code such as "de" — and nothing else,
• it is written only when you pick a language yourself from the language menu,
• it stays on your device, is never sent to us, and contains no identifier of any kind,
• clearing your browser’s site data removes it, after which the site follows your browser’s language again.

That entry exists so you do not have to choose your language again on every visit. Technical connection data — your IP address, the time, the page requested — is necessarily processed by our hosting provider in order to deliver the page to you. We have not enabled log collection for the website and we keep no visitor statistics.

Your account

Signing in runs through Microsoft Entra External ID, a Microsoft identity service. Your credentials are handled there; GeoQuestly never sees your password.

What GeoQuestly’s own database holds about your account is:

• a GeoQuestly user id, your display name and your handle,
• the identifiers that link your account to the directory that authenticates you,
• your account status and the dates it changed — activated, deactivated, deletion requested,
• your devices: an installation id, the platform, an optional device name, the app version and when it was last seen.

GeoQuestly does not store your e-mail address. It exists in the Microsoft directory that signs you in; the app neither reads it from the sign-in token nor saves it.

A profile picture you upload is stored in our media storage under your user id, and is replaced or removed when you change or delete it.

People, groups and events

GeoQuestly is a social app, so it holds the connections you make in it:

• friendships, and friend requests you have sent or received,
• who you follow and who follows you,
• the groups you belong to and your role in them,
• event invitations and whether you accepted them.

Who can see a group, an event or a post is decided by that item’s own settings and by whether you are a member — checked on every request against the current, committed state, never against a remembered answer.

What you write and share

Posts, chat messages, group chats and the media attached to them are stored so that the people they are meant for can see them:

• the text of posts and messages,
• pictures and other media you attach,
• reactions, hashtags and mentions,
• which conversations you have read.

The text of chat messages and posts is encrypted where it is stored, so it is not readable in the database itself.

If you deliberately attach a place to a post or a message, that place is part of the content you posted and is visible to whoever the post is visible to. That is a separate decision from live location sharing, which the next section describes.

Location

Location sharing is off until you switch it on. Nothing about your position is shared, stored or shown to anybody before you do.

When you switch it on, four things are yours to decide: whether it is on at all, for how long, who can see you — the groups you tick and your friend settings — and how precisely, from your exact position to a coarse area to nothing at all.

The precision somebody actually receives is the lowest of three limits: how precisely your device was allowed to measure, the limit you set, and what that person is entitled to. A recipient can never raise it.

Following somebody does not let you see where they are. Location sharing is its own decision, made by the person being shared, and being followed has never been a part of it.

If you allow it, the app can receive positions while it is in the background or your screen is off. That is what makes shared location keep working when you put your phone in your pocket, and both iOS and Android show you that it is happening. You can withdraw the permission at any time in your device settings, and you can switch sharing off in the app without touching the permission at all.

While you are sharing, this is what exists:

• your current shared position, in a short-lived cache that expires after about 30 minutes and is replaced by each new position,
• one checkpoint of your latest shared position on your sharing record, written at most once every couple of minutes, so that a recipient still sees something if the cache is lost,
• the audience and the duration you chose,
• whether the app is currently open, which expires by itself shortly after the app stops saying so,
• whether you are currently moving, which is a short-lived state and not a route.

GeoQuestly does not keep a location history. There is no trail, no table of past positions and no record of where you have been — what exists is your latest position while you are sharing, and the checkpoint carries the time it was actually measured, so a position twenty minutes old says so rather than pretending to be current.

When you switch sharing off, or the duration you chose runs out, the switch, the audience and the stored checkpoint are cleared together in a single step, and the short-lived copy expires on its own.

Arrival and departure alerts

A place in GeoQuestly can notify somebody when a person arrives at it or leaves it. There are two kinds: an alert a group’s managers set up for that group, and a personal alarm you set for yourself.

Both are worked out from a position you are already sharing. There is no separate tracking, no second permission and no additional collection: if you are not sharing your location with the group or the person concerned, nothing is evaluated. Sharing is the permission.

A group alert notifies the people the group’s configuration names; a personal alarm notifies you and nobody else. The records of the arrivals and departures they produce are kept for a limited period — currently seven days — and then removed automatically.

Push notifications

If you allow notifications, your device gives the app a delivery address for them. We store:

• the push token issued by Apple or Google, which is a delivery address and changes over time,
• an installation id, the platform and the app language, so the notification arrives in the right language on the right device,
• when the device was last seen.

Notifications are delivered through Azure Notification Hubs, which passes them to Apple or Google for delivery to your device. Who receives a notification is worked out from our own database at the moment of sending, never by the notification service. A notification tells the app where to look; the app then loads the content itself, with your session and your permissions.

AI-assisted drafting

GeoQuestly has an assistant that helps an administrator draft a group or a set of events: they write a brief, optionally attach a document, and get a draft back.

What is sent to the AI provider for such a run is:

• the brief the administrator wrote and the region they named,
• any document they attached — a PDF, a picture, a page,
• the language of the request and its technical instructions,
• nothing else.

The providers currently used are Anthropic and OpenAI; the person starting the run chooses which. The request may include a web search performed by the provider. GeoQuestly then checks the places the model proposed against map data sources, and a person opens the result in the ordinary editor and decides what, if anything, to save.

What is not sent is everything else: no account data, no friend lists, no messages, no positions, and nothing about the people who will later see the group or event.

The assistant never publishes anything by itself. Every group and every event is created by a person pressing save in the same editor used for one written by hand. Attached documents are removed automatically when they are not used — currently after 48 hours, or after 6 hours for a run that produced no draft.

Maps and other services your device contacts

A map is drawn from tiles published by other organisations, and your device fetches them directly from those organisations. That is how maps work, and it means those organisations see the request:

• base maps from OpenStreetMap, OpenFreeMap, Esri and CARTO,
• the optional Swiss overlays — swisstopo and geo.admin.ch, the federal offices for environment and roads, MeteoSwiss, Basel-Stadt, Basel-Landschaft and geodienste.ch — which are switched off unless you switch them on,
• GIPHY, when you open the GIF picker in a chat or a post. GIPHY requires apps to call it directly and does not permit us to fetch on your behalf,
• what any of them can see is what any web request shows: your IP address, what you asked for, and your device’s technical request data.

Other lookups run on GeoQuestly’s own servers rather than on your device, so you do not contact those providers and your IP address does not reach them: searching for places and addresses (Photon), calculating routes (OpenRouteService), checking places proposed by the AI assistant (Nominatim, Overpass) and finding pictures of places (Wikimedia Commons).

All of these organisations are independent of us; their own terms and privacy statements apply to what they do with a request they receive.

Switching an optional overlay off stops the requests for it, and not opening the GIF picker means no request is made to GIPHY at all.

Where your data is, and who processes it

GeoQuestly runs on Microsoft Azure. Mandrill Software GmbH remains responsible for your data; Azure processes it on our instructions and for no purpose of its own.

Where the parts of the service run:

• the application database, holding your account, content and sharing settings — Switzerland (Switzerland North),
• the cache and the real-time connection that keeps the map live — Switzerland (Switzerland North),
• media storage for pictures and attachments — Switzerland (Switzerland North),
• push delivery — Switzerland (Switzerland West), and from there to Apple or Google,
• sign-in through Microsoft Entra External ID — the directory is registered for Switzerland, and Microsoft holds its identity data in its European region.

Some data necessarily leaves Switzerland: to Apple and Google when a notification is delivered to your device, to the AI provider when an administrator starts a draft, to the map and GIF providers your own device contacts, and within Microsoft’s European infrastructure when you sign in.

Switzerland recognises the EU and EEA states as providing an adequate level of data protection, and since 15 September 2024 also the United States for companies certified under the Swiss–U.S. Data Privacy Framework.

If you would like to know which safeguard applies to a particular transfer, ask us and we will tell you.

How long things are kept

Data is kept for as long as it has a purpose, and no longer:

• your account, profile, posts, messages, groups and events: while your account exists, or until you delete them,
• your shared position: the short-lived copy expires after about 30 minutes, and the checkpoint is cleared the moment you stop sharing,
• whether the app is open: a few minutes after it stops saying so,
• arrivals and departures recorded by location alerts: currently seven days,
• documents attached to an AI draft: 48 hours if they are never used, 6 hours if the run produced no draft.

Anything not listed above is kept while it serves the purpose described in this statement, and is removed when you delete your account.

Your rights

Under Swiss data protection law you can ask us for the following, free of charge:

• access: confirmation of whether we process data about you, and a copy of it,
• correction of data that is inaccurate,
• deletion of your account and the data belonging to it,
• to object to a particular processing, or to withdraw a permission you gave — switching location sharing off is exactly that,
• in certain cases, to receive the data you provided in a common machine-readable format.

Much of it you can do yourself, without asking anybody: edit your profile, delete your own posts and messages, leave a group, switch location sharing off, and delete your account permanently under "Account" in the app. Deleting your account removes your GeoQuestly data and your GeoQuestly sign-in account; it does not delete an account you may hold with a provider you used to sign in.

For anything the app cannot do — an access request, a correction we have to make for you — write to us. We may have to ask you to identify yourself first, because handing your data to the wrong person would be the worse mistake.

Until a dedicated address is published, requests can be addressed to Mandrill Software GmbH through mandrill.software.

Security

The measures that matter most here, at a level it is sensible to state publicly:

• everything between your device and our servers travels over encrypted connections,
• the content of messages and posts is additionally encrypted where it is stored,
• whether somebody may see something is decided on every single request from the authoritative database, never from a cached answer that could have gone stale,
• sign-in is handled by Microsoft’s identity service, so your password never reaches GeoQuestly.

No system is perfectly secure, and we do not claim otherwise. If a breach of data security occurs that is likely to result in a high risk to your personality or fundamental rights, we will report it to the Federal Data Protection and Information Commissioner as soon as possible, and inform you where the law requires it or where it would help you protect yourself.

Changes to this statement

GeoQuestly is being actively developed, so this statement will change as the product does. The current version is always the one on this page.

The version and date at the top say when it last changed. A change that materially affects how your data is used will be pointed out in the app rather than left here to be discovered.