1. Controller
Michael Pfister Mühle 13 3177 Laupen BE Switzerland Email: michael (at) mp-development.de
This site runs on a server in the Nuremberg data centre park of
Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen Germany
Hetzner provides the machine and processes the data arising from that as a processor under Art. 28 GDPR, on the basis of a data processing agreement. No further processors are involved: the application, the routing and the mail sending all run on this one server.
Which law applies. The controller is resident in Switzerland, the site addresses people in the EU, and the processing takes place on a server in the EU. Both the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP) therefore apply. This notice states the legal bases under the GDPR; the corresponding provisions of the FADP are met along with them.
2. When you open a page
On every request the server processes technical data your browser sends: IP address, date and time, the address requested, the amount of data transferred, the status message, the referring page and the browser identifier. This data is needed to deliver the page, and beyond that it serves to detect faults and attacks.
The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is running the site securely. Server logs are deleted after 7 days.
3. Cookies and storage on your device
This site uses no cookies for advertising, audience measurement or analytics. What is stored is only what is needed to run the site or what you set yourself:
| Name | Purpose | Duration |
|---|---|---|
csrftoken |
protection against form forgery | 1 year |
sessionid |
keeps you signed in, only while you are | 2 weeks, or until you sign out |
django_language |
the language you chose, only if you switch | 1 year |
dc_map_consent |
your decision about map material (section 4) | 1 year |
dirtcompass:baselayer |
the base layer you chose, in the browser's local storage | until you clear it |
All of this is strictly necessary to provide the service you asked for, in the sense of § 25 (2) TDDDG, and needs no consent. The legal basis for the associated processing is Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) GDPR for signed-in users.
4. Map material from other providers
The maps on this site load their tiles from OpenStreetMap, OpenTopoMap and Esri. Your browser fetches those tiles itself and thereby transmits your IP address to the provider in question — together with anything that provider has previously stored in your browser.
None of this happens before you agree. Where the map would be, there is
first a notice with a button; only when you use it is map material loaded.
Your decision is kept in the dc_map_consent cookie. Under every map there is
a way to withdraw it — after which nothing is loaded again.
The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw it at any time with effect for the future.
The providers are:
- OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom — https://osmfoundation.org/wiki/Privacy_Policy
- OpenTopoMap — https://opentopomap.org/about
- Esri Inc., 380 New York Street, Redlands, CA 92373, USA — https://www.esri.com/en-us/privacy/overview
With Esri, data is transferred to the USA. Whether and on what footing that is permissible turns on the provider's certification under the EU-US Data Privacy Framework; independently of that, access by US authorities to such data cannot be ruled out. That is precisely why nothing loads until you have agreed.
5. Place search
When you search for a place on a map, your query goes to my server and from there to Nominatim, the search service of the OpenStreetMap Foundation. Nominatim learns the search term but not your IP address — only my server appears to the outside. Results are cached on my server for one day; what is stored is the search term, not who searched for it.
The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is running the search while passing on as little data as possible.
6. Route calculation
Routing runs on a server of my own (BRouter) in the same environment. The waypoints you place do not leave my infrastructure and are passed to nobody.
7. Account
For an account I process: username, email address, the password solely as a non-reversible hash, the time of registration and of confirmation, and your settings — time zone, language, units, planning defaults and, if you set one, a starting position for the map. First and last name are optional; running the site does not need them.
The purpose is providing the account; the legal basis is Art. 6 (1) (b) GDPR.
Your address is confirmed before the account works. After you register I send you a link, and until it is followed the account stays switched off. Accounts not confirmed within 14 days are deleted.
8. Routes, waypoints and GPX files
The routes you save belong to your account: name, description, the track including elevation, waypoints, tags and the figures derived from them. An uploaded GPX file is read and its track stored; the file itself is not kept.
Track data shows where you have been or intend to go. It is visible to you alone. There is currently no way to publish or share a route.
9. Emails
I send email only for a reason: to confirm your address, to reset your password, to confirm a change of address, and to notify the previous address when the address is changed. There is no newsletter and no advertising.
Sending runs over a mail server of my own; no mail provider is involved.
10. Contact form
The contact form lets you write to me without having an account. Name, reply address, subject and message are sent to me as an email and are not stored on the server — there is neither a database table nor a file for them. What happens to the message afterwards happens in my mailbox: I keep it while the matter is open and delete it after that.
Your address is used to answer you and for nothing else. The legal basis is Art. 6 (1) (f) GDPR — the legitimate interest being to answer an enquiry at all; where the matter concerns a contract or your account it is Art. 6 (1) (b) GDPR.
11. Protection against abuse
Registration, sign-in, address changes, the contact form and the sending of confirmation and reset emails are limited in number, so the forms cannot be used as somebody else's postbox. For this your IP address is held, together with the address concerned, in a cache for the length of the respective window — between one minute and one hour depending on the action. After that the entry expires by itself; it is not stored permanently and not evaluated.
The forms also carry a field invisible to people and a signed timestamp, to recognise automated submissions. A third-party service — a captcha, say — is deliberately not used, because it would hand every visitor to another company.
The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is protection against abuse.
12. Error notifications
When a server error occurs I receive an email with the technical report. It may contain the address requested, the IP address and details about the browser. Passwords and comparably sensitive form fields are masked in it. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is noticing errors at all.
13. How long data is kept
- Account data, routes and settings: until you delete the account.
- Unconfirmed accounts: 14 days.
- Server logs: 14 days.
- Abuse-protection entries: one hour at most.
- Cached search results: one day.
- Contact form messages: not on the server at all; what sits in my mailbox is deleted once the matter is settled.
14. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent once given can be withdrawn at any time with effect for the future.
Two of these you can exercise yourself, without asking me:
- Data portability — under Account → Export my data you get a ZIP archive with all account data as JSON and every route as a GPX file.
- Erasure — under Account → Delete account your account is deleted immediately and for good, with every route and waypoint. It cannot be restored afterwards; export first whatever you want to keep.
For anything else, a message to info (at) dirtcompass.de is enough.
You also have the right to complain to a supervisory authority. In the EU that is the authority where you live or work; the European Data Protection Board lists them at https://edpb.europa.eu/about-edpb/board/members_en. In Switzerland it is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — https://www.edoeb.admin.ch.
15. Changes
I update this notice when something described here changes about the site. Last updated: 23 August 2026.