Privacy policy

Last updated: 24 October 2026

Deutsche Fassung: Datenschutzerklärung

This policy explains which personal data Corner Society handles when you use the website and the iPhone app, why, for how long, and what rights you have. It follows Articles 13 and 14 of the General Data Protection Regulation (GDPR). We try to say things in plain words and only describe what the software really does.

1. Who is responsible

Questions about your data and requests to use your rights go to the e-mail address above (see also the support page).

2. The short version

• You need an account (e-mail address, public username, password). Your password is stored only as a hash.
• Guidance happens on your phone; your position goes to the Corner Society server to plan a route from where you are, to show the driving weather and what is near you on Home, Discover and in search, to show you to the members of a convoy, but only while you have sharing switched on, and, for every drive you navigate, as the track of that drive after it has ended, to count its kilometres and corners, award badges and, only if you take part, rank you on the leaderboards (the server keeps these totals and the German states you drove in, not the track).
• There is no advertising, no analytics and no tracking, in the app and on the website. The website sets one cookie that it needs to keep you signed in and, only if you choose a language there, a second one that remembers your choice (7).
• If you report a closed road, other users see the report without your name. It is deleted 30 days after it ended, or with your account.
• If you report a danger on the road (an accident, an obstacle, a breakdown or a traffic jam), other users see the report without your name for about four hours. On a tour, its members see your username next to it in the tour chat and are alerted with a sound.
• You can join tours that organisers publish. A join request is a message to the organisers; they see your username, your message and the car you choose for the tour from your garage (you do not have to choose one), and the other members of a tour see your username and that car, also if it is not shown on your profile. Payments are agreed with the organiser and are not handled by Corner Society.
• You can send friend requests. Friends are people who accepted each other’s request, and a request can carry a first message. Following someone is separate: it needs no approval and makes nobody a friend. Your friends and your requests are visible only to you.
• You can write text messages to your friends and to the organisers of a tour. Only the people in a conversation read it; administrators read a message only when someone has reported it.
• Every tour has a chat for the people who belong to it: its organisers and everyone who was accepted. They write messages, send photos and read the organisers’ announcements; nobody else reads it, organisers and administrators can remove messages, and the chat is deleted six months after the tour has ended.
• Every tour has one convoy for its whole length. In it your position is shared only while you navigate in the app, or after you have switched sharing on yourself – not overnight and not at the hotel – and only with the members of the tour.
• Members of a tour can add photos to it, and organisers publish photos of their tour. We remove the location data and every other hidden detail from each photo when it is uploaded. The members’ photos are seen by the members; the promotion photos of an organiser and the photos an organiser has made public are seen by everyone who can see the tour. Whoever added a photo can delete it at any time, and the members’ photos are deleted automatically 12 months after the tour has ended.
• The menu that opens when you click the map has a Street view button, which shows Apple’s street-level photographs of the road. Nothing is loaded from or sent to Apple until you open it; then Apple receives the place you look at, your IP address and technical data of your browser or phone, but no data of your Corner Society account.
• You can keep a garage of your cars, with pictures. It is private; a car you put on your profile is shown, with its kilometres and corners, to everyone with an account. The app sends the track of every navigation drive, with a car or without, so that the server can count the kilometres and corners; only these totals are kept, never the track. You are on a leaderboard only if you switch it on (3.17).
• You can delete your account yourself at any time. It removes you and everything you created, immediately and for good.

3. What data we process, and why

3.1 Your account

• E-mail address: to sign in and to tell you apart. It is never shown to other users. (Anyone who already knows your exact e-mail address can find your profile by typing it into the people search or into a route invitation. That is how inviting someone by e-mail address works.)
• Username: your public name. Other users see it, and it is part of the link to your profile.
• Password: stored only as a salted hash (Argon2). We cannot read it.
• Profile picture and biography: optional, shown on your public profile. The profile picture can be fetched without signing in by anyone who knows its address. You choose the square part that is shown; the whole picture is kept so that you can change that part, and only you can open it.
• Language: optional. If you choose a language for your account on the website (Settings › Language), it is stored with the account, so that the website, the answers of the server to the app, your notifications and the texts sent to your phone use it. Without a choice, the language your browser or phone asks for is used for each visit and nothing is stored in your account.
• First and last name, postal address, country: optional, in the website settings. They stay private; no other user sees them.
• Technical account data: when the account was created, when you last signed in, when the password last changed.
• App sign-in token: when you sign in on the iPhone, or create your account there, the server issues a token. It stores only a hash of the token, the device name the app reports, and when it was created and last used. A token you sign out of is marked as revoked.
• Sign-in protection: after failed sign-ins the server keeps a counter, tied to a hash of the e-mail address and a hash of the IP address, to slow down password guessing. It is cleared by a successful sign-in. Creating accounts in the app is limited too: the server counts the requests per IP address over the last hour, in its memory only (nothing is written to the database, and a restart clears it).

Purpose: provide your account and the service you ask for (Art. 6(1)(b) GDPR) and protect it against misuse (Art. 6(1)(f)).

3.2 What you create

• Routes with their name, description, waypoints, calculated line, distance and time, optional cover photo and optional event details (meeting point, notes, stops, participants you type in); folders that organise your routes; journeys (several routes in a row) with an optional cover photo.
• Highlights (favourite spots and road sections) with description, category, optional photo and your username as author; the star ratings you give to highlights.
• Comments on routes (stored with your username) and likes on routes and highlights.
• Follows (who you follow, who follows you) and shares of routes and journeys with other people.
• Notifications in the app and on the website (who did what, for example “started following you”), with their read state.

Purpose: this is the service itself (Art. 6(1)(b) GDPR). Routes and journeys are private until you choose to share them or make them public.

3.3 Location, and convoys

The iPhone app asks for your location (“While Using”, with Precise Location). It uses it on the phone to show where you are on your route, to give turn-by-turn directions and to notice when you leave the route. This also works with the screen locked while you navigate. Guidance happens on your phone; your position goes to the Corner Society server to plan a route from where you are, to show the driving weather and what is near you on Home, Discover and in search, to show you to the members of a convoy, but only while you have sharing switched on, and, for every drive you navigate, as the track of that drive after it has ended, to count its kilometres and corners, award badges and, only if you take part, rank you on the leaderboards (the server keeps these totals and the German states you drove in, not the track; see 3.16 and 3.17).

• Planning from where you are: the position travels in the planning request. It is not stored on its own. If you save the route, its waypoints, including a start point that came from your position, are stored as part of the route.
• Convoys (group drives): a convoy has a name, an optional start time, an optional shared route or journey, a leader and members. For each member the server stores the name, the role, whether the invitation is pending, accepted or declined, and whether position sharing is switched on.
• While you are an accepted member of a running convoy and sharing is on, the server stores your latest position (latitude, longitude, direction, speed, accuracy and the time of the fix). There is only one position per member; each new one replaces the previous one. No track or history is kept. The other accepted members of that convoy see it.
• When it is erased: as soon as you pause sharing, when you leave or are removed from the convoy (your entry is deleted), when the convoy ends (the leader ends it, or it ends by itself 24 hours after its start; the server applies this rule when someone next opens or lists the convoy), and when you delete your account. If your phone simply stops sending (for example the app is closed), the last position stays until one of these happens, and other members see it marked as outdated after two minutes.
• After a convoy has ended, its name, time and member list stay so that members can see that it ended. No position is kept. Your entry goes when you leave or delete your account.
• The website asks your browser for its position only if you switch on position sharing in the Convoy panel; it is then handled exactly like the app’s.
• The convoy of a tour: every tour has one convoy, made by the server when the tour starts and ended at the end of the tour’s last day (or when the tour is cancelled) – it does not end after 24 hours. Its leader is the organiser; its members are the accepted members of the tour, added and removed with their place in the tour, without an invitation. Sharing your position is off by default. It is on only while you navigate in the app (any drive; the app tells the server when a drive starts and ends, and the sharing lapses on its own ten minutes after the last position your phone sent) or after you switched it on yourself; if you switch it off, or the drive ends, it stops and your stored position is erased. Nothing is shared overnight or at the hotel unless you switched it on. The members of the tour see your latest position; the other rules above apply (one position, no track).

Purpose: guidance happens on your phone. The uses of the server are features you start yourself (Art. 6(1)(b) GDPR); the permission you give to the phone is your consent (Art. 6(1)(a)). You can withdraw it at any time in iOS Settings › Privacy & Security › Location Services › Corner Society.

Home, Discover and search. When you use Home, Discover or the search, the app sends your position (or the place you pick as your area) to the Corner Society server: to show the driving weather and the tours, routes, highlights and pictures near you, and to sort places by distance. The server answers the request and keeps no record of the position: only the request log (3.6) holds it, and the answer made for you stays in the server’s memory for a few minutes. For the weather, the server asks MET Norway (the Norwegian Meteorological Institute) for a forecast and the place-search service of the OpenStreetMap Foundation (3.5) for the name of the area, each with your position rounded to a grid of about 5 kilometres; neither receives your IP address or anything about your account, and the forecast and the name are kept on the server for a while, not linked to you. Without the location permission these screens work without what depends on where you are. Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR); the permission you give to the phone is your consent (Art. 6(1)(a)).

The app also asks for access to the camera, only to scan another rider’s profile QR code. Nothing is recorded or saved.

3.4 Notifications to your phone

If you allow notifications in the iPhone app, the server stores a device token (an address Apple gives your phone), the platform, whether it is a test or production build, the language of the app (so that notifications can be written in it) and which kinds of notification you switched on. When something happens that concerns you (a new follower, a friend request or its acceptance, a route shared with you, a convoy invitation or update, the answer to your request to join a tour or an invitation, a change to or the cancellation of a tour, a new message, a message in the chat of a tour, an announcement of an organiser, a picture of your car that an administrator removed after a report or a badge you earned), the server sends a short text to Apple’s push service, which delivers it to your phone. That text can contain the username of the other person, the name of the route, convoy or tour, the name of your car, the name of a badge and, for a message, the first 80 characters of the message (for a friend request: of its message) – so this preview passes through Apple’s push service (see 6). Several messages in a tour chat are bundled into one notification (“3 new messages in Sunday ride”), and a newer notification replaces the older one on your phone. An organiser’s announcement and the cancellation of a tour are marked as time-sensitive, which lets them through a Focus mode if you have allowed that for the app. In the app’s settings you choose which kinds of notification you get, and you can mute a single conversation or a tour’s chat. While a tour you belong to is under way, a danger report or a request to regroup by another member of the tour is sent to you at once, as time-sensitive and with a distinct sound; it names the sender, the kind of danger and the tour, and it cannot be switched off or muted. When an organiser switches the route of the tour’s convoy, you get a short notice with the name of that route. If you switch on Tour weather in the morning in the app’s settings (it is off unless you do), you get a notification on each driving day of a tour you belong to, with the weather of that day along its route: the start and the destination, the temperatures, rain, frost and wind (see 3.9). The text is written in the language of your account if you chose one, otherwise in the language of the app. The device token is removed when the app removes it, when Apple reports it as no longer valid, and when you delete your account.

Purpose: Art. 6(1)(b) GDPR for the notifications you asked for; the permission you give on the phone is your consent (Art. 6(1)(a)), which you can withdraw in iOS Settings › Notifications › Corner Society.

3.5 Searching places and planning routes

When you search for a place, the server forwards your search words to the place-search service (Nominatim) run by the OpenStreetMap Foundation. Your IP address is not passed on; the request comes from the Corner Society server, which also tells the service your language setting. To avoid asking twice, the server keeps the search words and the results in a cache and reuses them for 30 days. The cache is not linked to your account. The same service is asked for the name of the area on the weather card of Home (3.3): that request carries your language setting and a position rounded to a grid of about 5 kilometres, not your IP address, and the name is kept in the same cache. The same lookup gives a name to a place of the weather of a tour (3.9) that has none.

Routes are calculated by a routing engine that runs on the Corner Society server. To score how winding and scenic a road is, the server reads road properties (surface, speed limit, road class) from a local copy of OpenStreetMap data. If the operator has not installed that copy, the server instead asks the OpenStreetMap Foundation’s data interface for the map data of the area around the route or the road you looked at; that request contains map-area coordinates and the server’s address, not your account or your address.

When you click the map in the route planner on the website, or tap it in the route editor of the app, the server looks up the road nearest to that point in its own routing engine, so that the place can be named and put on the road. Only the coordinates of the point are sent, to the Corner Society server, which stores nothing about them apart from the request log (3.6); nothing goes to other services.

3.6 Technical data and logs

Like every web server, ours writes a log of requests: date and time, the requested address (which can include the words of a place search or the coordinates of a road you looked at or of a place you clicked on the map), the response code and size, and the IP address as the server or the proxy in front of it sees it. We use the logs to keep the service running and secure and to find faults. They are kept for 14 days and then deleted. Purpose: Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable service).

3.7 Road closure reports

Drivers can tell each other that a road is closed. A closure you mark in the route planner is shared with the other drivers unless you switch that off (the switch is on by default); so is a closure you report in the app during a drive (“Report closure ahead”). The server then stores a report:

• What it holds: the place of the closure (a circle, or a stretch of road between two points, with its radius; in the app during a drive, a place on your route a short way ahead of you), an optional end date and an optional short note (up to 200 characters) that you type yourself, the time of the report and of its latest confirmation, and the answers other drivers give to it (“still closed” or “open again”, one per driver, with the time). Your own position and your track are not part of it.
• Who sees it: everyone with an account sees the active reports on the map, without your name: they see when a report was made and how often it was confirmed, not who made it. Administrators of this service also see who made a report, so that they can remove false or abusive ones. The answers you give to other people’s reports are shown to others only as totals.
• How long it is kept: a report is active until its end date (through the end of that day, UTC) or, without an end date, for 24 hours after it was made or last confirmed. It ends earlier when it is resolved: when you or an administrator remove it, when you say the road is open again, or when two other drivers do. 30 days after it ended or was resolved, it is deleted together with all answers to it (the server applies this rule when reports are next listed or created). It is also deleted when you delete your account, together with the answers you gave to other people’s reports.

Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR). Administrators can see who made a report to protect the service and the other drivers from false or abusive reports (Art. 6(1)(f)).

3.8 Organiser requests

Anyone with an account can ask to become an organiser, which allows them to create and publish tours. The server then stores the request: your short message (up to 1,000 characters) about the tours you plan, the time of the request, its state (pending, approved or declined) and, once an administrator has decided, who decided, when, and the note they gave. The administrators of this service are told about a new request and decide on it; you see your own latest request, its state and the note. An administrator can also give or take back the organiser role without a request; that is stored as a mark on your account. Requests are kept until you delete your account.

Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR). Administrators decide who may publish tours to other users to protect them from misuse (Art. 6(1)(f)).

3.9 Tours

A tour is a trip of one or more days that an organiser plans and offers to other users. The organiser enters a title, a short summary, a description, the dates and time zone, a meeting point (a name, a place on the map and a time), the number of places, a price (it is only shown; Corner Society takes no payments and handles no bookings) and contact details (name, e-mail address, phone number, website), and for each day a title, a text, one or more of their saved routes and a timetable.

• What organisers publish: A tour is public (everyone, also without an account, sees its page and finds it in the list of tours), unlisted (everyone who has the link sees the page) or private (only members, applicants and invitees). The page shows everything the organiser entered, including the contact details, the organiser’s username, and for each day the whole timetable and the routes. While a public or unlisted tour is published and not cancelled, everyone who can see its page also sees its routes in full – the whole line on a map, the stops with their planned times, the distance and times and the cover picture of each route (which anyone who knows its address can open), but not the description or the notes the organiser wrote for a route. A visitor can open a route to look at it; saving a copy, downloading it or navigating it needs an account. The routes of a private tour, of a draft, of a cancelled tour and of a tour an administrator took offline are visible to the members of the tour only. The routes stay with the organiser, and nobody else can change them. What organisers write about themselves or a company behind a tour, and the contact details they publish, is their own responsibility.
• On other websites: The organiser of a public or unlisted tour can show the tour on their own website. The page of that website then loads the tour from Corner Society, either in your browser (a small script from Corner Society, then the text and pictures of the tour) or through that website’s own server. It shows what any visitor sees on the tour page and nothing that is only for members. Loading it is an ordinary visit to the Corner Society server: your IP address and the address that was requested are in the server log (3.6). Corner Society sets no cookie for it, tracks nothing and passes nothing on. The organiser can limit which websites may show the tour. A route of the tour is shown on a map: for that your browser also loads map pictures from the map tile server named in section 6, which sees your IP address, the part of the map you look at and the website you are on. These requests do not pass through Corner Society.
• Joining: You join a tour by a request: a message of up to 2,000 characters to the organisers (it starts a conversation, see 3.10). The server stores your membership: the tour, your role, its state (requested, waiting list, accepted, declined, invited, left or removed), an optional car that you choose for this tour from your garage (the server stores which one; an older version of the app lets you type a vehicle, make and model, instead), when and by whom it was decided, and the reason if the organiser gave one. A person can be invited by an organiser as well. The same entry is used if you ask again later.
• Who sees what inside a tour: The organiser and the co-organisers see all requests, your messages, the decisions and the car you chose. The accepted members of a tour see each other’s usernames, profile pictures and the car each has chosen for the tour – its cover picture, make, model, year and name, nothing else of it –, also if the car is private in the garage; it is no longer shown when you leave the tour or are removed from it. Applicants and invitees see the tour page, their own state and their conversation with the organisers. Accepted members can open every route of the tour, also a route that is otherwise private, with the description and the notes the organiser wrote for it; this ends when you leave the tour, are removed from it, or it is cancelled.
• Notifications: you are told in the app, on the website and, if you allowed them, on your phone (3.4) when your request is accepted, declined or put on the waiting list, when you are invited, removed or added as a co-organiser, when a tour you belong to is changed (dates, days, routes, timetable), cancelled or taken offline, and about new messages (3.10) and the messages and announcements of a tour’s chat (3.12).
• Weather: From seven days before a day of a tour, the members and the organisers see the weather forecast for that day, on the tour page and in the app: at the start and at the end of the day’s routes, along them (about every 25 kilometres) and, on a rest day, for its place – the first place of its timetable, else the weather place an organiser named for the day (only the members and the organisers see it), else where the last day’s route ended. For this the Corner Society server asks MET Norway (6) for the forecast of those places: the positions of the tour’s points, each rounded to the centre of a grid cell of about 5 kilometres, and only while the day is within seven days; no IP address and nothing about a member goes along, and nothing is sent about where you are. A place without a name is named by the place-search service (3.5). The server keeps the answer in its memory for at most 30 minutes and stores no forecast. If you switch on Tour weather in the morning in the app (it is off by default), you get a short summary of the day’s weather as a notification on each driving day of a tour you belong to (3.4); the server then keeps for three days a note that it was sent to you, so that it is sent once.

Purpose: this is the service you asked for (Art. 6(1)(b) GDPR). Organisers decide for themselves what they offer and to whom; they are responsible for what they do with the data of their applicants and participants and for their legal information.

3.10 Messages, blocking and reports

You can write text messages (up to 2,000 characters; no pictures or files) in two places: to your friends (people who accepted each other’s friend request, see 3.14) and in the conversation with the organisers of a tour (your join request and everything after it, or a question you send from the tour page; an organiser can also write to their applicants, participants and invitees). Nobody else can write to you – except through the optional first message of a friend request (3.14).

• What is stored: each message with its author, its text and its time; the conversations and who belongs to them; for each member the message they have read up to and whether they muted the conversation; short notes of the system in a tour conversation (for example “Request accepted”); and whom you have blocked.
• Who sees it: only the members of a conversation: in a conversation with a friend the two of you; in a conversation about a tour you and all organisers and co-organisers of that tour (a co-organiser who is added later can read the earlier messages). The administrators of this service do not read messages, except a message that someone has reported (see below).
• Deleting and blocking: You can delete your own messages at any time: the text is erased at once and the others see “Message deleted”. If you block a person, they can no longer send you messages and you no longer see theirs; they are not told, and a block does not change anyone’s place in a tour. A block also ends a friendship (the conversation stays readable but takes no new messages) and deletes friend requests and follows between the two of you (3.14). Only you see your list of blocked people.
• Reports: You can report a message, a tour, a report on the map (a closed road or a danger, 3.7 and 3.13), a photo (3.11), the picture of a car on someone’s profile (3.16) or a person with a short reason (up to 500 characters). Administrators see who reported, the reason and what was reported; for a message the report keeps a copy of its text, for a report on the map a copy of what it said (the kind, the place, the times, the note and the username of the person who made it), for a car picture a copy of what it shows (the make, model, year and name of the car, the caption and the username of the person it belongs to), so that the administrator can decide even if the author deletes it meanwhile or the report on the map has ended. The administrator removes the content (a message is deleted, a tour is taken offline, a report on the map is ended, a picture is deleted) or dismisses the report, and you are told the outcome. The copy is deleted with the decision; who decided and when stays with the report.
• Notifications: a new message creates one notification per conversation until you have read it (in the app, on the website and, if you allowed them, on your phone). It names the sender and, for a tour, the tour – in the app and on the website not the text of the message. The notification on your phone also shows the first 80 characters of the message, which passes through Apple’s push service (3.4, 6).

Purpose: messages are part of the service (Art. 6(1)(b) GDPR). Reports let us protect users and the service from abuse and unlawful content and let administrators decide on them (Art. 6(1)(f)).

3.11 Tour photos

In the app or on the website, organisers can add promotion photos to their tour until it is over, and the members of a tour (organisers included) can add photos of the tour from the day before it starts until 30 days after it ends. A photo is a JPEG, PNG or WebP picture of up to 20 MB (the app and Safari turn an iPhone’s HEIC photo into a JPEG before it is sent).

The organisers of a tour can also give it colours and a logo. The logo is a picture of the same kinds, handled like a promotion photo: it is re-encoded without hidden details, shown to everyone who can see the tour page or its card, kept as long as the tour exists and deleted with the tour, with the account of the person who uploaded it, or when it is replaced.

• What is stored: the picture itself, re-encoded by the server in two sizes (a large one and a thumbnail) – the original file is not kept –, an optional caption (up to 500 characters) that you type, who added the photo and when, the day of the tour it belongs to, and the time the photo was taken if the picture says so. All location data and every other hidden detail of the picture (EXIF, such as the GPS position and the camera or phone model, XMP, IPTC) are removed on upload; only the time of shooting is read, to put the photo on the right day, and it is kept with the photo. A promotion photo that is the cover of the tour is also kept in four cover sizes (wide pictures cut to the parts you chose: two for the app and two, still wider, for the header of the tour page) together with those choices, eight numbers; the rest of the photo stays in the large size, so that you can change the parts later.
• Where: in a storage service that is part of the Corner Society server, not with a third party. The pictures are not reached by a link into that storage; the app hands them out itself, after it has checked who may see them.
• Who sees them: the promotion photos of a tour, and the photos an organiser has made public, are seen by everyone who can see the tour page – visitors without an account too, when the tour is public or unlisted (and anyone who knows the address of such a photo can open it). The other photos of a tour are seen by its accepted members, its organisers and the administrators only. The members see the username of the person who added a photo; visitors do not. An organiser can hide a photo from everyone but the organisers.
• Other people in a photo: photos can show people and vehicle registration plates. Only add photos you may share. If you are in a photo and do not want it to be shown, report it or ask the organiser to remove it.
• Deleting and reporting: you can delete your own photos at any time, the organisers can delete any photo of their tour and administrators any photo; both stored pictures are removed with it. You can report a photo you can see, with a short reason. Administrators then see the report, who made it, the reason and a copy of the photo’s caption and details (the picture itself only as long as it exists); they delete the photo or dismiss the report, and you are told the outcome.

Purpose: photos are part of the tour service you use (Art. 6(1)(b) GDPR). Reports let us protect users and the service from abuse and unlawful content (Art. 6(1)(f)). Organisers decide for themselves what they publish and are responsible for the rights to the photos they upload.

3.12 Tour chat

Every tour has one chat for the people who belong to it: its organisers and co-organisers and every participant who has been accepted. Applicants, invitees and visitors can neither read nor write in it. Members write text messages (up to 2,000 characters) and send photos; organisers also post announcements, which stay pinned above the chat until an organiser unpins them. A short line of the system says when somebody joins or leaves the tour.

• What is stored: each message with its author, its text and its time; for a photo the picture and its caption – a photo sent to the chat is also added to the tour’s photo album, on the day it was taken, and then follows everything said about photos in 3.11 (location data and other hidden details removed, kept for 12 months after the tour, deletable by you); which announcements are pinned; who removed a message; for each member the message they have read up to and whether they muted the chat; and the lines of the system, which name the person who joined or left (their username).
• Who sees it: only the members of the tour, with the username of each author. Somebody who is accepted later can read the whole history; somebody who leaves or is removed no longer sees the chat. The administrators of this service do not read the chat, except a message that someone has reported.
• Blocking: if you block a person, you no longer see their messages in a tour chat. They can still write to the group, and they are not told.
• Deleting, removing and reporting: you can delete your own messages at any time (the text is erased at once, the others see “Message deleted”). The organisers of a tour and the administrators can remove any message of its chat; the others then see “Removed by the organiser” or “Removed by an administrator”, and a removed photo is deleted from the album too. Every member can report a message, as described in 3.10; the report keeps a copy of its text until it is decided.
• How long: members can write from the day the tour is published until 30 days after it has ended; the chat is read-only afterwards and when the tour is cancelled. The chat – all its messages – is deleted six months after the last day of the tour (the server applies this rule when the chat is next opened and when it starts). The photos in it are not part of that deletion: as album photos they are deleted 12 months after the tour (3.11), or earlier if they are deleted.
• Notifications: members who have not muted the chat are told of new messages in the app, on the website and, if they allowed them, on the phone. Messages are bundled per tour (“3 new messages in Sunday ride”); an announcement is always a notification of its own. On the phone the notification shows the username of the sender and the first 80 characters of the message; this preview passes through Apple’s push service (3.4, 6).

Purpose: the chat is part of the tour service you use (Art. 6(1)(b) GDPR). Removing messages and handling reports let us protect users and the service from abuse and unlawful content (Art. 6(1)(f)). Organisers are responsible for what they announce.

3.13 Danger reports

While you drive, the app has a Report button: one tap tells other drivers about an accident, an obstacle or oil on the road, a breakdown, a closed road or a traffic jam – and on a tour it can also ask the group to wait at the next safe place (a regroup). Danger reports use the same service as road closure reports (3.7).

• What is stored: the kind of danger, a point on the road and the time. Your phone works the point out from its own recent track – a few metres behind where you are when you tap, because you have already passed it – and sends only that point, not your position, your speed or your track. The answers other drivers give to a report (“still there” or “gone”, one per driver, with the time) are stored with it. A second report of the same kind within 200 metres of an active one is not stored as a new report but counts as a “still there” of the first.
• Who sees it: everyone with an account sees the active danger reports on the map and in the warnings on their route, without your name; administrators see who made a report. If you report while you are on a tour that is under way, the members of the tour also see the report in the tour chat (3.12) with your username, its kind and its place, and are alerted at once (3.4). A regroup request goes to the tour chat only, not onto the map, and shows the tour’s members your position at that moment.
• How long it is kept: a danger report is active for 4 hours; every “still there” of another driver keeps it for 4 more hours from then, and the “gone” of two other drivers – or yours, if you made it – ends it. 30 days after it ended it is deleted with the answers to it (the server applies this rule when reports are next listed or created). Its message in a tour chat stays as long as the chat (3.12), unless you or an organiser remove it, and is deleted with your account.
• What you decide: nothing is reported automatically; a report is sent only when you tap. You can delete your own report at any time, and report a message in the tour chat as described in 3.10.

Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR). Administrators see who made a report to protect the service and the other drivers from false or abusive reports (Art. 6(1)(f)).

3.14 Friends and friend requests

Friendship is a deliberate step. You can send another user a friend request, with an optional first message (text, up to 2,000 characters); they accept or decline it. Following someone (3.2) is a separate, one-way thing: it needs no approval and does not make anybody a friend.

• What is stored: the request – who sent it to whom, when, and its state – with its message. Once the request is answered, withdrawn or has expired, it keeps no message. When a request is accepted, its message becomes the first message of the two friends’ direct conversation (3.10), and the friendship is stored (the two accounts and the time).
• Who sees it: a request and its message are seen only by the two people: the person asked sees it in their list of friend requests and in a notification. A decline is silent: the sender is not told, sees “Add friend” again and cannot send a new request to the same person for 30 days. Your list of friends is visible only to you; another person’s profile shows you how you stand to them (“Friends”, “Request sent”, “Wants to be your friend”) and their number of followers and of people they follow, not their friends. Unfriending is silent as well.
• How long: a request nobody answers expires after 90 days; an answered, withdrawn or expired request is deleted 30 days later (the 30-day wait after a decline needs it). A friendship lasts until one of the two ends it, blocks the other, or deletes their account. Two people who are no longer friends keep their conversation readable, but it takes no new messages.
• Limits and blocking: 20 new friend requests a day and 100 waiting for an answer per person. If you block a person, your friendship ends, friend requests between you in both directions are deleted and you no longer follow each other; they can no longer send you friend requests or follow you.
• Notifications: a friend request and its acceptance are notifications in the app, on the website and, if you allowed them, on your phone; the notification on your phone shows the first 80 characters of the request’s message, which passes through Apple’s push service (3.4, 6).

Purpose: friend requests and friendships are part of the service you use (Art. 6(1)(b) GDPR).

3.15 Street view

The menu that opens when you click the map in the route planner on the website, or tap the map in the route editor of the iPhone app, has a Street view button. It shows photographs of the road taken from a vehicle (Apple Look Around), in which you can move along the road. Nothing of it is loaded from Apple or sent to Apple until you open Street view. The website offers it only if the operator has set it up with Apple; the app always has it.

• On the website: when you open Street view, your browser loads Apple’s map script (MapKit JS) and the imagery from Apple’s servers. Before that, your browser asks the Corner Society server for a token, a signed pass that Apple needs and that is valid for 30 minutes. It identifies the operator’s Apple developer account and the address of the website, and nothing about you. The server keeps no record of it apart from the request log (3.6).
• In the app: the view is Apple’s own Look Around, which is part of iOS. Your phone talks to Apple directly; the Corner Society server takes no part in it and receives no request for it.
• What Apple receives: the place you look at, your IP address and technical data of your browser or phone (such as its type and language), as with any use of Apple Maps. No data of your Corner Society account (not your name, e-mail address, routes or position) is passed to Apple. Apple provides Street view and is responsible for this data; Apple’s own privacy information applies (see 6).
• What you decide: nothing is sent to Apple unless you open Street view. Where Apple has no imagery of a place, the window says so and offers “Open in Apple Maps”; the place goes to Apple’s Maps only if you use that.

Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR). Corner Society stores nothing about your use of it.

3.16 Garage

The garage (website: account menu; app: Settings) holds your cars. It is private: nobody else sees it unless you switch on Show on my profile for a car.

• What is stored: for each car its make, model, an optional year and an optional name you give it, the order of your cars, whether it is on your profile, and its pictures. For each drive: the car, if you chose one, the time it started and ended, its distance and number of corners, whether it came from the phone or CarPlay, whether it counted and, if not, why, the share of it that could be fitted to roads, the German states it crossed (as two-letter codes) and, if there was one, the route, tour or convoy it belonged to (the route’s name as a copy). The track of a drive is never stored.
• How a drive is counted: the app sends the track of every navigation drive – a simplified line of its positions with their times, at most about 2,000 points – to the Corner Society server when the drive ends, or later if you were offline; you choose a car for it or not. The server fits it to the roads with its own routing engine (no other service receives it), counts the kilometres and the corners, works out from an outline of the German states that is part of the server which states you drove through (nothing is sent anywhere for that), keeps these figures and discards the track. Checks keep out what cannot be driving: a drive that cannot be fitted to roads, an average speed above 180 km/h or a jump faster than 300 km/h between two points, two drives at the same time, more than 1,500 km on one day, times that do not add up. Such a drive is kept but does not count, and you are shown why. A drive without a car counts for you and for no car.
• Pictures: up to 10 per car (JPEG, PNG or WebP). Each picture is processed when you upload it: its location and every other hidden detail (EXIF) is removed, and it is kept in four sizes in the same media storage as the photos of tours. You can choose which part of a picture is shown as the cover.
• Your car on Home: in the app you can choose one of your cars and one of its pictures to be shown at the top of the Home screen, in a frame of its own. The server then stores which car and which picture you chose and the part of the picture you picked (four numbers), and keeps that part in two further sizes next to your other pictures of the car. It is shown to you alone: nobody else sees it because of this choice, and a car that is not on your profile stays private. Without a choice the app shows the cover picture of your first car. Deleting the car or the picture, taking the choice back, or deleting your account deletes the choice and its two sizes (their files too).
• Who sees what: by default only you. A car you put on your profile shows its cover picture, make, model, year and name and its kilometres, corners and number of drives to everyone with an account, and the total of those cars is shown too. Its other pictures and its list of drives are not shown. You can take a car off your profile at any time. A car you choose for a tour (3.9) is the exception: the members of that tour see its cover picture, make, model, year and name, also if it is not on your profile; choose no car, or another one, and it is no longer shown. The medals a car has earned (3.17) are shown with it. If someone reports a picture of a car on your profile, the administrators can see that picture while the report is open – also if you take the car off your profile meanwhile – and can delete it (3.10). If they delete it, you are told in a notification (3.4) that names your car – not the reason and not who reported it.
• Changing and deleting: you can edit a car, move a drive to another car or delete it. Deleting a car deletes its pictures (their files too); its drives stay as drives without a car and keep counting for you, and you can delete each drive. Deleting your account deletes the whole garage, all your drives and your badges at once. A report about a picture that you deleted stays with the administrators until they decide it; deleting your account deletes the reports about your pictures (3.10). A car you delete is taken off the tours you chose it for.

Purpose: this is a feature you start yourself (Art. 6(1)(b) GDPR). The hidden details of a picture are removed so that nothing about where it was taken leaves your phone’s photo with it.

3.17 Leaderboards and badges

Corner Society counts the kilometres and corners of your navigation drives – nothing else: no speed, no lap times. From them it keeps leaderboards (riders, cars and makes; this week, this month, this year and all time) and gives you badges, seals and medals (for example 500 km, 2,000 corners, a car with 1,000 km).

• What is stored: for each day the kilometres, corners and number of counted drives of you and of each of your cars (3.16); the badges you earned, with the time and, where there was one, the drive that earned them; your choices below; and, if an administrator took you off the boards or took a badge back, that decision with a note and the administrator’s name.
• Leaderboards are your choice: you are on a leaderboard only if you switch on Show me on the leaderboards (off by default). Then everyone with an account sees your username, your profile picture and your kilometres or corners of the period and – for a car you show on your profile – the car with its make, model, picture and name, your username and its figures; the make of that car is counted in the board of makes. Friends see you in the Friends view only if you take part. You can switch it off at any time; you then leave the boards at once (others see the boards renewed within five minutes). Without the switch you still see every board, your own figures and your badges. We record when you switch it, as the proof of your consent.
• Badges: they are shown on your profile only if you switch on Show my badges on my profile (off by default); you can choose up to three to show first. You get a notification when you earn one (in the app, on the website and, if you allowed them, on your phone; 3.4). The medals of a car are shown on its page and in its row on a leaderboard once the car is shown on your profile.
• Fair play and moderation: a drive that fails the checks (3.16) does not count. Administrators can see the drives that did not count, exclude a drive, take you off the boards and take a badge back, each with a note, to keep the boards free of errors and cheating.
• Changing and deleting: you can delete a drive – it leaves your figures and the boards at once; a badge you already earned stays. Deleting your account deletes your figures, badges and settings.

Purpose: the boards and the badges are shown to others only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future; counting and badges for you are part of the service you use (Art. 6(1)(b)); the checks and the moderation protect the service and the other riders (Art. 6(1)(f)).

4. Who can see what

• Everyone with an account (registration is open) can see your username, profile picture, biography, how many people follow you and whom you follow, your public routes and journeys, your highlights and your comments on routes they can see.
• People you share a route or journey with (you invite them by name or e-mail address) can see it. A route or journey set to public is visible to everyone with an account.
• Members of a convoy can see the other members and, while sharing is on, their latest position.
• Everyone with an account sees the active road closure reports on the map, without the name of the person who made them (3.7). Administrators see who made a report.
• Everyone with an account sees the active danger reports on the map, without the name of the person who made them (3.13). The members of a tour see the danger reports of other members in the tour chat with the reporter’s username, and, while sharing is on, each other’s latest position in the tour’s convoy (3.3).
• Everyone, also without an account, sees the page of a tour its organiser has set to public, and everyone who has the link the page of an unlisted tour: the title, text, dates, meeting point, price, contact details and organiser’s username the organiser entered, and the days with their routes and the timetable (3.9). An organiser can also show this page on their own website (3.9).
• The organisers of a tour see the requests, the messages in the conversations about their tour, the decisions and the cars chosen for the tour. The members of a tour see each other’s usernames, profile pictures and the cars they chose for the tour (3.9, 3.16) and every route of the tour.
• Everyone, also without an account, sees the promotion photos of a public or unlisted tour and the photos an organiser has made public (3.11). The members of a tour see all photos of that tour with the username of the person who added each, and its organisers also the photos they have hidden.
• The members of a conversation read its messages (3.10). Administrators read a message only when it has been reported.
• The accepted members of a tour (organisers included) read the chat of the tour, with the username of each author (3.12). Visitors, applicants and invitees do not.
• The two people of a friend request see it with its message; your list of friends and your friend requests are visible only to you, and a profile shows another person only how you stand to them (3.14).
• Administrators of this service can technically access everything stored on the server, including private routes, in order to run and protect the service. They also see the list of accounts with e-mail address, username and join date. As a rule they do not read your messages; they read a message only when someone has reported it (3.10).
• Everyone with an account sees the cars you put on your profile: the cover picture, make, model, year and the name you gave each, and its kilometres, corners and drives, with their total (3.16). The rest of your garage – the other cars, the other pictures and the list of drives – only you see. The one exception is a car you chose for a tour: its cover picture, make, model, year and name are seen by the members of that tour (3.9, 3.16). Your place on a leaderboard and your badges are shown only if you switch them on (3.17).
• Your e-mail address, your password hash and your private profile details are not shown to other users.

5. Legal bases

• Contract, Art. 6(1)(b) GDPR: your account, your content, sharing, convoys, tours, messages, tour chats, notifications and the features you start yourself.
• Legitimate interests, Art. 6(1)(f) GDPR: security, sign-in protection, logs, preventing abuse, handling reports and organiser requests, checking that drives and rankings are fair (3.16, 3.17), and keeping the service stable.
• Consent, Art. 6(1)(a) GDPR: where the phone asks you for permission (location, notifications, camera) and where you switch on being shown to others on the leaderboards or with your badges (3.17). You can withdraw it at any time with effect for the future; this does not affect what was done before.

6. Recipients and other services

Apple and the OpenStreetMap Foundation may process data outside the EU/EEA; MET Norway is in Norway, which is part of the EEA. For each of them, their own privacy information applies: Apple, OpenStreetMap Foundation, MET Norway. No other third party receives your data, and the website does not load scripts, fonts or images from other sites except the map tiles above and, only after you open Street view, Apple’s map script and imagery (3.15). We do not sell data. We pass data to authorities only where the law requires it.

7. Cookies

The website uses a cookie called session. It keeps you signed in and holds the security token that protects forms against forgery (CSRF). It is set when you open a page with a form or sign in, can be read by the server only (not by scripts), and lasts until you log out, at most 12 hours after you sign in; before you sign in it holds only the security token and ends when you close the browser. It is strictly necessary for the service, so no consent is needed (§ 25(2) no. 2 TDDDG).

When you choose a language on the website (a language link in the footer, Settings › Language, or an address with ?lang=), it also sets a functional cookie called lang. It holds only the language code (for example de), is set only at that moment, is kept for one year and is sent only to the Corner Society server. Choosing Automatic in Settings removes it again. Unlike session, it is not hidden from scripts, because the website’s own script writes it when you save a language in Settings. It only remembers the language you asked for, so that the website keeps showing it; it is set at your request and is needed for that, so no consent is required (§ 25(2) no. 2 TDDDG). Without it, the website follows the language your browser asks for. The cookie does not hold the language of your account: that is stored with the account (3.1), and the language of the app with the registration of your device (3.4); both are used to write your notifications.

There are no analytics, advertising or tracking cookies and no tracking of any kind. The embed of a tour on another website (3.9) sets no cookie either.

8. How long we keep data

• Account data and content: until you delete your account.
• Live convoy positions: as described in 3.3, at the latest until the convoy ends.
• Road closure reports: until 30 days after they ended or were resolved, as described in 3.7.
• Danger reports: active for 4 hours (longer when other drivers confirm them) and deleted 30 days after they ended, as described in 3.13; their messages in a tour chat follow the chat (3.12).
• The convoy of a tour: it ends at the end of the last day of the tour (3.3); a position is kept only while it is shared and is erased when sharing stops.
• Organiser requests: until you delete your account (3.8).
• Friend requests and friendships: a request nobody answers is deleted after 90 days; an answered, withdrawn or expired request is deleted 30 days later, and its message is deleted when it is answered, withdrawn or expires. A friendship lasts until it is ended or the account is deleted (3.14).
• Garage: cars and pictures until you delete them or your account; the figures of a drive until you delete it or your account (a drive without a car is kept like any other); the track of a drive is not kept at all (3.16).
• Leaderboards and badges: the daily sums and the badges until you delete your account (a drive you delete leaves the sums at once; a badge you earned stays); your choices until you change them or delete your account (3.17).
• Tours and memberships: a tour stays until its organiser deletes it (only a draft can be deleted), or until the organiser deletes their account and no co-organiser takes over (3.9, section 9). A finished or cancelled tour stays visible to its members as it was. Your membership stays until you delete your account.
• Tour weather: no forecast is stored; the server keeps the answer for a tour in its memory for at most 30 minutes. The note that the morning weather notification was sent to you for a day (the day and your account) is kept for three days (3.9).
• Messages: until their author deletes them (the text is erased at once) or the account of the author is deleted; a conversation with the organisers of a tour goes with the account of the person who started it or with the tour (3.10).
• Tour chat: the messages of a tour’s chat are deleted six months after the last day of the tour (3.12); the photos sent to it follow the album: 12 months after the tour, or when they are deleted.
• Tour photos: the photos that members add are deleted 12 months after the last day of the tour; the promotion photos stay as long as the tour exists. Photos you delete and the photos of a deleted tour are removed at once. Reports of photos work like other reports (3.10, 3.11).
• Reports: a decided report keeps its reason and who decided when, and loses the copy of the reported text. It is deleted when the reporter’s account or the reported message, tour, person or report on the map is deleted. A report about a car picture is also deleted when the account of the person the car belongs to is deleted.
• Place-search cache: entries are reused for 30 days; they are not linked to your account.
• Server logs: 14 days.
• Sign-in protection counters: until the next successful sign-in; the one for your e-mail address is removed when you delete your account.

9. Deleting your account

You can do this yourself, any time: in the app under Settings › Account › Delete account, on the website under Settings › Delete account. You confirm with your password. The deletion happens at once and cannot be undone. It removes:

• your account, sign-in tokens, notification devices and profile picture;
• your routes (with waypoints, event details and cover photos), folders, and journeys (with their shares);
• your highlights with their photos and everyone’s ratings of them;
• the ratings, comments and likes you gave elsewhere, your follows in both directions, and all shares of routes and journeys to you or from you;
• notifications to you and notifications caused by you;
• your road closure reports, and the answers you gave to other people’s reports (the answers others gave to your reports, and the reports others made about them to the administrators, go with them);
• your membership in convoys, including your stored position. A convoy you lead is ended for everyone;
• your danger reports and the messages about dangers you wrote in tour chats; your place in the convoy of a tour, with the stored position – the convoy of a tour you organise goes with the tour to the co-organiser who takes it over, or is deleted with the tour;
• your friendships and your friend requests, sent and received, with their messages;
• your garage and what it earned: your cars with their pictures (their files too), all your drives, also those without a car, your daily sums, your badges and your settings for the leaderboards;
• your organiser requests, your places, requests and invitations in tours, your messages and your place in conversations, your list of blocked people, the reports you made, the reports about you and the reports about the pictures of your cars; a conversation you started with the organisers of a tour goes with everything said in it, and a conversation with a friend is deleted when no message of the friend is left in it;
• your messages and photos in the chats of tours, and the lines of the system that say you joined or left a tour; the chat of a tour that is deleted goes with it;
• the photos you added to tours, in any tour, together with their stored pictures – also the promotion photos of a tour you organised and handed over to a co-organiser;
• the tours you organise: the co-organiser who was added first takes a tour over; a tour without a co-organiser is cancelled – its members and applicants are told – and deleted with its days, routes, timetable, memberships and conversations. Your routes also leave the tours of other people.

Other people’s data stays: their journeys lose only the legs that used one of your routes, and copies that other people saved of your public routes remain theirs. Two limits: a like you gave to a highlight is only a counter and stays in the count; comments written before October 2026 are linked only to the name they were written under, so those written under an earlier name can only be removed when you ask us.

10. Your rights

Under the GDPR you have the right to:

• Access (Art. 15): to know which data we hold about you and to get a copy.
• Rectification (Art. 16): to correct wrong data. You can change your profile in the website settings and in the app.
• Erasure (Art. 17): to have your data deleted. Use Delete account as described above, or write to us.
• Restriction (Art. 18): to have the processing restricted in the cases the law lists.
• Data portability (Art. 20): to get your data in a common, machine-readable form. Every route can be exported as a GPX file (website: route details, send to navigation, GPX); for the rest write to us.
• Objection (Art. 21): to object at any time to processing based on legitimate interests (Art. 6(1)(f)).
• Withdraw consent (Art. 7(3)): for location, notifications and camera in iOS Settings.
• Complain (Art. 77) to a supervisory authority: the data-protection authority responsible for the place where you live, or the one responsible for the operator named above.

To use a right, write to the e-mail address in section 1 from the address of your account, so that we can tell it is you.

11. Other points

• Providing data: without an e-mail address, username and password we cannot give you an account. Everything else is optional.
• No automated decisions: there is no automated decision-making or profiling that has legal or similarly significant effects on you.
• Children: Corner Society is not meant for children under 16. We do not knowingly create accounts for them; if you think a child has one, tell us and we will delete it.

12. Changes

When the software or the law changes, we update this policy. The date at the top shows the latest version; the app and the website always link to the current one.