Privacy Policy for TOROH

Last updated: November 2025

1. Data Controller

This application is operated by a private individual:

Jeff Schramm
E-mail: openai@j3ff.de

The App is not operated by a registered company.
Processing of personal data is carried out under the European General Data Protection Regulation (GDPR).

2. Purpose and Scope of Data Processing

TOROH is a cross-platform application (Android, iOS, Web) that enables users to discover, organize, and interact with restaurant information.
The App processes personal data only to the extent necessary for providing and improving its services.

a) Authentication and Account Management

Authentication via Supabase Auth (email/password, Magic Link, OAuth via Google or Apple)
Data stored: user ID, e-mail address, session tokens, profile information
Data hosting: Supabase EU region (Amsterdam) operated by Supabase Inc., San Francisco, USA

Purpose: Login management, synchronization of favorites, profiles, and social connections
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

b) Location and Map Data

Access to device location is optional and requires explicit consent
Location is used only for proximity searches and not permanently stored
Map and restaurant data are provided by Google Places API and OpenStreetMap

Legal basis: Art. 6(1)(a) GDPR (consent)

c) User-Generated Content

The App stores content such as favorites, notes, restaurant lists, photos, and social connections
Uploaded media are stored in Supabase Storage with metadata (file size, MIME type, uploader ID)
Public profiles may be visible to other users if enabled

Legal basis: Art. 6(1)(b) GDPR (service functionality)

d) Feedback and Communication

Users can submit bug reports or feature requests via the in-app Feedback Board
Data stored: title, description, status, user ID, optional e-mail
Purpose: internal improvement of the App

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining service quality)

e) Notifications

Push notifications use Firebase Cloud Messaging (Google LLC)
Device tokens are stored for message delivery only
No marketing or advertising notifications are sent

Legal basis: Art. 6(1)(a) GDPR (consent)

f) Analytics and Logs

No third-party analytics tools (e.g. Google Analytics) are used
Local diagnostic logs (flutter_*.log) remain on the device and are not transmitted automatically

Legal basis: Art. 6(1)(f) GDPR (technical maintenance and debugging)

3. Data Sharing and Processors

Data may be processed by trusted external service providers under GDPR-compliant agreements:

Provider	Purpose	Location	Legal Safeguard
Supabase Inc.	Authentication, database, storage, realtime	EU (Amsterdam) / USA	EU Standard Contractual Clauses (Art. 46 GDPR)
Google LLC	Places API, Maps, Firebase Messaging, OAuth	USA	EU Standard Contractual Clauses (Art. 46 GDPR)
OpenStreetMap Foundation	Map tiles and geodata	UK	Adequacy Decision (UK GDPR)

No data is sold or transferred to third parties for advertising or profiling.

4. Data Retention and Deletion

Account data is deleted immediately upon user request via the in-app Delete Account feature
Media and feedback entries are removed automatically or upon deletion request
Local caches (Hive, SharedPreferences) can be manually cleared in the App settings
Backups on Supabase servers follow a limited retention policy for recovery purposes

5. User Rights (GDPR Articles 15–22)

You have the following rights:

Access to your stored data (Art. 15)
Rectification of inaccurate data (Art. 16)
Erasure (“right to be forgotten”, Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection to processing (Art. 21)
Withdrawal of consent at any time (Art. 7(3))

Requests can be sent to openai@j3ff.de.
Responses will be provided within the legal time frame of one month.

6. International Data Transfers

The App may transfer data to countries outside the EU (e.g. USA) when using Supabase or Google services.
Such transfers are protected by EU Standard Contractual Clauses and data processing agreements ensuring GDPR compliance.

7. Data Security

All communication between the App, Web Client, and Supabase backend is TLS-encrypted
Authentication tokens and passwords are securely hashed and never stored in plain text
Access to data is limited to authenticated sessions only

8. Children’s Privacy

TOROH is not directed toward children under the age of 16.
No personal data of minors is knowingly collected or stored.
If such data is discovered, it will be deleted immediately upon notice.

9. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect legal or technical changes.
The current version is always available in the App under “Privacy Policy”.

10. Contact

For privacy inquiries or GDPR-related requests, please contact:

Jeff Schramm
E-mail: openai@j3ff.de