Convenience translation – only the German version is legally binding.
Last updated: 2026
§ 1 Controller
- SimplyNext
- Owner: Nuri Toker
- Mechenseerstr. 12
- 88316 Isny im Allgäu
- Germany
- Phone: +49 1743 389049
- E-Mail: info@simplynext.de
- Website: simplynext.de
- VAT ID: DE463824630
A data protection officer is not required by law, as extensive processing of personal data is not a core activity. If you have any data protection questions, please contact the e-mail address above directly.
Competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
§ 2 Overview of the Data Processed
| Data category | Examples | Legal basis | Mandatory |
|---|---|---|---|
| Account data | E-mail, display name, language | Art. 6(1)(b) GDPR (contract) | Yes |
| Travel data | Destination, dates, interests, daily plan | Art. 6(1)(b) GDPR (contract) | For AI feature |
| Subscription status | Subscription expiry, unlocked content | Art. 6(1)(b) GDPR (contract) | Yes |
| Location data | GPS position, anonymous presence report | Art. 6(1)(a) GDPR (consent) | No (opt-in) |
| Camera data | Live view for text recognition (local) | Art. 6(1)(b) GDPR (contract) | No (opt-in) |
| Stampbook / gamification | Places visited (place ID + timestamp) | Art. 6(1)(b) GDPR (contract) | No |
| Group expenses | Amount, description, payer ID | Art. 6(1)(b) GDPR (contract) | No |
| Crash data (Sentry) | Device data, stack trace, app version | Art. 6(1)(f) GDPR (legitimate interest) | No (can be disabled) |
Not collected: microphone recordings, stored photos, contacts, calendars, biometric data, advertising IDs. Data is not passed on to advertisers.
§ 3 Registration & Account
Registration is required to use the NOOK app. The following data is collected and stored in the database of our service provider Supabase:
- E-mail address – for login and account communication
- Password – exclusively as a cryptographic hash (bcrypt), never in plain text
- Display name – freely chosen by you
- Preferred language – taken automatically from the device settings, can be changed
- Subscription status – activation, expiry date and unlocked content
Alternatively, you can sign in via Google Sign-In or Apple Sign-In (Sign in with Apple). In this case, the respective provider transmits your name and e-mail address. We do not receive access to your Google or Apple password.
Storage Period
Account data is stored until the account is deleted. You can delete your account at any time under Settings → Profile → Delete account or request deletion by e-mail to info@simplynext.de. After deletion, all personal data is irrevocably removed within 30 days.
§ 4 Location Data
The app only accesses your location after your express consent (opt-in on first launch). You can withdraw your consent at any time in your profile or in the Android system settings.
Your location is used for the following purposes:
- Map display: Your position is processed locally on the device and is not transmitted to or stored on our servers.
- Stampbook (collecting stamps): To redeem a stamp, your GPS position is compared once with the coordinates of the place (radius: 50 m). This check takes place on the device; your exact position is not stored permanently.
- Anonymous crowd reporting: With your consent, the fact that you are near a sight is transmitted – in the form of place ID + day of the week + time, without a user ID. This report cannot technically be traced back to you and is therefore anonymous within the meaning of the GDPR.
Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal: at any time without giving reasons via the app's profile screen or the system settings.
§ 5 Camera & Smart Scanner
The camera is used exclusively for the Smart Scanner, which recognises menus and signs. Access takes place as a live view; photos or videos are neither stored nor uploaded.
Text recognition takes place entirely on the device (Google ML Kit Text Recognition – no server call). Only the recognised text is then transmitted to our server-side AI interface (Supabase Edge Function → Google Gemini API) for content analysis. No personal data is sent in the process.
§ 6 Third-Party Providers & Data Processing
6.1 Supabase (Database, Auth, File Storage)
Core infrastructure of the app. All account data, travel plans, expenses and stampbook entries are stored in the Supabase database. Audio guides are stored in Supabase Storage.
| Item | Value |
|---|---|
| Provider | Supabase Inc., 970 Trestle Glen Rd, Oakland, CA 94610, USA |
| Server location | EU (Frankfurt / AWS eu-central-1) |
| Privacy | supabase.com/privacy |
| DPA | Required; available from Supabase as a DPA |
| Third-country transfer | Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR |
6.2 Google LLC (Maps, AI, ML Kit, Directions)
The Google Maps SDK for Android is used for the interactive map in the Explorer screen. Device identifiers and map tile requests may be transmitted to Google in the process.
The Google Gemini API is called exclusively server-side via Supabase Edge Functions – never directly from the device. Content processed: destination and travel dates (route planning), guide script texts (text-to-speech), recognised menu text (scanner), shared social post text (Zazu assistant). No user ID is transmitted to Google in the process.
Google ML Kit Text Recognition runs entirely on the device; no data leaves the device.
The Google Maps Directions API is used server-side for public transport connections; only anonymous start/destination coordinates are transmitted.
| Item | Value |
|---|---|
| Provider | Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA |
| Privacy | policies.google.com/privacy |
| Third-country transfer | SCC / Google Cloud DPA pursuant to Art. 46 GDPR |
6.3 BestTime API (Visitor Numbers)
To display live visitor numbers for sights, we use the BestTime API server-side. Only anonymous place IDs are transmitted; there is no personal reference.
| Item | Value |
|---|---|
| Provider | BestTime.app B.V., Netherlands |
| Privacy | besttime.app/privacy |
6.4 In-App Purchases (Google Play & Apple App Store)
Purchases and subscriptions are processed entirely via Google Play Billing or the Apple App Store. NOOK does not process any payment data directly. Purchase receipts are submitted to Google or Apple for verification exclusively server-side (Supabase Edge Function). The privacy policies of the respective stores apply.
6.5 Sentry (Crash Reporting, Optional)
To improve app stability, we optionally use Sentry. Sentry is only active if a DSN key is provided via the build configuration. In the event of a crash, the following data is transmitted: device manufacturer and model, operating system version, app version and stack trace. No personally identifiable data is knowingly collected.
| Item | Value |
|---|---|
| Provider | Functional Software Inc. (Sentry), 132 Hawthorne St, San Francisco, CA 94107, USA |
| Privacy | sentry.io/privacy |
| Storage period | 90 days |
| DPA | Required; available from Sentry |
| Third-country transfer | SCC pursuant to Art. 46 GDPR |
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and troubleshooting).
§ 7 Transfer of Data to Third Countries
Some of the service providers mentioned (Supabase, Google, Sentry) are based in the USA. For transfers to third countries without an adequate level of data protection, we rely on Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR. Copies of the clauses are available on request.
Insofar as Supabase is operated on EU servers (Frankfurt), no transfer to a third country takes place for the data stored in the database.
§ 8 Your Rights
| Right | Basis | Description |
|---|---|---|
| Access | Art. 15 GDPR | You can request information about the data stored about you at any time. |
| Rectification | Art. 16 GDPR | Inaccurate or incomplete data will be corrected at your request. |
| Erasure | Art. 17 GDPR | You can request the erasure of your personal data unless statutory retention obligations prevent this. |
| Restriction | Art. 18 GDPR | You can request the restriction of processing, e.g. while you dispute the accuracy of the data. |
| Data portability | Art. 20 GDPR | You have the right to receive your data in a machine-readable format or to have it transferred to another provider. |
| Objection | Art. 21 GDPR | You can object to processing based on legitimate interests (e.g. Sentry). |
| Withdrawal | Art. 7(3) GDPR | Consent (location data) can be withdrawn at any time with effect for the future, without affecting previous processing. |
| Complaint | Art. 77 GDPR | You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence. |
To exercise your rights, please contact: info@simplynext.de. We will process your request within 30 days.
Supervisory authority responsible for SimplyNext (registered in Baden-Württemberg): Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany. A list of all EU supervisory authorities can be found at edpb.europa.eu.
§ 9 Changes to This Policy
We reserve the right to adapt this privacy policy in the event of significant changes to the app or the legal situation. You will be informed of significant changes via the app or by e-mail. The date of the last update is shown above.