Privacy Policy

1. Who is responsible?

The controller responsible for this platform is:

Thomas Wunner
Wunner Software
Am Fichtenhain 6
95463 Bindlach
Email: info@wunner-software.de

If you have any questions about data protection, just send us an email.

2. What data do we collect?

When you register

When you sign up, we store your display name, your email address, your date of birth and your preferred language. Your password is stored encrypted — we cannot read it ourselves.

In your profile

You can voluntarily provide further information: a bio (a short text about yourself), a profile picture, your sports and your language skills. All of this is voluntary — you decide what you want to share.

Your content

Everything you post on ActionBuddies is stored: posts (text and images), comments, likes, chat messages (including reactions to messages), events, spot check-ins, marketplace listings, knowledge articles, questions and sessions (planned sports meetups). We also store your follows, crew memberships, mentoring relationships and blocks.

Location data

Some features work with location data. Here are the details of what we store:

• Spots — have GPS coordinates (latitude/longitude). When you check in at a spot, we store that you were there at a certain time. Over time, this creates a history of the spots you have visited.
• Events — can optionally have GPS coordinates if the organizer specifies a location.
• Sessions — are tied to a spot. When you take part in a session, your participation is stored together with the place and the time.
• Marketplace — listings can optionally contain a city and GPS coordinates so that buyers nearby can find the listing.
• Travel mode — when you activate travel mode, we store the city you enter and the corresponding GPS coordinates in order to show you spots and sessions where you are currently staying.
• Nearby notifications — when you activate this feature, you are notified when other users check in near a spot. For this, check-in data is matched against your surroundings. You can switch this feature off in the settings at any time.

None of these location features is active automatically — you decide for yourself whether you check in, take part in a session or use travel mode.

Images and face recognition

When you upload images (profile picture or post images), they are stored in different sizes and converted to the WebP format so that the site stays fast. The images are kept on our own server — not with an external cloud service.

In addition, uploaded images can be automatically analyzed for faces. This creates a so-called face vector (a mathematical value, not an image) that can be used to recognize people across different photos. This processing takes place exclusively on our own server — no image data is sent to external services. Before this feature is activated for you, we ask for your explicit consent. You can withdraw this consent at any time, after which your face vector is deleted.

As proof of your consent, we store when you gave or withdrew it and from which IP address this was done. This allows us to demonstrate that the processing only takes place with your consent (Art. 7(1) GDPR).

Technical data

When you visit our site, our server automatically stores your IP address, the browser type, the operating system and the time of access. We need this data so that the site works and to detect attacks. The server logs are automatically deleted after 14 days.

Protection against overload

So that nobody can bring the platform down with masses of requests or guess passwords by trial and error, we limit how many requests are possible within a short time. To do this, we count the requests per user account — and, if you are not logged in or are in the process of logging in, per IP address. For this, the IP address is only stored in pseudonymized form as a hash value, not in plain text. The counters are automatically deleted after one hour at the latest.

Online status

When you are logged in, we show other users whether you are currently online. You can switch this off in your settings under Privacy.

Activity data and gamification

ActionBuddies offers a gamification system with badges, streaks, challenges and trick progress. For this, we store which badges you have received, how long your current and your longest streak are and which tricks you have marked as done. This data serves to make your progress visible and to motivate you.

Reporting content

When you report content or a user, we store your user ID as the reporter, the reported content, the reason and the time. In addition, your approximate location (city) is determined — either from your profile or, if none is stored there, based on your IP address. This helps us to assign reports to regions.

Registering with a referral code

When you register with a partner's referral code, we store the code used, the time and your IP address at registration. This allows us to detect misuse of the partner program, for example when many accounts are created from the same IP address via the same partner. The partner does not receive your IP address (legal basis: legitimate interest, Art. 6(1)(f) GDPR).

3. Why do we store this data?

We store your data for these reasons:

• So that the platform works — without your email you cannot log in, without stored posts there is no feed (legal basis: performance of a contract, Art. 6(1)(b) GDPR)
• To show you suitable content — we use your sports to suggest suitable users and spots to you (legal basis: legitimate interest, Art. 6(1)(f) GDPR)
• For security — we store IP addresses and monitor suspicious behavior in order to detect attacks and misuse (legal basis: legitimate interest, Art. 6(1)(f) GDPR)
• Because you allowed it — for optional features such as push notifications or certain cookies, we ask for your permission first (legal basis: consent, Art. 6(1)(a) GDPR)

4. Cookies

Cookies are small text files that your browser stores. We only use cookies that we really need — no advertising or tracking cookies.

Essential cookies (always active)

• Login cookie — keeps you logged in so that you don't have to log in again on every page view. This cookie is a so-called httpOnly cookie, which means: no script can read it, only our server.
• Cookie settings — stores which cookie categories you have allowed or rejected.

Functional cookies (optional)

• Theme — stores whether you prefer light or dark mode.
• Language — stores your preferred language.

Analytics (optional)

• Usage statistics — only if you agree do we load our statistics program Umami (see section 10). Umami itself does not set any cookies.

You can change your cookie settings and withdraw any consent you have given at any time. The cookie banner then appears again and you can make a new choice.

5. Push notifications

When you activate push notifications, we store a technical address (subscription endpoint) through which we can send messages to your browser. This data stays on our server. You can switch push notifications off again at any time in your browser settings or in the ActionBuddies settings.

6. Premium and payment

When you take out a Premium subscription, we handle the payment via Mollie. This means: your payment data (credit card, bank details, etc.) is not stored by us but directly with the payment provider. We only receive a confirmation that the payment went through. You choose the payment method (for example credit card, Apple Pay or PayPal) in the Mollie checkout. If you choose PayPal, PayPal also receives your payment data, because the payment then runs through your PayPal account.

You can find the privacy policies of the payment providers here:

• Mollie privacy policy
• PayPal privacy policy

Cancellation and withdrawal functions (“Cancel contracts here”, “Withdraw from contract”)

With the cancellation function (“Cancel contracts here”, also without logging in) and the cancel button on the Premium page you can cancel your subscription. We store the content of your cancellation (name, email address of the account, the subscription reference if given, the kind of cancellation, the reason and the requested end of the contract), its assignment to an account, the email address for the confirmation of receipt, a pseudonymised key of your IP address (a hash value, not the IP address itself) and the times of receipt and processing.

We need this data to carry out your cancellation, to confirm its receipt to you and to be able to prove it. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 312k BGB (German Civil Code: the duty to provide a cancellation button and a confirmation of receipt).

We use the pseudonymised key of your IP address and the limits on requests and on confirmation emails per address and network to protect the form against misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: protection against misuse).

We keep cancellations as proof of receipt until the end of the third year after the year they were received (limitation period); then they are deleted.

The same applies to withdrawals through the withdrawal function (“Withdraw from contract”, also without logging in): we store the same details (without a reason, which a withdrawal does not need), on the same legal basis (Art. 6(1)(c) GDPR in conjunction with Section 356a BGB for carrying it out, confirming its receipt and proving it; Art. 6(1)(f) GDPR for protecting the form from abuse) and for the same time. If you withdraw without logging in, we send a confirmation link to the address stored for the account; we store the link only as a hash value, and it is valid for 14 days. For the refund we store the refunded amount and the identifier of the refund at Mollie with the other payment data.

When you take out Premium, we also store when you requested that Premium starts immediately and which version of that notice you saw. This is the proof for the proportionate amount on withdrawal and for the withdrawal period (Art. 6(1)(c) GDPR in conjunction with Sections 356(4) and 357a(2) BGB, and Art. 6(1)(b) GDPR for performing the contract). We keep it with the subscription data.

We store confirmation emails (confirmation of receipt, contract confirmation, payment receipts) until they are sent. Their text and the full recipient address are deleted after 7 days (for emails not linked to an account right after sending); afterwards only the kind, subject, times and the shortened address remain as proof of sending. We delete these details together with the cancellation for confirmations of receipt (end of the third year after the year it was received) and 12 months after they were created for all other emails.

7. Security

We protect our platform with CrowdSec, an open-source security solution based in France. If someone attacks our servers (e.g. through mass login attempts), the attacker's IP address is transmitted to the CrowdSec cloud together with the timestamp and the type of attack. This helps to detect and fend off attacks early.

Legal basis: legitimate interest in IT security (Art. 6(1)(f) GDPR). Further information: crowdsec.net/legal-notices

8. Where is your data stored?

All your data is stored on a server in Germany that we operate ourselves. We do not use any cloud service such as Amazon, Google or Microsoft. Your images, messages and profile data — everything stays on our own server.

SSL encryption (the padlock symbol in your browser) ensures that the data cannot be read by others on its way between your device and our server.

9. Recommendations and suggestions

We suggest other users, spots and content to you that match your sports. For this, we use a graph database that analyzes connections between users, sports and places. This happens entirely on our own server — no data flows to external recommendation services or AI providers.

10. Advertising and tracking

We use no advertising cookies, no Google Analytics, no Facebook Pixel and no other external tracking tools. We do not sell your data and do not pass it on to external advertisers.

Usage statistics with Umami

To understand how ActionBuddies is used and to improve the platform, we use the statistics program Umami — but only if you have agreed to the Analytics category in the cookie banner. Umami runs on our own server in Germany; the data does not go to any external provider.

We record the page you visit (address and title), the page you came from, browser, operating system, device type, screen size, language and your approximate location (country, region, city). In addition, we count a few actions: registration, login, new post, switching to another ActionBuddies network, check-in at a spot and searches (with search term and number of results).

Umami does not store your IP address and does not set any cookies. To group visits together, Umami creates a regularly changing hash value from the IP address and the browser identifier. We therefore cannot link the statistics to your account.

Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG [Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, the German Telecommunications Digital Services Data Protection Act]). You can withdraw it at any time using the “Change cookie settings” button in section 4 — from then on, nothing more is recorded.

ActionBuddies offers an in-platform advertising system for local sports shops, spot sponsors and community events. So that relevant ads can be shown to you, the system uses the following data:

• Your sports (which sports you have specified in your profile)
• Your approximate location (city from your profile, if specified)
• Your age (calculated from your date of birth)
• Your skill level (if specified)

When an ad is shown to you, we store which ad you have seen (impression) and whether you clicked on it (click). This data is not passed on to external advertising networks — it stays on our server and only serves to show advertisers how often their ad was seen.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — financing the platform combined with relevance to you.

11. Who receives your data?

As a rule: nobody. There are only four exceptions:

• Payment providers (Mollie; PayPal only if you choose PayPal as the payment method) — only if you take out a Premium subscription, and even then only the payment data, not your profile
• CrowdSec — only IP addresses of attackers, no normal user data
• OpenWeatherMap — if you use the weather display at a spot, the GPS coordinates of the spot (not your personal ones) are sent to the OpenWeatherMap API to retrieve the current weather. Further information: OpenWeatherMap privacy policy
• Authorities — only if we are legally obliged to do so (e.g. in the case of a court order)

12. How long do we store your data?

• Your account and your content — as long as your account exists. If you delete your account, your data is removed.
• Server logs (IP addresses, access data) — are automatically deleted after 14 days.
• Counters for protection against overload (pseudonymized IP addresses) — are automatically deleted after one hour at the latest.
• Proof of consent to face recognition and IP address at registration with a referral code — as long as your account exists.
• Usage statistics (Umami) — as long as we evaluate them to improve the platform; they cannot be linked to your account.
• Payment data — we keep billing information for 10 years because tax law requires it. The actual payment data is held by the payment provider.
• Cancellations and withdrawals — as proof of receipt for three years from the end of the year of receipt.
• Confirmation emails — text and recipient address for 7 days, then only the sending data.

13. Your rights

You have the following rights — and we take them seriously:

• Access — You can ask at any time which data we have stored about you.
• Rectification — If something is wrong, we correct it.
• Erasure — You can request that we delete your data. The easiest way: delete your account in the settings.
• Restriction — You can request that we keep your data but no longer use it.
• Data portability — You can request a copy of your data in a common format.
• Objection — You can object to the processing of your data if we process it on the basis of our legitimate interest.
• Withdrawal — If you have given consent (e.g. for push notifications), you can withdraw it at any time.
• Complaint — You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority, BayLDA).

For all requests, simply write to: info@wunner-software.de

14. Children and young people

ActionBuddies is aimed at sports enthusiasts of all ages. If you are under 16 years old, you need the consent of your parents or legal guardians to use the platform.

15. Changes to this policy

If anything changes in how we process data, we will update this policy. You can always find the current version on this page.

Last updated: 23 October 2026