FIPS
Privacy at FIPS
We process only the data needed for accounts, festival planning, groups, chat, offline sync and optional notifications. The legal basis is your use of FIPS itself (Art. 6(1)(b) GDPR); push and location requests happen only with your consent (point (a)), and security and error diagnosis rely on our legitimate interest (point (f)).
Controller
Giraffe GmbH, Wiesenweg 1, 07937 Zeulenroda-Triebes, Germany. Contact: [email protected].
Data we process
This may include a display name, optional email address, internal account and device IDs, selected acts, plans, group content, chat messages, push tokens and the images and avatars you upload yourself. FIPS does not request contacts, microphone, advertising IDs or payment data. For the “Near me” search, FIPS asks once for your approximate location when you tap it — only for that one search. It is not stored and not shared. To set or find a camp or event spot, FIPS asks once for your precise location when you tap; only the point you deliberately set is stored — as part of the event, visible to the edition's attendees. AI suggestions and image generation run entirely on your device; only the image you deliberately save as an avatar is transmitted to FIPS.
Sign-in, notifications and storage
Apple or Google sign-in exchanges the required identity data with the selected provider. Optional push notifications use APNs or Firebase Cloud Messaging; Apple and Google also process data in the USA for this (EU-US Data Privacy Framework). Native chat pushes contain no message text; web push may show a short excerpt. Emails are sent by our provider Brevo. Technical error reports may go to our provider Sentry — without content and without tokens. We do not use advertising, profiling or cross-app tracking. Hosting is provided by Hetzner in Germany, reachable via Cloudflare; uploaded images are not held in the app but in a separate object storage service. Storage and backups are located in the EU.
Images and avatars
Crew images are visible only to members of that crew; campsite events and their photos are shared within the access-restricted festival area. These user images are not freely accessible on the internet. Your avatar appears in your crews. EXIF and GPS metadata are removed on upload. You can delete your images under “My images”. After leaving a crew, a shared image may remain without a link to your account. This does not make recognisable people in the image anonymous. For image rights or deletion, contact [email protected], even without an account.
Image rights and visibility
A crew image proposed for the official data collection is reviewed before being accepted. Crew images are visible only to members of that crew; campsite events and their photos are shared within the access-restricted festival area. These user images are not freely accessible on the internet. Publish photos of people only if you have the right to do so. Anyone affected can contact [email protected] without an account.
Spotify playlist sync
If you connect Spotify, FIPS uses the access only to create or update private playlists from your festival plan. The connection is stored in your FIPS account, encrypted on our servers; disconnecting removes it there. Also revoke app access in your Spotify account.
Your rights and deletion
You can exercise your rights to access, rectification, export, deletion and other data protection rights through [email protected]. Standard account deletion in settings or at /konto-loeschen has a 14-day reconsideration period; statutory rights to deletion without undue delay remain unaffected. You can remove individual images and your avatar yourself. After account deletion, we retain a minimal deletion record without a direct account link for 42 days; deletions are applied when backups are restored. You can complain to a data protection supervisory authority.