Privacy Policy

Last updated: 27 August 2026

NoGo is built so that as little as possible accumulates about you: there is no user account, no email address, no free-text fields and no photos. This policy describes which data is nevertheless processed when you use the “NoGo” app, why, for how long — and what rights you have.

1. Controller

ESBM-Solutions UG (haftungsbeschränkt)
Ditfurthstraße 48
33611 Bielefeld, Germany
Email: support@esbm-solutions.com

2. Hosting

The app’s API (api.nogo.esbm-solutions.com) runs on servers operated by Hetzner Online GmbH (Germany), managed via Coolify; the server location is Frankfurt am Main. The PostgreSQL database holding the report data is operated by Supabase, Inc. — also in a data centre in Frankfurt am Main (AWS region eu-central-1). Data processing agreements are in place with both providers. Report data and location queries are processed exclusively in Germany.

3. Use without an account

NoGo has no registration and no sign-in. We collect neither an email address nor a name, phone number or password, and the app is not linked to any social login.

So that reporting limits, confirmation limits and abuse protection can work at all, the app creates a random device identifier the first time you use it. That identifier is stored in your device’s encrypted system storage and is kept on our server only as a cryptographic hash (SHA-256). It contains no information about you, your device or your connection and is not linked to any advertising identifier. If you delete the app you lose access to that identifier; reinstalling creates a new one.

4. Which data we process

• Device identifier (as a hash) and an internal trust score derived from it, based on how often your reports were confirmed by others or expired unconfirmed. Purpose: abuse protection and weighting of the map.
• Reports — we store only: the chosen category (e.g. robbery, violence, aggressive group, harassment, drug scene, pickpocketing, feeling unsafe, dark area, demonstration/assembly), optional attributes from fixed lists (group size, behaviour, mobility), the location of the reported incident as a coordinate, the time of the report, optionally the stated time of the incident, the link to your device identifier and, where applicable, the link to a previous report of the same incident. There are no free-text fields, no photo or video uploads and no fields for names or descriptions of people.
• Confirmations — if you confirm someone else’s report, we store the report, your device identifier and the time.
• Your device location when reporting — transmitted together with the report but not stored. It is used only for the immediate plausibility check that the reported location is no more than 500 metres away from you. After the check it is discarded.
• Location queries — to load the map, warnings and nearby help the app sends your position to our API. These queries are neither logged nor stored: our server is configured so that neither the request URL containing the coordinates nor the IP address is written to log files.
• Map tiles — the map itself does not come from us: the app loads map images, fonts and symbols directly from OpenFreeMap (map data from OpenStreetMap). For technical reasons that service learns your device’s IP address and which section of the map you are currently viewing. It does not receive your reports, your device identifier or your precise GPS position.
• IP address — used briefly in memory as a counter when a new device identifier is created, so that identifiers cannot be created without limit. It is not stored in the database and not logged, and expires after 24 hours at the latest or when the service restarts.
• Settings (language, warning categories, warning radius, subscription status) — in principle remain on your device. Only if you switch the warning system on are your warning radius, warning categories and language additionally stored on our server, so that we can send you the right warnings (section 6). The subscription status is not transmitted to our API.

5. Location data in detail

In the foreground (while you are using the app) we use your location to centre the map on you, to place and verify your report and to find help nearby.

In the background we use your location only if you explicitly enable warnings and grant the “always allow” permission. In that case the app loads the current areas within your chosen radius (500 m to 5 km) and monitors up to 18 zones of 200 metres radius each on your device. If you enter such a zone, the app creates the notification itself. You can switch warnings off at any time in the app settings or in your device’s system settings.

During this process the app additionally reports a deliberately coarsened position to our server, so that we can also tell you about a new report near you while the app is closed. We only ever store the latest state of it — a new entry overwrites the old one. This creates no location history and no movement profile. Exactly what is stored is described in the next section.

6. Notifications and push messages

Warnings reach you in two ways, and both exist only if you explicitly switch them on under Settings → Warnings → Notifications. The first are local notifications triggered by your own device as soon as you enter one of the zones described in section 5 — no location leaves your device in the process. The second is a push notification from our server: when a new report arrives within your warning radius, we actively send it to you — even while the app is closed. If the warning system is off, none of this takes place.

What we store for this. When you switch the warning system on, we create exactly one record linked to your anonymous device identifier:

• your device’s push token — the technical delivery address through which the push service reaches your device;
• your deliberately imprecise position: the app rounds the coordinates before sending them to three decimal places, which corresponds to a grid of roughly 110 metres; our server rounds them the same way again as a safeguard. Your exact position does not leave the device for this purpose.
• your warning radius (500 m to 5 km) and the warning categories you have chosen — the only way to decide which report is relevant to you at all;
• your app language, so the notification arrives in your language (the text has to be fixed at the moment it is sent), and your time zone offset from UTC. The latter is currently only stored and not yet evaluated; it is the basis for a quiet-hours feature planned for later.

There is a single record per device, overwritten on every sync. We therefore do not store places where you have been before.

Short-lived send logs. So that the same danger does not wake you repeatedly, we additionally note which warning went to your device and when. The location appears in it only as a coarse grid key (a map cell of roughly 0.7 km², without coordinates). This serves solely as spam protection: a cool-down period per area and a cap on notifications per day. These entries are deleted after 48 hours; the technical delivery receipts of the push service, through which we detect addresses that have become invalid, after 7 days.

How long the registration lasts. It is deleted as soon as you switch the warning system off again, as soon as you use “Delete my data” in the app, and as soon as the push token has become invalid (for example after you uninstall the app). At the latest it is deleted automatically after 90 days of inactivity.

Who delivers it. Sending is carried out on our behalf by the Expo Push Service (Expo, Inc., USA); from there Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) hands it over to your device. These services receive the push token and the text of the notification. The text names only the category of the report and deliberately no place or street name — it is visible on the lock screen and must not reveal anything about where you are. We do not transmit your reports, your device identifier or your position to these services. On transfers to the USA see section 16.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by switching the warning system on. You can withdraw it at any time with effect for the future by switching the toggle off again — the data listed above is then deleted from our servers.

7. Reports and other people’s data

A report describes a situation at a place, not a person. That is exactly why the app has no input fields for names, descriptions or photos: no identifying information about third parties should be created in the first place. Please do not use NoGo to follow, observe or tag individual people — our terms of use prohibit this.

8. Purposes and legal bases

9. Recipients and processors

Beyond that we use no further analytics or AI services; in particular, NoGo uses no OpenAI or comparable AI providers.

10. Advertising

Without a subscription we show an ad banner — exclusively on the map screen. No advertising appears in the reporting, help, onboarding or settings areas.

On first launch in the European Economic Area, Google’s consent dialog (User Messaging Platform, following the TCF standard) asks whether you agree to personalised advertising; on iOS, Apple’s App Tracking Transparency (ATT) additionally applies. Only with your consent does Google AdMob serve personalised ads and use your device’s advertising ID for that purpose. Without consent, advertising remains non-personalised; if your consent state does not permit any ads, the advertising SDK is not started at all.

In both cases Google AdMob processes technical information about the device and the ad request as well as a coarse location (region) derived from the IP address, in order to deliver ads, cap their frequency and prevent fraud. We do not pass any reports, NoGo device identifiers or precise locations to AdMob.

You can change or withdraw your advertising consent at any time in the app under Settings → Ad privacy settings. With a subscription, no advertising is loaded at all.

11. Crash reports (Sentry)

If the app crashes or a technical error occurs, it sends an error report to Sentry (Functional Software, Inc.). A report contains the technical error message with its execution trace, the app version, operating-system version and device model, and the time. We have deliberately restricted Sentry to the minimum: no session replay, no performance tracing, no transmission of personal details (send-PII is disabled); your NoGo device identifier, your reports and your location are never part of an error report. Processing takes place on Sentry’s EU servers in Frankfurt am Main; reports are automatically deleted there after 90 days at the latest. In development builds of the app, Sentry is switched off entirely. The legal basis is our legitimate interest in a stable app (Art. 6(1)(f) GDPR).

12. Measuring the success of ad campaigns (advertising partners)

To measure whether our ads work, we share individual events with our advertising partners. Our only advertising partner at present is TikTok; for this we use the TikTok Business SDK — exclusively if you explicitly agree in the onboarding step “Help NoGo reach more people” (Art. 6(1)(a) GDPR). If you decline, the SDK is never started and no data whatsoever flows to TikTok. If you agree, the app transmits individual events to TikTok: completion of onboarding, the start of a subscription purchase and a completed purchase (with price, currency and product ID) — together with technical device information and, if you have allowed it on iOS via ATT, your device’s advertising ID. Your reports, your location and your NoGo device identifier are not transmitted to TikTok. The provider is TikTok Technology Ltd. (Ireland); data may also be transferred to third countries, in particular the USA. You can withdraw your consent at any time with effect for the future — directly in the app via the toggle Settings → Legal → Ad campaign measurement. After withdrawal, no further events are transmitted to TikTok. If we add further advertising partners in the future, we will update this privacy policy before any data flows to them.

13. Subscriptions

The “Ad-free” and “Supporter” subscriptions are purchased through the Apple App Store or Google Play; your contractual partner for the purchase is Apple or Google. The technical management (checking which subscription is active) is handled by RevenueCat. This creates an anonymous app identifier, the store’s purchase and transaction identifiers and the subscription status. We receive no payment data such as credit card numbers or billing addresses. The privacy policies of Apple and Google apply in addition. The subscription status is stored on your device and is not linked to your reports.

14. Retention

• Reports are permanently deleted no later than 90 days after they arrive. Before that they enter an anonymous statistic which we keep indefinitely. What exactly goes into it — and what does not — is set out in section 15.
• A report stays visible on the map for far less time: depending on the category it expires automatically after five times its decay period, which — counted from the last confirmation — is between roughly 10 hours (e.g. violence, feeling unsafe) and around 60 hours (drug scene). Persistent conditions such as “dark area” stay visible until deletion after 90 days.
• Confirmations are deleted together with the report they belong to.
• Device identifiers (hash and trust score) are retained for as long as they are needed for abuse protection. You can delete yours yourself at any time — in the app under Settings → My data, with immediate effect. Your reports and confirmations are not deleted but anonymised: the link to the device identifier is permanently removed, and the reports stay on the map as anonymous warnings until they expire normally or are permanently deleted after 90 days at the latest. Alternatively we delete the identifier on request by email — see Delete account & data.
• Push registration (push token, coarsened position, warning radius, categories, language, time zone offset): deleted when you switch the warning system off, on “Delete my data”, when the push token has become invalid — at the latest automatically after 90 days of inactivity. The send logs are deleted after 48 hours, the delivery receipts after 7 days.
• Location queries and IP addresses are never stored in the first place.

15. Anonymous long-term statistics

Before a report is deleted after 90 days, it enters an anonymous statistic which we keep indefinitely. It powers the history layer of the map and is the basis for our analyses of the safety situation.

What goes into it. Every report becomes a pure count:

• a cell of the map grid (H3, resolution 11, roughly 50 metres across) instead of the coordinate;
• the hour of the incident instead of the exact time, plus weekday and month;
• the category and the selected attributes from the fixed lists;
• the number of incidents and confirmations, and how long an area kept being reported;
• country and region, derived from the cell.

What does not. No device identifier, no coordinate, no exact timestamp — and no attribute that would let two entries be attributed to the same person. The statistic consists solely of counts per cell and hour; individual reports are not part of it and cannot be reconstructed from it. Rounding to a cell and an hour exists precisely for that reason: place and exact time together would be a recognisable trace even without an identifier.

What we publish from it is coarser still. Analyses that leave our house are coarsened further — to roughly 0.1 km² spatially, and to roughly 5 km² as soon as a time of day is carried along — and aggregated to the month. Cells with fewer than five incidents are dropped entirely. A published analysis therefore never contains a single event, only a pattern of at least five.

This statistic is not personal data within the meaning of Art. 4(1) GDPR; the rights in section 17 no longer apply to it. The act of condensing — processing your report into a count — is based on Art. 6(1)(f) GDPR. You may object to it under Art. 21 GDPR for as long as your report has not yet been condensed, i.e. within 90 days: email us at support@esbm-solutions.com quoting your device identifier and we will delete your reports before they are condensed.

16. Transfers to third countries

Google AdMob, RevenueCat and — only with your consent — TikTok process data (also) in the USA. Sentry and Supabase are US companies but store the data described here on servers in Frankfurt am Main; access from the USA is contractually safeguarded. If you switch the warning system on, the push token and the text of the notification are additionally transmitted to the Expo Push Service (Expo, Inc., USA) and from there to Apple or Google; your coarsened position stays with us. Transfers are based on the EU standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework), where applicable. Your reports and location queries do not leave Germany.

17. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Consent you have given — for instance to warnings — can be withdrawn at any time with effect for the future by switching them off in the app. You also have the right to lodge a complaint with a data protection supervisory authority.

You can exercise your right to erasure (Art. 17 GDPR) without going through us at all: in the app under Settings → My data, “Delete my data” removes your device identifier and its trust score, as well as any push registration together with the coarsened position stored in it, from our servers immediately and irreversibly. In the same step your reports and confirmations are anonymised — the link to your identifier is permanently removed, so that afterwards neither we nor any third party can establish which device a report came from. The anonymised reports stay on the map as a warning for others and are permanently deleted no later than 90 days after they arrive. Because they carry no personal reference once the link is gone, they are no longer personal data within the meaning of Art. 4(1) GDPR and are therefore no longer covered by the right to erasure. Whatever has already entered the anonymous statistic under section 15 stays there — it can no longer be traced back to you and therefore can no longer be deleted either. The same screen also shows you your device identifier.

A practical note for every other kind of request: because we deliberately store no contact details, we can only match a request to your data if you tell us your device identifier. Without that link we cannot provide information or carry out a targeted deletion — this is not a refusal but a consequence of data minimisation (Art. 11 GDPR).

18. Contact for privacy matters

For questions or to exercise your rights, contact: support@esbm-solutions.com.

Note: This text is a carefully prepared draft and does not constitute legal advice. We recommend having it reviewed by a lawyer before the official app launch.