Privacy statement

Last updated: 2026-07-11

Who we are

GeoTour Passport is operated from the Netherlands and is the controller for the player data described below. Two other parties play their own role: Geocaching.com (Groundspeak, Inc.) is an independent controller for your Geocaching.com account, and the tourism boards behind each GeoTour never receive player-level data from us — at most aggregate statistics such as how many finds a tour had.

What we collect

When you sign in with your Geocaching.com account, we store:

your Geocaching.com account identifier, username and display name — this is how you log in and how we can check your "Found it" logs;
your find records: which cache you found, when, and whether the find was verified;
your reward claims: the claim code and when it was issued and redeemed;
login sessions and tokens, so you stay signed in.

To keep the app and service reliable we also process crash reports with device metadata (via our error-reporting service) and short-lived technical server logs (IP address, user agent).

We never upload or store your GPS location. The app uses your device's live location only on the device itself — to show the map, distances and compass bearings. The only location-adjacent fact we store is that you found a specific cache at a specific time.

We deliberately do not collect:

email addresses or phone numbers
contacts or photos
background location or movement traces
advertising identifiers or behavioural analytics

We do not request your email address from Geocaching.com; should the sign-in technically require it at some point, we will update this statement first.

Why we process it

To provide the service (contract): your account, find records, reward claims and sessions — without these the passport simply doesn't work.
Legitimate interest: fraud prevention around reward claims, crash reporting and technical server logs for security and debugging.
Consent: anything optional we may add later, such as push notifications or beta feedback — always opt-in.

How long we keep it

Account, find records and reward claims: for the life of your account. Reward claims may be kept for a short window after redemption to handle disputes.
Sessions and tokens: until they expire or you sign out.
Crash reports: at most 90 days.
Server logs: at most 30 days.

Who else sees data

Geocaching.com (Groundspeak, Inc., United States): handles your sign-in, and our server queries their API for your "Found it" logs.
Our hosting provider: runs our servers in the European Union.
Our error-reporting service (Sentry): receives crash reports, stored in the EU.
Map data (based on OpenStreetMap) is downloaded from our own servers as prepackaged tour bundles — no third-party map service receives requests from your device.

We never sell personal data.

Your rights

Under the GDPR you can access, correct, export, delete and object to the processing of your personal data. Export and deletion are built into the app: in the app's settings you can download your data or delete your account — no email required. Deleting your account removes your account, find records and reward claims.

You can also lodge a complaint with your data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

Contact

Questions about privacy? Email us at hello@geotour-passport.example.

Changes to this statement

When this statement changes in a way that matters, we will announce it in the app and update the date at the top of this page.