This policy explains what personal data BagLog collects, why, and what your rights are. The data controller (verantwortliche Stelle) within the meaning of Art. 4 No. 7 GDPR is Thomas Eichinger, Lindenstraße 12, 84332 Hebertsfelden, Germany ("we"). Contact: contact@baglog.space. BagLog is operated from Germany and available to users worldwide.

1. Data we collect

• Account: email address, password (hashed), date of birth, derived age, account creation date.
• Profile: display name, optional avatar, privacy preferences (show profile photo, name, age, country, bio, nearby city).
• Inventory: containers, items, categories, photos, sizes, conditions, trade notes that you create.
• Trade & chat: messages you send, who you block / mute / report and the reason, intro-message counters, ratings.
• Location: only approximate, area-based location. Coordinates are rounded to roughly 1 km client-side before being saved. We do not collect or store exact GPS coordinates and we do not track you in real time.
• Push notifications: if you enable push, we store the browser push endpoint and the cryptographic keys your browser generates so we can deliver notifications about chat messages and safety reports. We do not use push for marketing. You can revoke it any time in your browser settings or in Profile.
• Internal product analytics: a small, first-party event log of which area of the App you opened (for example "inventory" or "trade") tied to your account ID. We use this to see which features are actually used. We do not load Google Analytics, Meta Pixel, or any third-party tracker.
• Technical: authentication session tokens, basic device/browser info, error logs needed to keep the App working.

We do not collect phone numbers, postal addresses, payment data, precise location, or marketing trackers.

2. Why we use it (legal bases, GDPR)

• Contract performance — Art. 6(1)(b) GDPR: running your account, showing your inventory, delivering chat messages, enabling trades.
• Legal obligation — Art. 6(1)(c): enforcing the 18+ age limit, responding to lawful requests.
• Legitimate interest — Art. 6(1)(f): keeping the service secure, preventing abuse, handling reports and blocks. You can object at any time.
• Consent — Art. 6(1)(a): for any optional feature that requires it; you can withdraw at any time.

3. Who can see what

• Your inventory is private to you by default.
• Items you mark as available for trade are visible to verified BagLog users on the trade marketplace.
• Your messages are visible only to you and the recipient.
• If you block someone, your profile and items become invisible to them.
• Exact GPS coordinates are never shown to other users. Only your closest city (within about 15 km) is shown.
• We never sell your data. We never share it with advertisers.

4. Sub-processors (Auftragsverarbeiter)

• Lovable Cloud (managed backend, hosting, database, file storage, authentication).
• Email provider for transactional email (verification, password reset).

These providers process data on our behalf under a data processing agreement (Art. 28 GDPR) and may host data in the EU and/or the United States. Where data is transferred outside the EU/EEA, transfers rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5. Retention

• Account data: kept while your account exists.
• Messages: kept until you or your chat partner delete them, or your account is deleted.
• Reports: kept up to 24 months for safety enforcement.
• After account deletion: removed from live systems within 30 days; encrypted backups rotate out within 90 days.
• We may retain reports, moderation history, blocked-content evidence, and the minimum account identifiers needed to enforce bans after account deletion where reasonably necessary for legal compliance, fraud prevention, or user safety (typically up to 24 months).

6. Your rights

Under the GDPR (and equivalent rules under UK GDPR and other regimes where applicable) you can:

• access your data (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20) — you can export your data directly from Profile → Download my data
• object to processing based on legitimate interest (Art. 21)
• lodge a complaint with a supervisory authority (Art. 77)

To exercise any right, email contact@baglog.space. We respond within 30 days. Users in the UK have equivalent rights under the UK GDPR; users in California may exercise rights under the CCPA where applicable.

7. Supervisory authority

You may lodge a complaint with the competent supervisory authority. For BagLog, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also contact the authority of your habitual residence or place of the alleged infringement.

8. Children

BagLog is an 18+ service. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

9. Security

Passwords are stored hashed. Connections are encrypted in transit (HTTPS). Access to production data is limited to authorised personnel. Row-level security restricts every record to its owner. No system is perfectly secure: please use a strong, unique password.

10. Image metadata (EXIF / GPS)

Photos you upload to BagLog are re-encoded on your device before being sent to our servers. EXIF metadata — including GPS coordinates, camera serial numbers, original timestamps, and device information — is stripped automatically. Photos are also resized to a maximum of 2048 px on the longest edge.

11. Cookies & local storage

We use only strictly necessary storage (your authentication session and a few UI preferences). See the Cookie & Local Storage Policy. No cookie consent banner is required under §25(2) TTDSG/TDDDG.

12. Changes

We will notify you in-app of material changes to this policy. This English version is the authoritative version; a German translation can be provided on request.