LOOK UP!Privacy policy
Last updated: October 2026
1. Controller
Martin Herold, Herold IT-Service (sole proprietor)
Wilhelm-Liebknecht-Straße 18, 64846 Groß-Zimmern, Germany
Email: info@herolditservice.de
Phone: +49 151 20794769
We have not appointed a data protection officer. For any privacy question, contact us at the email address above.
2. Overview
This policy applies to the website lookup-app.de and to the LOOK UP! app. We process personal data only as far as it is needed to run the website and the app, for your account and the features you use, or if you have given consent. We do not set a minimum age for using the app.
3. Visiting this website
The website is hosted by OVH (OVH GmbH, Germany) in region DE1. When you open a page, the web server processes technically necessary data: IP address, date and time, requested page, amount of data, status code, and browser and operating system information (server log files). Log files are deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
4. The app: account and features
For the app we process the following data to perform the contract for using the app (Art. 6(1)(b) GDPR):
- Account: email address and password (stored as a hash). When you sign in with Apple or Google, the identifier and email address that provider sends us.
- Profile: username, display name, an optional profile picture, the "public or private profile" setting and experience points.
- Challenges: challenges you draw, start, complete, abandon or that expire, with timestamps and their visibility (private, friends, public).
- Social features: friend requests and friendships, the feed of released challenges and "Looks" (likes). If you release a post, your confirmed friends can see it. Everyone who can see the post sees the Look count. Only the creator of a post sees who gave a Look. If your profile is private, you cannot make posts public.
- Local data: settings such as language and consents are stored on your device. Local notifications (for example when a challenge is about to expire) are created on the device without sending data to us.
5. Email confirmation and emails
When you sign up or reset your password, we send you an email with a link. The link opens this website (the "verify" page), which forwards you to the app or the browser. The link contains a one-time token that is used only for the confirmation. We send these emails through the SMTP service of STRATO (STRATO AG, Berlin, Germany). The legal basis is Art. 6(1)(b) GDPR.
6. Hosting of app data (Supabase)
We store app data with Supabase (Supabase Inc., USA) in the Frankfurt region (eu-central-1, Germany). Supabase processes the data as our processor (Art. 28 GDPR). The data is stored in the EU. Access by Supabase from the USA cannot be ruled out completely. A data processing agreement with standard contractual clauses is in place.
7. Retention and deletion
We keep your data as long as your account exists. If you delete your account in the app, your account, profile, profile picture, challenges, Looks and friendships are deleted immediately. Database backups still contain the data for up to 7 days and are then overwritten. Statutory retention duties remain unaffected.
8. Google Analytics (website)
With your consent we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on the website to measure reach. Cookies are set and data such as visited pages, time on page, approximate location, device and browser is processed. The IP address is shortened. Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework. Event data is deleted after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google Analytics is only loaded after you agree. You can change your choice at any time with effect for the future via "Cookie settings" in the footer.
9. Usage analytics in the app (Firebase Analytics)
In the app we record usage events through Firebase Analytics (Google Ireland Limited) only with your consent, which is requested at first launch. We send only pseudonymous events, for example "challenge started" or "challenge completed", but no email address, name or user ID. Firebase technically processes device identifiers (for example the advertising or app instance ID), device model, operating system and app version. Data may be transferred to the USA (EU-US Data Privacy Framework). Event data is deleted after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in your profile under "Usage statistics".
10. Push notifications (planned)
We plan to use push notifications in the app through Firebase Cloud Messaging (Google) and the Apple Push Notification Service (Apple). This will process a device identifier (push token) and your notification setting. We only send push messages if you allow them on your device (Art. 6(1)(a) GDPR). You can withdraw the permission at any time in your device settings. We will update this policy before the launch.
11. Recipients
Recipients of your data are our service providers acting as processors: OVH (website hosting), Supabase (app data), STRATO (email delivery) and, where you consented, Google (analytics). Other app users only see the content you release to them. We do not sell data.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent at any time with effect for the future. To exercise your rights, write to info@herolditservice.de. You can delete your account in the app yourself.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.
14. Changes
We update this policy when the app or the law changes. The version published here applies.