Last updated: October 2026
This privacy policy applies to the website loco-app.de (including its subpages and the subdomain open.loco-app.de for invite and app links) and to the “Loco App” for iOS and Android. It explains which personal data we process, for what purpose and on what legal basis, and what rights you have.
Lukas Wilke
Heisterbacher Straße 28
53639 Königswinter
Email: support@loco-app.de
We have not appointed a data protection officer, as there is no legal obligation to do so.
The website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit the website, technically necessary data transmitted by your browser is processed: IP address, date and time, page visited, referrer URL, browser type and version, and operating system. This data is used to deliver the website and to keep it stable and secure (Art. 6(1)(f) GDPR) and is not combined with other data. We have a data processing agreement with STRATO.
The website does not set any cookies for visitors and does not use any third-party tracking or advertising services. Fonts and scripts are loaded from our own server; no connections to third-party servers are made when you visit the website. Technically necessary cookies are only set when administrators log in to the website’s admin area.
To understand how many people visit the website, which countries and cities they come from and how they find us, we use the open-source software Matomo. Matomo runs on our own web server at STRATO; the data is not shared with third parties. Matomo does not set cookies and does not store anything on your device.
The following is processed: pages visited, date and time, time spent on the page, referrer URL, links clicked to other websites, browser, operating system, device type, language setting and your IP address. When you visit, your approximate location (country, region, city) is determined from the IP address; the IP address is stored only in shortened form (without the last two bytes), so that we cannot attribute visits to a person. The legal basis is our legitimate interest in statistically analysing and improving the use of the website (Art. 6(1)(f) GDPR). We delete the individual visit data after six months; after that, only aggregated statistics without any personal reference remain.
You can object to this at any time: if your browser sends the “Do Not Track” signal, Matomo does not record your visits. You can also send us your objection by email to support@loco-app.de.
At open.loco-app.de we provide pages that are opened when invite and app links are used and for account actions (e.g. confirming an email address, resetting a password). These pages are run on Google’s Firebase App Hosting. When they are opened, technically necessary connection data (IP address, date and time, page visited, browser details) is processed to deliver the page and – for invites – to show the event preview or open the app. Account actions are carried out via Firebase Authentication. The legal basis is Art. 6(1)(b) or (f) GDPR.
The website links to our Instagram profile. You are only taken to the respective provider when you click such a link; that provider’s privacy policy then applies.
You need an account to use the app. Mandatory information is an email address (or signing in with a Google account) and a username; without this information we cannot create an account. All other information – first and last name, profile picture, bio – is voluntary. You can use the website without providing any data yourself; only the technically necessary connection data is processed.
To use Loco, you create an account – with an email address and password or with your Google account (“Sign in with Google”). We process your email address, your username, optionally your first and last name, profile picture and bio, and technical login data. If you sign in with Google, we receive your account data from Google (e.g. email address and name). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Your username, name, profile picture and bio are visible to other users.
When you create an event, we store its details (e.g. title, date, location, description, cover image), the guest list and the acceptances and declines. You can invite guests with an invite link; anyone who receives the link can view the invite. You can generate a new link at any time, which makes the old one invalid. The legal basis is Art. 6(1)(b) GDPR.
We store messages, photos and documents that you share in chats or in an event’s gallery in order to show them to the respective participants. Please only share photos of other people with their consent. The legal basis is Art. 6(1)(b) GDPR.
When you send a request to a venue, we pass on your request (e.g. date, occasion, message) and your profile name to the venue’s provider. Offers, bookings and the related chat are stored for both sides. Any rental contract is concluded exclusively between you and the venue. The legal basis is Art. 6(1)(b) GDPR.
When you list a venue, we process the venue’s details (e.g. name, address, description, images, amenities, prices, availability) and review them before they are published. To check the address, we use Google’s Address Validation API. The published details are visible to all users. The legal basis is Art. 6(1)(b) GDPR.
Only if you allow it in your device settings does the app use your location to show you venues near you. You can withdraw this permission at any time in your device settings. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
The app only accesses your camera, photo library and files if you allow it and take a picture or choose a file yourself, for example for your profile picture, an event, a chat or the gallery. Only the content you select is uploaded.
For map views we use Apple MapKit JS from Apple Inc. When a map is displayed, technically necessary data such as your IP address and the map section shown is transmitted to Apple (Art. 6(1)(b) and (f) GDPR).
If you allow notifications, we store a device token so we can send you updates, e.g. about new messages, RSVPs or requests. They are delivered via Firebase Cloud Messaging (Google) and the Apple Push Notification service or the Google services on Android devices. You can turn notifications off at any time in your device settings (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
For emails to confirm your email address, to reset your password and for similar account notices, we use the email service Resend. Your email address and the content of the email are processed (Art. 6(1)(b) GDPR).
We store friendships and blocks in order to control the visibility of profiles and messages accordingly. If you report content, profiles, chats or venues, we store the report, the reason and a copy of the reported content in order to review the case and act on violations of our community guidelines (Art. 6(1)(f) GDPR – protecting users and the platform).
To prevent abuse, the app uses Firebase App Check to verify that requests come from a genuine installation of the app. If errors occur, the app sends error reports to the service Sentry. These contain technical details (e.g. device type, operating system, app version, error trace) as well as your IP address and, where applicable, your user ID. The legal basis is our legitimate interest in a secure and error-free app (Art. 6(1)(f) GDPR).
The app stores settings and cached content locally on your device so that it loads faster. This data is used solely for the app to work (§ 25(2) no. 2 TDDDG). The app contains no advertising and no analytics or tracking services.
We use the following service providers as processors:
Where data is transferred to the USA, this is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified under it, and additionally on the European Commission’s standard contractual clauses.
For downloading the app, the privacy policies of Apple (App Store) or Google (Google Play) also apply; we have no influence on that processing.
We only store your data for as long as is necessary for the respective purpose:
You can request the deletion of your account at any time by email to support@loco-app.de.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future, e.g. by turning off location or notification permissions in your device settings. Just contact us at support@loco-app.de.
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Venues and reported content are reviewed by people.
Transmission between your device or browser and our servers is encrypted (TLS). Access to data is limited to the people who need it to operate Loco.
We update this privacy policy when Loco or the legal requirements change. The version published here applies.