Privacy Policy

§ 1 Introduction

Gnosis Service GmbH, Glogauer Straße 6, 10999 Berlin, Germany (“Gnosis”, “we”, “us”, “our”) operates the hiir App, a service that enables eligible users to discover and redeem offers from participating local merchants in a designated Berlin neighbourhood (“Kiez”) using a points-based system, and to receive a bonus in hiir Points on eligible purchases from shops in a Kiez other than businesses we exclude, as shown in the hiir App (the “Kreuzer-Bonus”), as part of a limited pilot programme (the “Pilot”). The hiir App is currently available as a web application at https://app.hiir.world/, as a mobile application for Android distributed via Google Play, and as a mobile application for iOS distributed via the Apple App Store (each a “Channel”). We may add or withdraw Channels at any time on reasonable notice.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the hiir App. It supplements our Terms of Participation.

Gnosis is the data controller within the meaning of Art. 4(7) GDPR for all processing described in this Privacy Policy.

For questions about this Privacy Policy or to exercise your data subject rights, contact us at: hello@hiir.world

§ 2 Information we collect

2.1 Account Data

When you access the hiir App, a local account is automatically generated. You do not create a username or password; your access credentials are stored locally on your device (in your browser’s local storage on the web app, or in the operating system’s secure keystore on the mobile apps). Clearing your browser data or uninstalling a mobile app will destroy these credentials, and your account will be permanently inaccessible unless you have activated email-based account recovery. During registration you are required to provide an email address through our Authentication Service Provider (Privy). Your email address is stored by Privy and is accessible to Gnosis. It is processed for account recovery, Pilot-related communications, user support, and, with your separate consent, our newsletter. To prevent fake or multiple accounts, we limit sign-ups per email address and per network (IP address). For this, we create a keyed hash of your email address and of your IP address (a character string from which the address cannot be calculated back). We keep the email hash for 1 day and the IP hash for 2 days (see § 7).

2.2 Location Data

The hiir App verifies your location to confirm you are within the designated Kiez. Verification occurs at account creation and may recur in connection with earning hiir Points or redeeming merchant Offers. You verify your location by sharing it through the hiir App or by scanning a QR code at a merchant location. Location verification via the hiir App requires you to explicitly grant location access when prompted by your browser or device. On the mobile apps, your operating system will request permission to use precise location; the hiir App requires precise location because an approximate position may fall outside a Kiez boundary. You may grant or revoke this permission at any time through your device or browser settings.

Each time the app checks your location, it sends your precise coordinates to our server. We use them only to confirm whether you are inside a Kiez. Our server keeps only the result (inside or outside a Kiez) and does not store your coordinates.

When we verify your location, we store a presence record on our servers. It includes:

your pseudonymous account identifier;
the verification method used;
the merchant, where applicable;
the Kiez;
a timestamp;
whether your phone reported the position as simulated, for example by a location-faking app; and
whether our server confirmed the position is inside a Kiez.

The record does not include your coordinates. A position your phone reports as simulated does not count for sign-up.

If you verify your presence at a merchant location (for example, by scanning a QR code), the presence record will show which merchant you visited and when, which means it also reveals your approximate location at that time. This record is retained for the duration of your participation and deleted upon account deletion (see § 7). Merchants do not receive your precise location data through the hiir App.

2.3 Pilot Activity Data and Distributed Ledger Data

Certain Pilot activity, including account creation, Kreuzer-Bonus credits and offer redemption events, is recorded on publicly accessible distributed ledger infrastructure. This data is associated with pseudonymous addresses that are not displayed in the hiir App and are not linked to your name or email address. It is immutable and cannot be modified or erased once recorded. See § 8 for the implications for your data subject rights.

2.4 Authentication Data (via Privy)

Our Authentication Service Provider, Privy (operated by Horkos, LLC d/b/a Privy), processes the following data in connection with account creation and login:

Online identifiers: email address (if provided), wallet address
Device and IP data: IP address, IP-based location information, device type, operating system, browser type
Web analytics data: referring webpage or source
Session data: authentication tokens used to maintain your session
Cryptographic key material: if you activate account recovery, encrypted key shares generated and held within a secure enclave to protect your wallet

Privy acts as a processor on behalf of Gnosis.

2.5 Analytics Data (via PostHog)

We use PostHog (PostHog, Inc.) for product analytics to understand how users interact with the hiir App and to improve our service. This includes session replay technology that records your on-screen interactions (such as clicks, scrolling and navigation). Where you have given your consent and are logged in, we may associate a pseudonymous account identifier with your analytics sessions to link activity across multiple sessions. PostHog may collect, in particular:

Technical information: IP address, browser type and version (web app), device model, operating system and version, app version (mobile apps), and pseudonymous account identifier (where you have given consent)
Usage information: referring website (web app), screens and pages visited, time spent on screens, session data, clicks, taps, swipes, form submissions, scroll behaviour, session replay recordings, and other interactions

For details on PostHog’s hosting location and cookie usage, see §§ 4.2 and 5.

2.6 Aggregate Visitor Metrics

We maintain a server-side counter, within the hiir App, that records aggregate visitor metrics (such as total page visits and whether a visit is from a new or returning device) without placing any tracking technology on your device and without collecting personal identifiers. This counter operates independently of the cookie banner and of PostHog. The resulting data is not linked to your account or any other information we hold about you.

2.7 Receipt Data (Kreuzer-Bonus)

If you take part in the Kreuzer-Bonus, you can submit a photo of a payment receipt from an eligible shop in a Kiez (see our Terms of Participation: https://hiir.world/en/app-terms) through the hiir App. On the mobile apps, your operating system will ask for permission to access your camera or photo library. You may grant or revoke this permission at any time through your device settings.

When you submit a receipt, we collect the receipt image and the information shown on it. We also store the text read from the image. This text is extracted on your device using its built-in text recognition (Apple Vision on iOS or Google ML Kit on Android). Neither the image nor the extracted text is sent to a third party for this processing. This typically includes the merchant’s name and address, the date and time of purchase, the items purchased, prices and the total amount, and the payment method used, which may include the card type and a partial (truncated) card number. Receipt images may also contain any other information visible in the photo and metadata embedded by your device (for example, the date and, depending on your device settings, the location at which the photo was taken). We also store your account identifier, the time of submission, and the outcome of our review, including the merchant, date and amount of the purchase, whether the receipt was approved or rejected, the reason for the decision, and the Kreuzer-Bonus granted, if any (together, “Receipt Data”).

We check each receipt to confirm that the purchase was made at an eligible shop in a Kiez and meets the Kreuzer-Bonus conditions set out in our Terms of Participation. For receipts from a till we have registered that carry its fiscal signature (an orderbird QR code, a Flatpay link or the signature printed on the receipt), our server verifies the signature and pays the Kreuzer-Bonus immediately. No one at Gnosis sees the photo, and we do not keep it. Authorised Gnosis personnel review every receipt our server cannot verify this way, whatever shop it comes from. Our server automatically declines a receipt if it is more than 24 hours old, has already been submitted, shows no amount eligible for a Kreuzer-Bonus or would exceed your own Kreuzer-Bonus limit or the shop’s Kreuzer-Bonus budget, or comes from a till we have already found to belong to a chain or a shop outside a Kiez. If you think we declined a receipt in error, you can contact us and a member of our team will review the decision. Receipt images are accessible only to personnel involved in reviewing submissions and handling related queries, and are not shared with merchants.

We retain receipt images, the text read from the image and any fiscal QR code data until we have reviewed your submission. After our review decision, we keep them for 7 more days so that we can respond to queries about approved or rejected submissions, and then delete them. If we have not reviewed a submission within 30 days, we delete its images, text and fiscal QR code data at that point. This means we keep them for no more than 37 days after you submit a receipt. If you delete your account, we delete your receipt images, the text read from them and any fiscal QR code data without undue delay. The review outcome is retained as described in § 7.

2.8 Feedback

You can send us feedback through the hiir App. When you do, we collect your message, your account identifier, the screen you sent it from, your language setting and the app version (“Feedback Data”). We do not store your email address with your feedback. If we reply, we retrieve your email address from Privy at that time and reply to the address shown in the feedback form.

§ 3 How we use your information

We process your personal data for the following purposes and on the following legal bases under Art. 6(1) GDPR:

Purpose	Data Categories	Legal Basis
Operating the hiir App, authentication, session management, and the Kreuzer-Bonus (including review of receipt submissions)	Account data, session data, authentication data (via Privy), Pilot activity data, Receipt Data	Art. 6(1)(b) (performance of contract)
Location verification	Location data (transient, not stored); presence records, including the simulated-position flag and our server’s result (inside or outside a Kiez) (stored, see § 2.2)	Art. 6(1)(b) (performance of contract)
Account recovery, user support, Pilot-related communications, and newsletter	Email address	Art. 6(1)(b) (performance of contract); Art. 6(1)(a) (consent), which you may withdraw at any time for the newsletter
Product analytics and service improvement	Analytics data (via PostHog) including session replay recordings, crash reports and diagnostic data, pseudonymous account identifiers, and app-specific technical data (device model, OS version, app version on mobile apps)	Art. 6(1)(a) (consent) for analytics and session replay; Art. 6(1)(f) (legitimate interest in service stability) for crash reports and diagnostics
Recording Pilot activity on distributed ledger	Pseudonymous on-chain identifiers, transaction data	Art. 6(1)(b) (performance of contract)
Enforcing our Terms (including preventing fraudulent or duplicate Kreuzer-Bonus claims, preventing fake or multiple accounts and handling queries about receipt review decisions); compliance with legal obligations	Account data, Pilot activity data, Receipt Data, keyed hashes of email and IP address; as required	Art. 6(1)(f) (legitimate interest); Art. 6(1)(c) (legal obligation)
Responding to feedback and improving the hiir App	Feedback Data, email address (retrieved from Privy when we reply)	Art. 6(1)(f) (legitimate interest in answering your feedback and improving the hiir App)

Your email address will not be shared with merchants. We will use your email address to send you a newsletter only with your separate consent, which you may withdraw at any time with effect for the future.

§ 4 Third-Party Service Providers

4.1 Privy (Authentication)

Provider: Horkos, LLC d/b/a Privy Role: Data processor on behalf of Gnosis Purpose: Account creation, authentication, session management, account recovery

Privy’s privacy policy is at https://www.privy.io/privacy-policy. Privy’s subprocessor list is at https://trust.privy.io/subprocessors. Privy has appointed GDPR Art. 27 representatives: DP-Dock GmbH in Hamburg (EU) and DP Data Protection Services UK Ltd. in London (UK).

4.2 PostHog (Analytics)

Provider: PostHog, Inc. Role: Data processor on behalf of Gnosis Purpose: Product analytics, usage analysis, service improvement Hosting: PostHog Cloud EU, Frankfurt, Germany

All analytics data is processed and stored on PostHog Cloud EU infrastructure in Frankfurt. Your analytics data does not leave the European Union. PostHog does not use third-party cookies or third-party tracking services. PostHog Cloud EU defaults to disabling IP data capture for EU organisations; where disabled, IP addresses are not stored alongside analytics events.

PostHog’s privacy policy is at https://posthog.com/privacy.

4.3 Infrastructure Services

The hiir App uses the following services to operate the points and wallet system and to protect it against misuse:

Blockchain infrastructure (in particular Gnosis Chain RPC, Circles RPC and Profile Service, Safe Transaction Service, Pimlico): these services receive your IP address and pseudonymous on-chain account identifiers in connection with account creation, wallet operations, and transaction processing. They do not receive your name or email address. Data flows occur before and independently of your analytics consent.

App integrity checks (in particular Apple App Attest on iOS, Google Play Integrity on Android): we use these services to check that requests come from the genuine hiir App on a real device. Apple or Google receives device and app integrity data for this check. We store one key identifier for each installation of the App until you delete your account. These checks also take place independently of your analytics consent.

Provider: Loops (United States)

Role: Data processor on behalf of Gnosis

Purpose: Newsletter delivery

Data received: Your email address is transmitted to Loops on a server-to-server basis if you have opted in to the newsletter. Loops processes and stores this data in the United States.

4.5 OpenFreeMap (Map Tiles)

Provider: OpenFreeMap

Purpose: Displaying map tiles within the hiir App

Data received: IP address and map viewport on each map load. This occurs before and independently of your analytics consent. OpenFreeMap does not set cookies or store identifiers on your device.

4.6 Unsplash (Merchant Images)

Provider: Unsplash

Channels: Mobile apps only

Purpose: Displaying fallback merchant photographs

Data received: IP address on each image request

4.7 Browser Push Notifications (Web App)

If you enable browser push notifications, notification delivery is handled by your browser vendor’s push service (operated by Google, Mozilla, or Apple, depending on your browser). These services receive a push token associated with your device. Push notifications are not enabled by default.

4.8 Hosting and Infrastructure

Provider: Netlify (web app and API hosting); DigitalOcean (application database, Frankfurt, Germany)

Data received: Netlify hosts the web app and processes all API requests, including those from the mobile apps. Netlify’s server request logs, which include IP addresses, are stored in the United States. The application database on DigitalOcean stores the data described in §§ 2 and 7.

§ 5 Cookies, Device Storage and similar Technologies

The hiir App uses cookies (on the web app) and device storage (on the mobile apps) for authentication and analytics. The mobile apps do not set cookies; they store data using the operating system’s secure keystore (for your account key) and ordinary application storage (for your account address, language preference, consent status, presence stamp, notification preferences, onboarding status, location-sharing preference, and, temporarily, the email address provided for the newsletter until confirmed by the server).

5.1 Essential / Authentication Cookies (Privy)

Privy sets essential cookies (session and functional) to maintain your authenticated session. These are strictly necessary and cannot be disabled without losing access to your account.

5.2 Analytics Cookies (PostHog)

PostHog uses a single first-party cookie (ph_<project_api_key>_posthog, 365-day expiry) to store your session identifier, device identifier, and configuration data. PostHog may also use your browser’s localStorage. These technologies support all PostHog analytics features described in § 2.5, including session replay. No third-party cookies are set. All data collected through these cookies is sent to PostHog Cloud EU in Frankfurt (see § 4.2).

Essential cookies are required for the hiir App to function. Disabling them may prevent access.

Analytics: PostHog analytics tracking, including session replay, is activated only after you consent via our cookie banner (web app) or the equivalent consent prompt (mobile apps). If you decline, no analytics data will be collected and no session replays will be recorded.

You can also manage cookies in the app and through your browser settings. Clearing your browser data may result in loss of access to your account if you have not activated email-based account recovery.

Cookie / Technology	Provider	Purpose	Type	Duration	Data Residency
Authentication session cookies	Privy	Login and session management	Essential (first-party)	Session	US (see § 10)
Functional cookies	Privy	Preferences and auth state	Essential (first-party)	Session / persistent	US (see § 10)
ph_<key>_posthog	PostHog	Product analytics	Analytics (first-party)	365 days	EU (Frankfurt)
localStorage entries	PostHog	Analytics data persistence	Analytics (first-party)	Until cleared	EU (Frankfurt)

We share personal data with: (a) our processors, as described in § 4; (b) public distributed ledger infrastructure, as described in § 2.3; (c) authorities, where required by applicable law, regulation, legal process, or governmental request; and (d) an acquiring entity in connection with a reorganisation, merger, acquisition, or transfer of the Pilot.

Merchants do not receive your personal data through the hiir App. We do not sell your personal data.

§ 7 Data Retention

We retain personal data only as long as necessary for the purposes described in this Privacy Policy:

Account data and email address: retained for the duration of your participation. Deleted upon account termination or Pilot discontinuation, subject to legal retention obligations.
Location data: we do not store your coordinates. Our server processes them only to check whether you are inside a Kiez, then discards them immediately (see § 2.2).
Presence records: we keep these until you delete your account or the Pilot is discontinued (see § 2.2). Each record holds the verification method, the merchant where applicable, a Kiez, a timestamp, the simulated-position flag and our server’s result (inside or outside a Kiez).
Sign-up hashes: we keep the hash of your email address for 1 day and the hash of your IP address for 2 days, then delete them.
Analytics data: retained on PostHog Cloud EU (Frankfurt) per our analytics configuration. You may request deletion at any time (see § 8).
Distributed ledger data: recorded permanently and cannot be modified or erased (see § 2.3).
Authentication data (Privy): retained as long as you have an active account or as necessary to provide the service, with longer retention where required by law.
Receipt Data: receipt images, the text read from them and any fiscal QR code data are deleted 7 days after our review decision. If we have not decided on a receipt within 30 days of submission, we delete them then (see § 2.7). The review outcome (including the merchant, date and amount of the purchase, the decision and the Kreuzer-Bonus granted) is retained for the duration of your participation. When your account ends or the Pilot is discontinued:
for receipts that did not result in a Kreuzer-Bonus payment, we delete the review outcome; and
for receipts that resulted in a payment, we erase any remaining photo and fiscal QR code data and keep the review outcome as a payment record as required by applicable rules.
Feedback Data: deleted 90 days after you send it, or earlier if you delete your account.

§ 8 Your Rights as a Data Subject

Under Articles 15–21 GDPR, you have the right to:

Access your personal data (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data, subject to legal retention obligations (Art. 17)
Restrict processing under certain circumstances (Art. 18)
Receive your data in a portable format (Art. 20)
Object to processing based on legitimate interests, including analytics (Art. 21)

To exercise these rights, contact us at hello@hiir.world.

Distributed ledger limitation: On-chain data is immutable (see § 2.3). Where you exercise your right to erasure, we will delete all personal data within our control, including the mapping between your account and your pseudonymous on-chain address, rendering the on-chain data practically unidentifiable.

Supervisory authority: You may lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the supervisory authority of your habitual residence.

§ 9 Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and the data minimisation measures described in § 2 (local credential storage, transient location processing, pseudonymous on-chain identifiers). Our service providers maintain their own security and compliance programmes.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately at hello@hiir.world.

§ 10 International Data Transfers

Privy (Authentication): Privy’s services are hosted in the United States. International transfers are carried out on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR and transfer impact assessments.

PostHog (Analytics): Analytics data is processed and stored exclusively within the EU (see § 4.2). No international transfer safeguards are required.

Netlify (Hosting and API): Netlify’s serverless functions that process API requests are hosted in Frankfurt, Germany. Server request logs, which include IP addresses, are stored in the United States on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Loops (Newsletter): Newsletter email addresses are processed and stored in the United States on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Distributed ledger: Data recorded on a public distributed ledger is accessible globally. This data consists of pseudonymous identifiers as described in § 2.3.

§ 11 Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our data practices or applicable law. Material changes will be notified at least 7 days in advance by email or in-app notice.

§ 12 Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Germany. Your rights under the GDPR and applicable German data protection law (including the BDSG) remain unaffected.