Mons
English

Privacy Policy for the Mons App and Website

1. General

Mons is an app that helps you identify the mountains and peaks around you. This Privacy Policy applies to the Mons app and the website mons-app.com.

The controller responsible for processing personal data is OSTREUM GmbH, Leopoldstr. 53, 80802 Munich, Germany ("we", "us" or "our").

If you have questions about data protection, you can reach us at this address or by email at privacy@mons-app.com.

Last updated: October 23, 2026

2. Summary

You do not need a user account to use Mons. Mons processes your location, the camera image and your photos only on your device; they are not transmitted to us. Mons does not transmit any data that allows us to identify you directly – no name, email address or phone number, no user account, no advertising ID and no precise location data. Only technical and pseudonymous data required for area downloads, online search, the profile backup, error reports and usage statistics is sent to our servers. You can turn off the profile backup, error reports and usage statistics in the settings. We do not sell your data, do not show advertising and do not use any third-party advertising or analytics services in the app.

3. What Data Does Mons Process?

3.1 Location

When you first start Mons, the app asks whether it may access your location while you are using it. Mons uses your location to calculate the panorama and the peaks for your viewpoint and to offer you suitable area data. These calculations take place entirely on your device; your exact coordinates are not transmitted to us. Mons does not access your location in the background. If you decline access, you can choose your viewpoint manually. You can change this permission at any time in your device settings.

3.2 Camera and Sensors

Mons asks for access to the camera only when you open the camera view. The camera image is processed only on your device in order to overlay the peak names correctly and to improve the alignment. It is not transmitted to us. The same applies to data from the compass, orientation and motion sensors.

3.3 Your Photos

When you take a photo in Mons, the app stores the original, the location and direction of the shot and your edits only on your device. We have no access to them, and photos are not part of the profile backup (see 3.6). Mons also excludes your photos from your device backups (such as iCloud or Google backup). If you want to keep photos, please export them before changing devices or deleting the app.

Mons accesses your photo library only when you export a photo to it. Exported and shared images do not contain location coordinates in their file metadata. However, visible peak names may reveal where a photo was taken.

You can pass on photos to other apps or people using your device's share function. Photos are passed on only if you actively trigger this and choose the receiving app yourself. The privacy notices of the receiving app apply to its processing.

3.4 Area Downloads

When you download terrain and peak data for an area, Mons retrieves the required data tiles from our server. In doing so, technically necessary connection data such as your IP address, the time and the requested tiles are processed. The requested tiles allow an approximate conclusion as to which region you are interested in. We do not keep access logs of these retrievals.

To protect our data against abusive bulk retrieval, Mons uses the interfaces provided by Apple (App Attest) or Google (Play Integrity) during downloads to check whether the request comes from an unmodified Mons app on a genuine device. Apple or Google processes information about your device and the app for this purpose and only tells us the result of the check. In addition, we count downloads per device and day using a random device identifier in order to enforce limits.

3.5 Online Search

When you search for a peak online, Mons transmits your search term and the app language to our server. Mons does not transmit your location; the app calculates distances and directions on your device. We process your IP address only briefly in memory in order to limit the number of requests per sender. Our logs contain neither the search term nor your IP address, only technical information such as status, length of the search term, number of results and response time. Offline, Mons searches only the data downloaded to your device.

3.6 Profile Backup

So that you can restore your data on a new device, Mons backs up by default your favorites, your saved viewpoints (name, position, observer height and, where applicable, a chosen date and time), your transferable settings and small technical states on our servers. Mons does not back up photos. Saved viewpoints contain coordinates that you have chosen yourself; they may, for example, reveal your home or favorite destinations.

For the profile backup, Mons uses a random, pseudonymous profile identifier and a secret access key. We do not need a user account, your name or your email address for this. So that you can access your profile backup again after changing devices, Mons stores the access key in encrypted form in your operating system's backup and transfer functions (on iOS via Apple, on Android via Google). The privacy notices of Apple or Google apply to these functions.

When connecting to our servers, the time and status of the request and technically necessary connection data such as your IP address are also processed.

You can turn off the profile backup in the settings at any time. Independently of this, you can delete an existing profile backup on our servers there.

Independently of the profile backup, your favorites, viewpoints and settings may also be included in the backups of your device that you manage via your operating system. Mons excludes photos and area data from these backups.

3.7 Error Reports

If Mons crashes or freezes, the app creates a technical error report and sends it to our server the next time it starts. The report contains the type of error, a cleaned-up error message, the affected code locations, app and operating system version, device model, the approximate screen area, the time and a random installation identifier that is used only for error reports and is not linked to any other data. We remove numbers that could be coordinates, as well as email addresses and file paths, before sending and again on the server.

Error reports do not contain your location, search terms, photos, favorites or viewpoints, or any advertising or device identifiers. Your IP address is not stored. On iOS, the operating system provides us with crash and hang reports via MetricKit only if you have allowed sharing analytics data with app developers in the iOS settings.

Error reports are turned on by default. You can turn them off at any time in the Mons settings; Mons will then no longer send error reports.

3.8 Usage Statistics

So that we understand how Mons is used and can improve the app in a targeted way, Mons collects usage statistics. These include, for example, on which days the app is used, which features and views are used, whether photos are shared, how often areas are downloaded and used offline, and in which broad regions (such as country or mountain region) Mons is used. The app determines the broad region on your device; we do not collect exact coordinates, movement histories, search terms or the content of photos, favorites or feedback.

The statistics use a random, pseudonymous identifier that is separate from the profile backup, error reports and purchases and is not linked to them. We evaluate the data only in aggregated form and do not attempt to identify individuals.

Usage statistics are turned on by default. You can turn them off at any time in the Mons settings; Mons will then no longer send statistics data.

3.9 Ratings and Feedback

Mons occasionally asks for your opinion of the app. We store your answers in order to improve Mons.

3.10 Contact and Support

If you contact us by email, for example via "Help & Feedback" in the app, we process your email address, your message and the date and time in order to handle your request. Mons suggests technical information such as app version, operating system and device model for troubleshooting. This information is visible in the email, and you can delete it before sending. If you write to us by post, we process your address and your letter accordingly.

3.11 Purchase via the App Store

You buy Mons in the Apple App Store or on Google Play. The respective app store is responsible for the purchase and payment and processes your account and payment data under its own responsibility. We do not receive any payment data or information that identifies you as a buyer. From the app store, we receive only aggregated sales and billing reports, such as the number of purchases per country, and, where applicable, information about refunds.

3.12 Links to Other Websites

The peak details contain links to OpenStreetMap, GeoNames and, where available, Wikipedia. If you open a link, you leave Mons; the privacy notices of these websites apply to their processing.

3.13 Website mons-app.com

Hosting and server log data: Our website is provided via Amazon Web Services (see Section 6). In particular, your IP address, the date and time of access, the page or file accessed, the previously visited page, browser type and version, operating system, amount of data transferred and the HTTP status code may be processed in order to deliver the website, detect technical errors, ensure its security and prevent misuse. Insofar as access logs are stored in the hosting infrastructure, we delete them after seven days at the latest, unless longer storage is exceptionally necessary to investigate a specific security incident or to comply with a legal obligation.

Storage of your cookie choice: So that we can remember your decision in the cookie banner, we store the version of the prompt, the selected categories and the time of your decision in your browser's local storage. This information remains on your device until you change your decision, clear your browser's local storage or we introduce a new version of the prompt.

Google Analytics: If you expressly consent in the cookie banner, we use Google Analytics 4 on the website, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics processes in particular information about pages visited, time and duration of the visit, approximate location, previously visited page, browser, device, operating system, language settings and interactions with the website. Your IP address is also transmitted to Google and processed there for technical delivery and to derive approximate location information. We use this information to understand how our website is used and to improve it. Google Analytics is loaded only after you have consented. We have disabled advertising and personalization features as well as Google Signals. The retention period for user-level event data in Google Analytics is two months; cookies set by Google Analytics may remain on your device for up to two years unless you withdraw your consent earlier. Google Analytics is used only on the website, not in the app, and is not linked to any data from the app. For more information, please see Google's privacy notices (policies.google.com/privacy).

Withdrawal: You can withdraw your consent or change your choice at any time with effect for the future using the "Cookie settings" button at the bottom of the website. If you withdraw your consent, we deactivate Google Analytics and attempt to delete the cookies set by Google Analytics on our domain.

3.14 Required Information

You do not have to provide any personal information to use Mons. Location and camera access are voluntary; without them, some features are not available or only to a limited extent. You can turn off the profile backup, error reports and usage statistics without restricting the other features of Mons.

4. For What Purposes and on What Legal Basis Do We Process Data?

4.1 We process area downloads, online search and the profile backup in order to provide you with the features of Mons that you use. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). The profile backup is turned on by default because it is part of the agreed service; you can turn it off at any time. Storing the identifiers and keys required for this on your device is strictly necessary for these features that you have requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

4.2 We process technical connection data, rate limits and abuse protection for downloads and search in order to operate our servers securely and reliably and to prevent misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure operation and the protection of our systems and data. Insofar as information is stored on or read from your device for this purpose, this is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG).

4.3 We process error reports in order to detect and fix crashes and errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stability and security of Mons.

4.4 We process usage statistics and your answers to our rating prompt in order to understand which features and areas are used and how you like Mons, and to develop Mons accordingly. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving and developing Mons in line with demand. We limit collection to pseudonymous, broad information without exact location data and evaluate it only in aggregated form.

4.5 We process data from support requests in order to handle your request. The legal basis is Art. 6(1)(b) GDPR insofar as handling the request is necessary for the performance of the user agreement, and otherwise Art. 6(1)(f) GDPR; our legitimate interest then lies in handling your request.

4.6 We process sales and billing data in order to comply with our obligations under commercial and tax law (Art. 6(1)(c) GDPR). Insofar as we must process or retain data in order to comply with any other legal obligation, the legal basis is also Art. 6(1)(c) GDPR.

4.7 Website: The processing of server log data and the storage of your cookie choice are based on Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website and in respecting your choice. Access to your browser's local storage for your cookie choice is based on Section 25(2) no. 2 TDDDG. We use Google Analytics only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

4.8 Mons does not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. How Long Is Your Data Stored?

5.1 Data on your device (photos, area data, favorites, viewpoints, settings) remains there until you delete it in the app or remove Mons and its app data from your device. Favorites, viewpoints and settings may also be included in a device backup that you manage (see 3.6).

5.2 We store your profile backup for as long as you use it. If you delete it in the app, we delete the server data without undue delay. If a profile backup has not been used for five years, meaning it has been neither updated nor retrieved, we delete it automatically. Merely deleting the app does not immediately remove an existing profile backup.

5.3 We delete error reports automatically after 180 days.

5.4 We delete usage statistics data with a pseudonymous identifier five years after the last use of the app recorded under that identifier. After that, we use only aggregated evaluations without any personal reference.

5.5 We delete technical connection data processed briefly for rate limiting as soon as it is no longer needed for that purpose; for online search, it remains only in memory. We delete other data stored on our servers as soon as it is no longer needed for its purpose, and no later than five years after the last use. The periods stated in 3.13 apply to the website.

5.6 We delete personal data from a contact request as soon as your request has been resolved, unless statutory retention obligations prevent this.

5.7 We retain sales and billing records in accordance with the statutory retention periods (accounting records eight years, commercial and business correspondence six years, annual financial statements ten years).

5.8 In all cases: insofar as we must continue to store individual data due to a legal obligation or need it to establish, exercise or defend legal claims, we restrict processing to that purpose and delete the data as soon as the reason no longer applies.

6. Recipients and Service Providers

We do not sell your data and do not pass it on for advertising purposes.

For hosting and operating our servers and delivering the area data and the website, we use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Our servers are located in the Frankfurt am Main data center region. For fast delivery of the area data and the website, we use the content delivery network Amazon CloudFront, which answers requests from the location closest to you; this may be outside the European Union. AWS processes the data solely on our behalf and in accordance with our instructions on the basis of Art. 28 GDPR.

When you send us an email, it is transmitted via the email provider you have chosen to the email service we use, Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which processes the data on our behalf.

When you purchase, download and update the app, when app integrity is checked and when your access key is backed up, Apple or Google processes data under its own responsibility. For more information, please see the privacy notices of Apple (apple.com/legal/privacy) or Google (policies.google.com/privacy).

If you consent to Google Analytics on our website, Google Ireland Limited processes the data described in 3.13 (see also Section 7).

We pass on personal data to other recipients only if this is necessary to provide Mons or to handle your request, if you have consented beforehand, or if we are legally obliged to do so.

7. Transfers to Countries Outside the EU

Our processors may belong to a parent company outside the European Union (for AWS: Amazon.com, Inc., USA), and content may be delivered via CloudFront locations outside the EU. Google may also process Google Analytics data in the USA. Transfers to third countries take place only on the basis of an adequacy decision of the European Commission – for the USA, the EU-U.S. Data Privacy Framework, under which Amazon.com, Inc. and Google LLC are certified – or appropriate safeguards under Art. 46 GDPR, in particular the European Commission's standard contractual clauses. You can obtain further information at privacy@mons-app.com.

8. How Do We Protect Your Data?

We protect your data through appropriate technical and organizational measures based on the state of the art and on the risks associated with the processing. Data transmitted between the app and our servers is encrypted. We keep the data of the profile backup, error reports and usage statistics separate from each other. Only authorized persons may access server data, and only to the extent necessary for their tasks. We review our protective measures regularly and adapt them as needed.

9. What Data Can Others See?

Mons has no public profiles, leaderboards or comment features. Other users cannot see any of your data. Others receive your photos only if you share them yourself (see 3.3).

10. Your Rights

Subject to the statutory requirements, you have the right to:

Right to object: Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. The easiest way to object to error reports and usage statistics is to turn them off in the Mons settings.

You can exercise many rights directly in the app: turn off or delete the profile backup and turn off error reports and usage statistics. You can remove locally stored data by deleting it in the app or by deleting the app from your device.

For questions and to exercise your other rights, you can contact us at the address given in Section 1 or at privacy@mons-app.com. Because Mons works without a user account and we store only pseudonymous data, we are generally unable to attribute this data to you. The rights of access, rectification, erasure, restriction and data portability therefore apply to this data only if you provide us with additional information that allows us to identify it unambiguously (Art. 11 GDPR).

You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority)

Promenade 18

91522 Ansbach, Germany

www.lda.bayern.de

11. Children

Mons is not specifically directed at children.

12. Changes to This Privacy Policy

We will update this Privacy Policy if Mons or the legal situation changes. We will inform you about material changes in the app. The current version is always available in the app under "Legal" and at mons-app.com.

← Back to Mons