Privacy Policy

How heybaum handles your data — in plain language.

Please note. The German version of this policy is the legally binding one. This English text is provided as a courtesy translation; in case of any discrepancy, the German version prevails.

The short version. heybaum is a free, non-commercial project mapping Frankfurt's public trees. You can browse the entire map without an account and without giving us anything. If you choose to create an account, we ask for two things: an email address (to log you in) and a display name (shown next to what you post). We use no analytics, no tracking, and no advertising. We never sell your data. If you delete your account, everything you wrote goes with it.

1. Who is responsible

The controller responsible for data processing on this website, in the sense of the General Data Protection Regulation (GDPR), is:

Ansar Ahmad
60598 Frankfurt am Main, Germany
Email: info@heybaum.com

heybaum is a personal, voluntary, non-commercial project. It is not a business, earns no revenue, and carries no advertising.

2. Browsing without an account

You can use the whole map — every tree, every species profile, every shade layer — without registering and without us storing anything about you.

The "find me" button

If you press the location button, your browser asks your permission and then tells the map where you are, so it can centre on your position. This location is never sent to us and never stored anywhere. It exists only in your browser for as long as the page is open. If you refuse permission, everything else still works.

Cookies and tracking

heybaum sets no tracking cookies, uses no analytics service, and runs no advertising or profiling of any kind. If you log in, your browser stores your login session locally so you stay signed in — that is a technical necessity for the account to work, not tracking.

The opening screen

When the page loads, heybaum shows an opening screen with several ways in. Whether you have seen or closed it is not stored — not in a cookie, and not in your browser's local storage.

Directions to a place

Tree and spot detail views let you get directions. We offer links only, to Google Maps, Apple Maps, Waze and OpenStreetMap. Until you tap one of them, no connection to those services is made and nothing is sent.

If you do tap one, your browser leaves heybaum and opens the service you chose. That service then learns your IP address and the coordinates of your destination; what happens after that is governed by their privacy policy, over which we have no influence. Legal basis for offering the links: Art. 6(1)(f) GDPR — legitimate interest in helping you reach a place without tying you to one particular provider.

3. If you create an account

Creating an account is entirely optional. It lets you rate trees, write notes and comments, react to others' comments, and file Baum-Ranger reports. We ask for the minimum we can:

What	Why	Legal basis
Email address	To log you in, verify your account and let you reset a forgotten password. It is not used for marketing unless you separately opt in.	Art. 6(1)(b) GDPR — performance of a contract (providing the account you asked for)
Display name	Shown publicly next to your ratings, notes and comments. You choose it, and you do not have to use your real name.	Art. 6(1)(b) GDPR
Password	To secure your account. It is stored, hashed, by Amazon Cognito — we never see it.	Art. 6(1)(b) GDPR
Consent record (date and time)	To demonstrate that you agreed to the Terms of Use and this policy.	Art. 6(1)(c) GDPR — legal obligation to evidence consent
What you post: ratings, notes, comments, replies, reactions, Baum-Ranger reports	To show your contribution on the tree you posted it to, and to calculate your "rings" (a simple contribution score).	Art. 6(1)(b) GDPR

What you post is public. Your display name, your ratings, the notes you write explaining a rating, your comments and replies, and your Baum-Ranger reports are visible to everyone who visits heybaum — including people without an account. Please do not write anything you would not want publicly readable, and do not include personal information about yourself or others.

Reporting content

Every comment carries a report button. When you report something, we store:

your user ID as the reporting person;
the ID of the reported item and of the person who wrote it;
the reason you selected;
the time of the report;
a copy of the reported text as it stood at the moment of reporting.

The copy is necessary because a comment can be deleted seconds after it is reported, which would otherwise leave nothing to review. Legal basis: Art. 6(1)(c) GDPR together with the duty under §§ 8 to 10 DDG to remove unlawful content once we know of it, and Art. 6(1)(f) GDPR — legitimate interest in a service free of unlawful or abusive content.

Reports are not public and can be seen only by the project maintainer. People who file a report are told that it was received, but never the outcome. Every report is reviewed by a human: there is no automated decision-making within the meaning of Art. 22 GDPR, and nothing is hidden automatically.

If a place you added is reported. A copy of the reported text is stored in the same way. That report is kept for as long as the place is on the map — including after you delete your account, because a decision about content that is still visible has to remain traceable. Your name has already been removed by then.

If one of your comments is reported. A copy of its text is stored in the moderation queue — including when you delete the comment afterwards. That copy stays there until your account or the reporting person's account is deleted.

Emails we send you

Necessary account emails — your verification code when you sign up, and a code if you ask to reset your password. These are part of the service and cannot be switched off while you have an account.

We send no newsletters, no marketing and no other informational email. You only ever receive the messages above, and only because you have just triggered them yourself.

4. Who else processes your data

heybaum is a small project and relies on a few external services. These are the only third parties involved:

Amazon Web Services (AWS)

The site, its database and its login system all run on AWS in the Europe (Frankfurt) region — eu-central-1, so your data is stored in the European Union. Specifically: Amazon Cognito (accounts and login), Amazon DynamoDB (your ratings and comments), AWS Lambda (processing), Amazon S3 and Amazon CloudFront (serving the website). AWS is contracted as a processor under Art. 28 GDPR.

AWS's parent company is based in the United States. Although your data is stored in Frankfurt, access from the US cannot be entirely excluded; such transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.

Map tiles (CARTO / OpenStreetMap)

The map background is loaded from CARTO, using OpenStreetMap data. When the map loads, your browser contacts CARTO's servers directly, which means your IP address is visible to them. This is technically necessary to display a map. We receive nothing from this exchange.

Software libraries (unpkg, jsDelivr)

The site loads a few open-source components (the Leaflet mapping library and, on pages with login, the Amazon Cognito browser library) from public content delivery networks. As with map tiles, your browser contacts those servers directly and your IP address is visible to them.

Amazon Simple Email Service (SES)

Emails to you — verification codes and password reset codes — are sent via Amazon SES in the eu-central-1 region. SES processes your email address and the content of the message. SES also carries the internal notification to the maintainer when content is reported; that message contains the copy of the reported text described above. Like the other AWS services, SES is bound as a processor under Art. 28 GDPR.

Google Workspace (email mailbox)

The mailbox info@heybaum.com is hosted on Google Workspace. Every email you send us, and every internal moderation notification, is therefore processed and stored on Google's servers. A data processing agreement is in place with Google; transfers to the United States rely on the EU-US Data Privacy Framework and standard contractual clauses.

5. Server logs

Our hosting provider (AWS) records standard technical access data, such as IP address, time of request and the file requested. This happens automatically for any website and is necessary for security and for delivering the site. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a functioning, secure website. We do not combine this data with anything else and do not use it to identify individuals.

6. How long we keep things

Account data — for as long as your account exists.
What you posted — for as long as your account exists.
After deletion — removed as described below.
Content reports — including the stored copy of the reported text: until the account of either the reporting person or the author is deleted.
Emails to info@heybaum.com — for as long as they are needed to deal with your enquiry.
Technical server logs — kept only for the short period our hosting provider retains them.

7. Deleting your account

You can delete your account yourself at any time: log in, open Your account via your name at the top left, and confirm by typing DELETE. Deletion is immediate and permanent.

When you delete your account, we delete all of it:

your account and email address;
your display name;
every rating you gave and every note you wrote;
every comment and reply you posted;
every reaction you left;
every Baum-Ranger report you filed;
every content report you filed;
every report concerning one of your comments — including the copy of its text stored there;
any spot you added that is still waiting for review;
every place you saved.

Kept, with your name removed:

spots you added that are published, and edits you made to other people's spots. Other people have saved and commented on them, so they are no longer yours alone. Your user ID and display name are replaced with "user deleted", leaving nothing that links them to you. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a community-maintained map that survives one person leaving.

Nothing you wrote is kept behind under a placeholder name. Because comments are deleted outright, replies that other people wrote underneath one of your comments may remain visible without the comment they were answering.

If deletion does not work for any technical reason, please write to info@heybaum.com and we will delete your account manually.

8. Your rights

Under the GDPR you have the right to:

Access — ask what data we hold about you and receive a copy (Art. 15).
Rectification — have inaccurate data corrected (Art. 16).
Erasure — have your data deleted (Art. 17), as described above.
Restriction — ask us to limit how we use your data (Art. 18).
Portability — receive your data in a machine-readable format (Art. 20).
Objection — object to processing based on legitimate interest (Art. 21).
Withdraw consent — at any time, for anything you consented to, without affecting what was lawful before you withdrew it (Art. 7(3)).

To exercise any of these, write to info@heybaum.com. We will respond within one month.

Right to complain

If you believe we are handling your data unlawfully, you can complain to a data protection supervisory authority. The competent authority for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden, Germany
datenschutz.hessen.de

9. Security

The site is served exclusively over encrypted HTTPS connections. Passwords are never stored by us in any form — account security is handled by Amazon Cognito, which stores them hashed. Access to the underlying data is restricted to the project maintainer.

10. Children

heybaum is open to everyone, but accounts are not intended for children under 16. If you are under 16, please ask a parent or guardian before creating an account. If we learn that we hold data from a child under 16 without consent, we will delete it.

11. Changes to this policy

If heybaum changes in a way that affects your data, this policy will be updated and the date below will change. Substantial changes affecting registered users will be communicated by email.

12. Governing version

The German version of this privacy policy is the legally binding one. This English text is a courtesy translation; in case of discrepancy, the German version prevails.