Privacy Policy

1. Controller

Controller within the meaning of the EU General Data Protection Regulation (GDPR):
Max Christl
Augustenstraße 4
80333 Munich
Germany
Email: max@christls.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

Hut Finder is a search engine for bed availability in alpine huts. We process personal data only where necessary to provide the service or where you have given consent. Depending on the operation, the legal basis is Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or use of the service), or Art. 6(1)(f) GDPR (legitimate interest).

3. Hosting and server logs

The website is hosted by an external cloud hosting provider. When you visit the site, the server automatically processes technical access data (IP address, date and time, requested page, user agent). This data is required for the technical operation and security of the service (Art. 6(1)(f) GDPR) and is not combined with other data. A data processing agreement is in place with the provider; where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, under which the provider is certified.

4. Cookies and consent

Technically necessary storage (e.g. your cookie choice, sign-in tokens, your recent searches and current search settings in the browser's local/session storage) is used without consent (§ 25(2) of the German TDDDG). Optional analytics cookies and storage access are only used after you choose “Accept” in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time with effect for the future:

5. Analytics (only with your consent)

Google Analytics

With your consent, Google Analytics (Google Ireland Limited) measures how the website is used (pages visited, approximate location based on a truncated IP address, device information). We use Google Consent Mode v2: without your consent, no analytics cookies are set in the EU/EEA, the UK, or Switzerland. Data may be transferred to the USA (EU-US Data Privacy Framework). You can withdraw your consent at any time via the cookie settings.

PostHog (analytics and session recording)

We use PostHog (PostHog Inc.) hosted exclusively in the European Union to collect usage statistics and — only with your consent — to record sessions (interactions with the interface; input into sensitive fields is masked). Without consent, PostHog runs cookieless and without recognizing returning visitors. You can withdraw your consent at any time via the cookie settings.

6. Account, sign-in and favorites

You can use an account to save favorites. Sign-in is handled by Google (Google Ireland Limited), either with your Google account or via an email sign-in link. This involves processing your email address, a pseudonymous user ID and — for Google sign-in — the name and profile picture from your Google profile. Your saved favorites (user ID and hut IDs) are stored in a database operated for us on servers in Frankfurt am Main, Germany; a data processing agreement is in place with the provider. The legal basis is Art. 6(1)(b) GDPR. You can delete your account (including all saved favorites) yourself at any time via “Delete account” in the account menu.

7. Map display and place search

The interactive map loads map tiles from OpenTopoMap; in satellite view, imagery tiles are loaded from Esri (Esri Inc., USA). Your IP address is transmitted to the respective tile provider in the process — without tiles, the map could not be displayed (Art. 6(1)(f) GDPR). Map data © OpenStreetMap contributors.

If you use the “Nearby” search, your browser asks for permission to determine your location (Art. 6(1)(a) GDPR — you can decline). The coordinates are used solely to run that radius search and are not stored.

The place search uses the Nominatim geocoding service of the OpenStreetMap Foundation. Search queries are relayed through our server; your IP address is not transmitted to Nominatim.

8. External links

Result and detail pages link to external services (the alpine clubs' booking portals, Google Maps). Data is only transmitted to the respective provider once you click such a link; from then on, that provider's privacy policy applies.

9. Retention

  • Server logs: deleted automatically after 30 days at the latest.
  • Account and favorites: until you request deletion of your account.
  • Analytics data: according to the retention settings of Google Analytics and PostHog, at most 14 months.
  • Cookie choice: in your browser's localStorage until you change it or clear your browser data.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20 GDPR), as well as the right to withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of your habitual residence.

11. Changes

We will update this privacy policy when the service or the legal situation changes. The version published here applies.

Last updated: August 2026