Privacy policy

Last updated: October 2026

This privacy policy applies to the website mychurchguide.com and the MyChurchGuide apps for iOS and Android. We process personal data exclusively on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

1. Controller

Church Guide GmbH Faberstraße 20/22, 5020 Salzburg, Austria Email: info@mychurchguide.com Phone: +43 660 8427482
No data protection officer has been appointed, as there is no legal obligation to do so. Please send any data protection enquiries to info@mychurchguide.com.

2. Hosting and server log files

The website, app backend and database are operated by App Monkey Development Studio GmbH, Rosenberggasse 2, 8010 Graz, Austria. The servers are located in Graz. When you visit the website or use the app, the following data is automatically stored in server log files: IP address, date and time of access, page or interface accessed, amount of data transferred, status code, browser or app version and operating system.

• Purpose: provision, stability and security of the service, defence against attacks
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Retention period: 90 days, after which the data is deleted automatically

3. Images, videos and audio guides (Exoscale)

Images, videos and audio files are delivered via the storage and delivery service Exoscale of A1 Digital International GmbH, Vienna, from the data centre in Vienna (zone AT-VIE-2). For technical reasons, your IP address is processed so that the files can be transmitted to your device.

• Legal basis: legitimate interest in fast and secure delivery (Art. 6(1)(f) GDPR)
• The data remains in Austria

4. User account

You can use MyChurchGuide without an account. With an account, you can save churches as favourites. For this purpose, we process:

• Email address (required, for the login link)
• First and last name (optional, for a personal greeting)
• Your saved favourites
• Your newsletter consent (yes/no, with timestamp)
• Time of registration and last login

The purpose is to provide the account and the favourites function. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). We use your email address to send login links and, only if you consent, for the newsletter.

Newsletter: When registering, you can voluntarily subscribe to our newsletter. After you confirm your subscription by email (double opt-in), we send you information about new churches and features of MyChurchGuide. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can unsubscribe at any time via the unsubscribe link in every email or in your account settings. Your account remains unaffected. We store the time and IP address of your subscription and confirmation as proof of your consent. To improve the newsletter, we analyse whether and when you open it and which links you click. For this purpose, the emails contain an invisible tracking pixel and personalised links. This analysis is part of your consent to the newsletter and ends when you unsubscribe. Sending and analysis are carried out via Mailgun (see section 5). You can delete your account yourself at any time in the app or on the website. All account data and favourites will be deleted. Any remaining data in backups is overwritten after 30 days at the latest. The user account is intended for persons aged 14 and over.

5. Email delivery (Mailgun)

To send login links and the newsletter, we use Mailgun, provided by Mailgun Technologies, Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA. The data is processed in the EU region (data centre in Germany). Your email address, the content of the email and technical delivery data (time, delivery status) are transmitted.
As Mailgun is a US company, access from the USA cannot be ruled out. Mailgun is certified under the EU-US Data Privacy Framework. In addition, Standard Contractual Clauses of the European Commission have been agreed (Art. 45 and 46 GDPR).

• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for login links, consent (Art. 6(1)(a) GDPR) for the newsletter

6. Local storage on your device (Local Storage)

We do not use advertising cookies. On the website (local storage or session cookie) and in the app, we store the following locally on your device:

This storage is strictly necessary for the service you have requested and is therefore permitted without consent (§ 165(3) TKG 2021). You can remove this data at any time via your browser settings or by deleting the app data.

7. Web analytics (Matomo)

We use the analytics tool Matomo on the website and in the apps. Matomo is operated on our own servers at App Monkey in Graz. No data is passed on to third parties. The following data is processed: IP address, pages and screens viewed, time spent, time of access, device type, operating system, browser or app version, screen resolution, language setting and a random visitor ID that is stored on your device.

• Purpose: improving the website and app, analysing usage
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Matomo only runs once you have given your consent.
• Withdrawal: at any time via [Cookie settings in the footer] or in the app under [Settings > Privacy]
• Retention period: 2 years, after which the data is deleted automatically

8. Maps Website (OpenStreetMap):

We use OpenStreetMap to display maps. [The map tiles are loaded from servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.] In the process, your IP address is transmitted to these servers. The European Commission has issued an adequacy decision for the United Kingdom. The legal basis is our legitimate interest in displaying maps (Art. 6(1)(f) GDPR).

Apps: The Android app uses Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), the iOS app uses Apple Maps (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). When the map is loaded, your IP address, the map section and device data are transmitted to the respective provider. In the case of Google, a transfer to the USA is possible. Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR.

Location: [If you allow location access, the app uses your location to show churches near you. Your location is only used on your device and is not stored on our servers. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings.]

9. Push notifications (Firebase, Apple)

If you allow push notifications, we use Firebase Cloud Messaging (Google Ireland Limited) for Android and the Apple Push Notification Service (Apple Distribution International Ltd.) for iOS. A device-specific push identifier (token) is generated and transmitted to us and to the respective provider. In the case of Google, a transfer to the USA is possible (EU-US Data Privacy Framework).

• Legal basis: your consent (Art. 6(1)(a) GDPR)
• Withdrawal: at any time via the notification settings of your device
• Retention period: until you withdraw consent or delete the app or account

10. Error analysis (Sentry)

To detect and fix crashes and errors, we use Sentry, provided by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. If an error occurs, technical data is transmitted: error description, time, device type, operating system, app or browser version and [truncated] IP address. The data is stored in the [EU region (Frankfurt)]. Sentry is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses also apply.

• Legal basis: legitimate interest in a stable, error-free service (Art. 6(1)(f) GDPR)
• Retention period: [90] days

11. Contact by email

If you contact us by email, we process your email address, your name and the content of your message in order to respond to your enquiry. The legal basis is our legitimate interest in responding (Art. 6(1)(f) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR). We delete the correspondence as soon as it is no longer needed, at the latest after statutory retention periods have expired.

12. Recipients and processors

We do not pass on your data for advertising purposes and do not sell it. The following service providers process data on our behalf on the basis of a data processing agreement (Art. 28 GDPR):

Provider: App Monkey Development Studio GmbH, Graz, Service: hosting, database, Matomo, Place of processing: Austria (Graz)
Provider: A1 Digital International GmbH (Exoscale), Vienna, Service: delivery of images, videos and audio, Place of processing: Austria (Vienna)
Provider: Mailgun Technologies, Inc., Service: sending login links and newsletter, Place of processing: EU (Germany), US parent company
Provider: Functional Software, Inc. (Sentry), Service: error analysis, Place of processing: EU, US parent company
Provider: Google Ireland Limited (Firebase, Google Maps), Service: push notifications, maps Android, Place of processing: EU/USA
Provider: Apple Distribution International Ltd., Service: push notifications, maps iOS, Place of processing: EU/USA

13. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw your consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact info@mychurchguide.com. We will respond within one month.

14. Complaint to the data protection authority

If you believe that we are processing your data unlawfully, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42, 1030 Vienna Phone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: www.dsb.gv.at

15. Changes

We update this privacy policy when our service or the legal situation changes. The version published here applies.