Privacy Policy

Effective date: 2026-06-29

1. Who we are

Oppdag Norge is operated by Frich Utvikling. We are the data controller for personal data processed through the app and this website.

2. What we collect

We collect the following categories of personal data:

Account: An anonymous Firebase Auth ID is created automatically when you open the app. If you choose to create an account, we also store your email address and chosen username. You can sign in with Google or Apple, in which case we receive your name and email address from the provider (Apple may provide a private relay email).
Location (GPS): GPS coordinates are recorded at the time of a check-in to verify that you actually visited the place. Coordinates are used solely for verification and are stored as part of the check-in record. If you start a route in the app, the app also tracks your location continuously in the background while the route is active, so it can follow your progress; the operating system displays a background-location indicator during this time. Tracking is user-initiated and stops automatically when the route ends.
Photos: You may optionally upload photos when checking in. These are stored in Firebase Storage.
Content: Ratings, reports, and messages you send via the contact feature in the app.
Usage and analytics: Firebase Analytics collects pseudonymised usage data (for example, which screens are viewed and when) to help us improve the app.
Crash data: Firebase Crashlytics automatically collects information about app crashes and errors, including device type and operating system version, to help us diagnose problems.
Integrity protection: Firebase App Check is used to verify that requests to our backend originate from genuine installations of the app, not from abuse.
Subscription: We store your purchase and subscription status. Payment is handled exclusively by the Apple App Store or Google Play – we never see card details or payment information.

3. How we use your data and legal basis

We use your information for the following purposes:

Providing the service (performance of a contract, GDPR Art. 6(1)(b)): GPS verification of visits, displaying statistics and leaderboards, and managing your account.
Improving and debugging the app (legitimate interests, GDPR Art. 6(1)(f)): Analysing usage patterns and crash reports to improve stability and user experience.
Security and abuse prevention (legitimate interests, GDPR Art. 6(1)(f)): App Check protects our backend against abuse.
Communication (legitimate interests, GDPR Art. 6(1)(f)): Responding to enquiries you send via the contact feature.

4. Data processors and third parties

We share data with the following third parties to the extent necessary to deliver the service:

Google Firebase (Firestore, Auth, Storage, Analytics, Crashlytics, App Check) – infrastructure and analytics. Processing locations: EU/EEA and USA (see section 8).
Apple App Store / Google Play – handles payment and subscription processing. We receive only purchase status, not payment details.
Kartverket – map data for Norway, provided via public API.
OpenStreetMap / OpenFreeMap – map tiles and geographic data.

We never sell personal data to third parties.

5. Retention and security

Data is stored in Firebase Firestore and Firebase Storage, protected by access control rules that restrict each user to their own data. Traffic is encrypted via HTTPS/TLS. Crash data (Firebase Crashlytics) is retained for approximately 90 days and analytics data (Firebase Analytics) for up to 14 months, in line with Firebase's default retention settings; data is then deleted or anonymised.

Account data is retained for as long as the account is active. Check-in data and other content are deleted when you delete your account (see section 6).

6. Your rights

Under the GDPR you have the following rights:

Access: You may request a copy of the personal data we hold about you.
Rectification: You may ask us to correct inaccurate data.
Erasure: You may ask us to delete your personal data ("right to be forgotten").
Data portability: You may request your data in a machine-readable format.
Objection: You may object to processing based on legitimate interests.
Restriction: You may ask us to restrict processing in certain circumstances.

How to delete your account and data in the app: Go to Settings → Delete account. This deletes your account and all associated data immediately. You may also contact us directly at frichutvikling@gmail.com for help exercising your rights.

7. Children

Oppdag Norge is not directed at children under the age of 13. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

8. Transfers outside the EEA

Google Firebase may transfer data to servers outside the EEA, including the United States. Such transfers are safeguarded through the EU Standard Contractual Clauses (SCCs) and Google's Data Processing Agreement. For more information, see Google's Firebase privacy resources.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated in the app or on this page. The effective date at the top of the page shows when the current version took effect.

10. Complaints to the supervisory authority

If you believe we are processing your personal data in breach of applicable data protection law, you have the right to lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority):

Website: www.datatilsynet.no
Email: postkasse@datatilsynet.no

We encourage you to contact us first so that we can try to resolve any concerns directly.