Globe Billboard Privacy Policy

Version 1.2 · en

This Privacy Policy explains how 10003 processes personal data for Globe Billboard.

Controller

Legal / trading name: 10003 (Globe Billboard)
Operated by: Yke ten Donkelaar
Chamber of Commerce (KvK): 76667626
Registered office: Pikeursbaan 15AH, 7411 GT Deventer, the Netherlands
Correspondence / VAT address: Pikeursbaan 15AH, 7411 GT Deventer, the Netherlands
VAT identification number: NL003120123B78
Privacy and legal contact: [email protected]

Version 1.2. Effective 5 October 2026. This policy is published in English, the launch language of the product.

Acknowledging this policy when you activate an account means you have read it. That acknowledgement is not GDPR consent, is not agreement to the Terms of Service, and does not allow third-party AI moderation.

1. Who this policy covers

It covers the Globe Billboard apps, website, accounts, map, Coins, and moderation as they actually operate in this version.

The service is not directed at children under 16. Do not create an account if you are under 16. We do not collect date of birth.

2. Categories of data

Account

Email address (including an Apple Hide My Email relay if you use one), username, Apple/Google or other provider user identifiers, 16+ representation timestamp, account status, ban/suspension status, and deletion status.

We do not store your legal name unless you put it in a username or, for B2B features, in a business profile.

Authentication

One-time email sign-in codes and related delivery metadata, Apple and Google sign-in identifiers, and session or API tokens.

Business or billing profile

Ordinary use of the app does not ask for a business profile. This version does not offer a public auction, external bidding, or a paid business-protection subscription. Where an older Stripe billing record exists, we keep the accounting reference described under Payments and minimise identity when the account is deleted. Globe Billboard does not store full payment-card numbers.

Content

Pixel art, a gallery image supplied for the art or moderation workflow, revisions, map claim coordinates (the square you claim — not GPS), URLs, campaign creative and copy, and related moderation state.

Economy

Coin ledger entries, Coin balance, vouchers, purchase and reversal history, Founder and free entitlements, and daily-reward records.

Payments

Apple / Google / RevenueCat mobile purchase records. Where a Stripe payment was used, Stripe records for invoices, payments, refunds, disputes, and tax. Stripe handles payment-card data.

Analytics

First-party product interaction events on our servers, with account or pseudonymous subject identifiers as described below. No third-party advertising or product-analytics SDK.

Technical health

App and build information, error occurrence records, and technical diagnostics we collect ourselves. We do not use Firebase Analytics or Firebase Crashlytics in this version. We do not use Sentry.

Push notifications

A Firebase Cloud Messaging token, device platform, push-preference flags, notification delivery metadata where applicable, and records of an operator sending a targeted test or service notification to a selected account (that account’s registered devices). There is no broadcast operator messaging feature.

Moderation

Automated verdicts, human decisions, user reports, appeals, and rights cases.

Legal records

Evidence that you agreed to the Terms or acknowledged this Privacy Policy, including document version, content hash, action, and time; content-licence provenance; and details needed to handle a privacy or rights request.

Admin and security

We keep security and operational audit information needed to run and protect the service. This policy does not describe internal security architecture.

We do not collect GPS or device location. Map coordinates are the plot you claim on the globe, not your phone’s location.

3. Purposes and legal bases

We do not treat Privacy acknowledgement as consent. We ask for a separate in-product permission before we send content to a third-party AI moderation service. Agreeing to the Terms or acknowledging this Privacy Policy does not grant that permission. We also ask for the operating-system permission for notifications, after you choose to enable them.

Account, map, Coins, claims, artwork: contract (performance of the service).
Mobile payments you request: contract.
Security, fraud prevention, abuse handling: legitimate interests, and legal obligation where applicable.
Automated and human moderation of usernames, pixel art, imported photos, and Billboard link information: legitimate interests in keeping the public map within our content rules, and legal obligation where content is illegal. Before that content is sent to a third-party AI service, we also require the separate product permission described above. You can refuse it, or turn it off later in Privacy & data. Refusing or withdrawing it stops new AI moderation. It does not by itself remove artwork already on the map. This product permission sits alongside the legitimate-interest basis. It is not a claim that consent is the only legal basis for moderation, and it is not the Privacy acknowledgement.
First-party product analytics: legitimate interests (understand and improve the service).
Diagnostics and reliability: legitimate interests.
Push delivery you enabled: contract and/or legitimate interests, plus OS permission where the platform requires it.
Accounting, tax, invoicing: legal obligation.
Legal claims, acceptance evidence, licence provenance: legitimate interests and, where applicable, legal obligation.

You may object to processing based on legitimate interests. Email [email protected]. Some processing is required to provide the service.

4. What is public

The world map is public. Anyone can see approved (and some moderated) pixel art, plot size and place, the owner username, and an approved link title. Email, Coin balance, reports, payment details, and private originals are not public. An imported photo is not shown on the map. When you have allowed AI moderation, that original photo may still be sent to the moderation service, not only the pixel version.

5. Processors and other services

Hetzner

Hosts the application, database, and related servers. Processor for hosting.

Cloudflare

DNS, CDN, TLS, reverse proxy, and security in front of the site and API. Email routing for addresses such as [email protected]. Private R2 object storage for operational backups and, where configured, map media. Cloudflare is a US company; traffic may be processed in the EU and elsewhere under Cloudflare’s terms. We do not operate a persistent public Cloudflare access-log archive of our own.

CARTO basemaps

The app and website load background map tiles from CARTO. CARTO may see your IP address and which tiles you request (roughly where you are looking on the map). That request does not go through our API.

OpenRouter (automated moderation)

OpenRouter is the third-party service we use for automated moderation. We currently request a model in Google's Gemini family through OpenRouter. We do not pin OpenRouter to a specific infrastructure host: the request does not set provider.only or provider.order. Routing may use infrastructure that meets the privacy settings on that request. We do not call Google's Gemini API directly.

When you have allowed AI moderation, our servers may send:

the username you submit;
pixel artwork;
the original imported photo, not only the pixel version made from it;
Billboard link information such as the title, URL, final domain, and page title.

Those requests do not include your email address or account id. Before an original photo is uploaded, we ask you to confirm that the photo itself may be sent for this check.

Our servers send each request with Zero Data Retention (zdr) and data_collection=deny. We do not retry those requests with weaker privacy settings. OpenRouter account training / data-sharing is disabled on our side. We keep parsed moderation outcomes (and what we need for appeals), not an intentional archive of full prompts and model responses.

OpenRouter’s ZDR policy is a provider routing/retention control. We do not independently audit every upstream endpoint and do not guarantee more than that policy and our configuration provide. We do not claim a specific retention period at Google, or at whichever host OpenRouter selects.

You can refuse this permission when you choose a username, and turn it off later in Privacy & data. Withdrawal stops future AI moderation of new usernames, artwork, photos, and Billboard links. Content already published stays on the map until it is removed for another reason.

We do not use a direct OpenAI runtime in this version.

Google Web Risk

Submitted URLs may be sent to Google’s Web Risk service to detect malicious or unsafe URLs. We do not use the legacy Google Safe Browsing Lookup API.

Firebase Cloud Messaging and Apple Push Notification service

Push uses Google FCM and, on iOS, APNs. Data includes the push token, platform, and notification payload. Logout or account deletion removes the push token we store. We do not use the token as a general device fingerprint beyond notification delivery.

RevenueCat

Mobile purchase processing, entitlements, and reversal notifications. Apple or Google handle the store payment. We store product and transaction references and the Coins or vouchers credited or reversed. RevenueCat does not receive your full card number from us; the platform stores handle payment.

Stripe

Billing, tax calculation, invoices, payments, refunds, and disputes where a Stripe payment was used. Stripe handles payment-card information. We store limited Stripe references and payment metadata.

Apple and Google

Resend

Transactional email, including one-time sign-in codes.

Not used in this version

We do not currently use as live processors or product features: a direct OpenAI API, OpenStreetMap Nominatim, Google Safe Browsing Lookup, Firebase Analytics, Firebase Crashlytics, Sentry, or advertising / attribution networks.

6. AI training

Globe Billboard does not use user artwork to train its own generative AI models.

The community-content licence in the Terms of Service does not grant a general AI-training right.

Moderation processing is distinct from training a generative model.

7. Push notification control

Default preferences for a new token:

plot activity: on
protection: on
moderation: on
daily reminder: off

The operating-system permission is requested only after a deliberate enable or a contextual prompt. An automatic Globey prompt, if shown, remains feature-controlled.

An operator may send a targeted test or service notification to one selected account. That is not a broadcast to all users.

8. Retention

First-party analytics events: 12 months, then deleted.
Technical issue occurrences: 30 days.
Technical issue summaries: 12 months.
Application / operational logs: approximately 30 days.
Privacy export ZIP files: 7 days.
Operational database backups (R2): approximately 30 days.
Account deletion is completed when you delete the account. There is no restore window. Section 9 describes what is removed then. Backup copies can still contain the earlier data until those backups expire.
Accounting and basic administration: generally 7 years.
Applicable statutory records, including OSS/IOSS where they apply: up to 10 years.
Legal acceptance and licence provenance: retained as needed to establish rights; no short generic TTL.
Rights, legal, and privacy cases: as reasonably required to handle or defend claims.

Backup copies age out under backup retention. We do not delete all personal data 30 days after every event. Bounded backups may contain data until those backups expire.

9. Account deletion

When you delete your account, deletion is permanent and finishes without a restore window. You cannot sign back in to recover that account. Signing in later creates a new Globe Billboard account.

We take active plots and artwork off the public map. We delete private original photos, previews, and the stored pixel data for that artwork. Cached map images can remain visible for a short time while tiles update.

We disconnect the account from you. Email and the original username are removed or replaced. The Apple identifier and the Google identifier stored for this account are removed. Sessions and push tokens we store are removed. The Coin balance is set to zero. Unused vouchers and free entitlements are forfeited. There is no cash redemption.

Sign in with Apple: when a refresh token is stored, we ask Apple to revoke it, and we retry if Apple cannot be reached. Older accounts may have no stored token. Deletion of the Globe Billboard account still completes either way.

Google: we remove the Google identifier stored on the Globe Billboard account. Deleting this account does not necessarily revoke an authorization you granted on the Google side.

We may retain, in minimised form where appropriate:

accounting and tax records
Coin ledger entries and store purchase history
legal acceptance records
content-licence provenance
moderation reports, with the reporter identifier disconnected
rights, privacy, and legal evidence while still needed to handle or defend the matter
commercial transaction history
security and operational logs for the periods in section 8

where that is justified. Claim and takeover history may remain without your original identity. Analytics events linked to the account are disconnected from it and then follow the analytics period in section 8. We do not promise that every historical row is deleted on the day you delete the account. Backup copies age out under the backup period above.

10. Your rights

If the GDPR applies to you, you may request access, correction, deletion, restriction, objection, and — where applicable — portability.

In this version, send requests to [email protected]. We handle them manually. We can produce a curated export. There is no consumer self-service download button yet.

You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another competent supervisory authority.

11. International transfers

Processors may process data outside the Netherlands or the EEA depending on their infrastructure. We do not claim that every transfer is covered by a specific adequacy decision or a named SCC filing in this policy. We rely on the contractual and transfer tools those providers offer, and we choose providers that publish such terms. Ask [email protected] if you need more detail about a named processor.

12. Changes

If this policy changes, we publish a new version. A Privacy Policy update does not by itself hard-gate the app. The Terms of Service may still require a separate agreement when those Terms change.

13. Contact

Privacy requests and questions: [email protected].