Privacy Policy
Last updated: 14 October 2026
This policy explains which personal data is processed when you use the NEB Network AR app for iOS (including its App Clip) and the web app at the.neb-network.app, including its portals (Dreaming, Decision, Dwelling).
1. Controller
Hochschule Anhalt (Anhalt University of Applied Sciences)
A public-law corporation, represented by its President
Bernburger Straße 55, 06366 Köthen, Germany
E-mail: info@hs-anhalt.de
The app is developed in the Reallabor ZEKIWA project of Hochschule Anhalt.
Data protection officer: Datenschutzbeauftragter der Hochschule Anhalt, Bernburger Straße 55, 06366 Köthen, Germany — dsb@hs-anhalt.de
2. Summary
- There are no user accounts: everyone uses the app anonymously as a guest. We do not ask for your name, e-mail or any other contact details, and we do not assign you a user or device ID.
- No advertising, no tracking, no analytics. The iOS app contains no third-party SDKs.
- Camera images, AR tracking data and your precise location are processed on your device and are not uploaded.
- If you record your voice in a portal, the recording and its transcript are stored and shown to other visitors of that portal, and processed by AI services (section 4.3).
Purposes. NEB Network is a citizen-participation app of the Reallabor ZEKIWA research project of Hochschule Anhalt. We process data only to run the app: to show AR content and the map, and to keep the contributions to the portals. We do not sell data and do not pass it on except to the service providers named below.
3. Data processed on your device only
| Data | Why | Leaves the device? |
|---|---|---|
| Camera image (AR, QR codes, printed markers) | Show AR content, recognise QR codes and markers | No |
| AR tracking (position and orientation of the phone in the room, detected surfaces) | Place AR content | No |
| Motion and compass sensors | Orient the map | No |
| Precise location (GPS) | Show the map and the portals around you | Not the coordinates — see section 4.2 |
| App settings, tutorial progress, last known position, cached map data | Remember your settings, start faster | No (stored in the app's or browser's storage on your device) |
You can delete this data by deleting the app (iOS) or by clearing the website data in your browser.
4. Data processed on our servers or by third parties
4.1 Server logs and abuse protection
When the app loads content, our servers receive your IP address, the time, the requested address and your device or browser type; this is technically necessary. Your IP address is also kept in memory for at most 24 hours to prevent abuse (limits on how many dreams can be created); it is not written to a database.
Legal basis: Art. 6(1)(e) GDPR in conjunction with Sections 4–9 DSAG LSA (the university's public tasks, here the secure and stable operation of the app).
4.2 Maps
To draw the map around you, the app downloads map data for the area around your position (a rectangle of a few hundred metres, not your exact coordinates) from:
- OpenStreetMap Overpass servers: overpass-api.de (Germany), overpass.kumi.systems
- Terrain tiles from Amazon Web Services (AWS S3, USA)
- Map tiles from OpenFreeMap (tiles.openfreemap.org)
These providers receive your IP address and the requested map area.
Legal basis: Art. 6(1)(a) GDPR (you allow access to your location).
4.3 Voice recordings, dreams and comments in the portals
When you choose to speak in a portal (a dream, a comment on an option):
- your voice recording is uploaded to our server, transcribed, and stored together with the transcript and the detected language — anonymously, without your name or any ID (shown as “guest”);
- from your words, an image and a 3D scene are generated;
- the recording, the transcript, the image and the 3D scene are visible and audible to other visitors of the portal. Please do not say anything you do not want to make public, such as the names or addresses of yourself or others;
- “likes” are counted anonymously.
Service providers (AI services) that process this data on our behalf:
- OpenRouter, Inc. (USA) and the AI model providers it forwards the requests to — currently OpenAI (USA, speech-to-text), Google (USA, image generation) and Mistral AI (France, recognising whether you spoke a dream or a comment, and naming the dream). They receive the recording, the transcript and, for images, the text prompt.
- Our own GPU server (hosted by Hetzner, section 4.4) receives the generated image to build the 3D scene; its jobs are deleted after 2 hours.
Legal basis: Art. 6(1)(a) GDPR (consent — you start the recording yourself).
Storage: recordings, transcripts, dreams and comments are kept permanently as part of the portal, unless you ask us to delete them. To have your contribution deleted, write to info@hs-anhalt.de or dsb@hs-anhalt.de and tell us the portal and approximately when you recorded it. Withdrawing your consent does not affect the lawfulness of the processing before the withdrawal.
4.4 Hosting
Our servers, including the GPU server for 3D generation, are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under a data processing agreement (Art. 28 GDPR).
5. Permissions on iOS
| Permission | Used for | When asked |
|---|---|---|
| Camera | AR, QR codes, printed markers | When you start AR |
| Microphone | Recording your voice in a portal | When you first record |
| Location (while using the app) | The map around you | When the map opens |
All permissions are optional, and you can withdraw them at any time in the iOS Settings. Without them some features do not work.
6. Children
The app is not directed at children under 16.
7. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and you can withdraw your consent at any time with effect for the future (Art. 7(3)). Contact us at info@hs-anhalt.de or the data protection officer at dsb@hs-anhalt.de.
You also have the right to lodge a complaint with a supervisory authority, in particular: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany, poststelle@lfd.sachsen-anhalt.de.
8. Changes
We update this policy when the app changes. The current version is always available at the.neb-network.app/privacy/.