Gibber — a Cats on Acid app
We store your account (email, nickname, city) and what you post (photos, descriptions, item locations, chat messages). Your phone's live GPS position stays on your device, with two narrow exceptions: it is sent when you report that a finding is still there or gone (to check you're actually at the spot), and as a search bias when you look up an address. Neither is stored — see section 3d. There is no background tracking, ever. What you post, your nickname, and your karma are visible to other users — unless you turn on Anonymous Findings in Settings, in which case findings you post from then on are shown without your name. Turning on Anonymous Profile in Settings hides your level, karma, badges, home region and your list of listings from other users (your picture, nickname, bio and giveaway reputation stay visible). Giveaways, and requests and their offers, always show it, because they are exchanges — you have to arrange a handover with the other person. The free version shows a small number of clearly labelled ads; before the first ad we ask whether you consent to personalised ads, and you can change that choice any time in Settings — see section 11. There are no analytics in the app: we don't track what you do, which screens you open or how long you stay. If the app crashes, it does send us the error and what it was doing just before, so we can fix it — see section 5. You can delete your account any time in Settings — it's immediate, and there's no way to undo it. Your own giveaways and their photos are deleted with it; findings you posted stay up as anonymous community content, and chats stay visible to whoever you talked to. See section 9 for the details, or email contact@catsonacid.dev if you can't sign in to do it yourself.
We are the controller responsible for your data — that means we decide why and how it's processed. That's Cats on Acid UG (haftungsbeschränkt), HRB 291788, Amtsgericht Charlottenburg, Kolonnenstr. 8, 10827 Berlin, Germany, contact contact@catsonacid.dev. We have not appointed a data protection officer — we are not required to.
This policy covers the Gibber mobile app (Android and iOS) and our website, gibber.online — including the pages that open shared links and invites. It exists in English and German — see section 13.
Here's every category of personal data we handle, why we're allowed to (our "legal basis" — the GDPR reason that makes it lawful), and how long we keep it.
Your email (for login and magic links), your unique nickname (public), an optional bio, your home city (required — the app is organised by city), and — optionally — your home borough (in Berlin: a Bezirk) and neighbourhood (an Ortsteil, what Berliners call a Kiez). You either pick those two on a map or confirm what your phone suggests; both steps can be skipped, and you can change or clear them later in Settings. You may also add an optional profile photo; if you do, it is shown on your public profile and next to your nickname on the leaderboard. You can change or remove it later in Settings. Basis: Art. 6(1)(b) GDPR ("we need it to provide the service you signed up for"). We keep this while your account exists. Deleting your account in Settings removes it immediately and permanently — see section 9 for exactly what that does and doesn't touch.
Sign-in is passwordless. With a magic link, we email you a one-time login link (sent through our email provider, Resend). With Google Sign-In, Google tells us only your email address, a technical user ID, and whether the email is verified — no name, no photo. We store login sessions, including device platform info, to keep you signed in. Basis: Art. 6(1)(b) plus Art. 6(1)(f) ("legitimate interest" — keeping accounts secure). Tokens and sessions are kept until they expire or you log out.
To stop anyone using our sign-in to flood an inbox, we count the sign-in emails we send. For each one we keep a keyed fingerprint of the email address and of your device's IP address — a one-way code we can compare but not turn back into the address or the IP — and the time. Basis: Art. 6(1)(f) (protecting people's inboxes and our service from abuse). These records are deleted after 24 hours.
Photos, a title, a description, a category, and the map pin you place — the pin marks the item's location, chosen by you, not a record of where you were standing. Chat messages with other users about giveaways (visible only to the two of you, with one exception: if one of you reports the other from that chat, our team may read the messages of that chat to review the report, as described in section 4). Reservation requests. Basis: Art. 6(1)(b). When you attach a photo, the app opens its own camera or shows a strip of your device's recent photos so you can pick one — this runs entirely on your device, and a photo is uploaded only once you actually post. A copy of the photos you take with the in-app camera is kept in your phone's photo library (in a Gibber album) unless you turn this off in Settings › Photos. From that pin, and only from it, our server works out which borough (Bezirk) and neighbourhood (Ortsteil/Kiez) the item falls in, and stores those two labels next to it, so items can be browsed and ranked by area. For a giveaway that area comes from the pin you placed, not from the blurred marker everyone else sees (section e) — a Kiez is a whole neighbourhood, never an address, but it's worth knowing. Findings you mark "gone" are hidden but retained. Your optional profile photo (section a) is a user-provided image too: it is stored the same way as the photos above and is removed when you clear it or delete your account. Deleting your account treats findings and giveaways differently — see section 9. In short: a finding is something you spotted, not something of yours, so it stays up as anonymous community content; a giveaway is your own possession, so it and its photos are deleted with your account. Chat messages are part of the other person's conversation too, so we can't delete only your side of a shared thread — if you delete your account, your messages stay visible to whoever you were chatting with, just no longer attributed to you by name. Please don't put anything sensitive in chat that you wouldn't want to remain readable that way.
Your device's live GPS position is used on your phone — to centre the map, suggest your city, suggest your Bezirk and Kiez, and notice when you've wandered away from your city. None of that leaves the device, and there is no background tracking, ever: we only ever read your position while the app is open in front of you. The Bezirk/Kiez suggestion is no exception: your phone downloads the boundary outlines and compares your position against them on the device. What reaches us is the region you confirmed — a name like "Prenzlauer Berg" — never the position it was worked out from. Contrast that with the item pin in (c), which is stored — because you chose to publish it.
Two things do send your position to our server, both only at the moment you ask for them:
One consequence worth stating plainly, because it isn't obvious: since a status update can only be posted from nearby, the update itself records that you were within a short distance of that spot at that time, and (as above) the position behind that check is kept with it for up to 12 months. It is visible in the finding's history like any other update, but the position itself never is — not to other users, not in the app, nowhere on the wire. We rely on this for the update feature you asked for and to keep the map honest (Art. 6(1)(b) and 6(1)(f) GDPR); reading and retaining your device's position for it is limited to what that check strictly needs (§ 25(2) no. 2 TDDDG).
To protect givers, a giveaway's exact spot is blurred — shown shifted randomly by up to about 300 metres — to everyone except its owner, until a pickup is arranged. This is a protective design choice, the kind of "data protection by design" GDPR Art. 25 asks for.
Our backend logs include email addresses in a few places, such as sign-up and magic-link sending. Our backend does not log IP addresses. Basis: Art. 6(1)(f) (running and debugging the service). Logs are kept for 30 days, then deleted automatically.
Alongside the login session in section b, we keep a lightweight record of the app installation you're signing in from: an id the app creates itself the first time it runs on your device, and your device's own identifier from Apple or Google (the kind every app on your phone can read). Both are sent to us when you sign in and whenever your session renews in the background. Basis: Art. 6(1)(f) — this exists purely so we can recognise several accounts signing in from the same phone, which helps us catch abuse of the karma system; it never blocks or limits anything by itself, and it is never shown to other users. We keep it for up to 12 months, the same window as the rest of our abuse-prevention records (section 9).
Our website host, Vercel, automatically records each request to gibber.online: your IP address, the time, which page you asked for, and what browser you're using. This happens for every website on the internet — it's how a server knows where to send the page back — and we can't switch it off. We use it only to keep the site running and to investigate problems. Basis: Art. 6(1)(f) (a working, secure website). These logs are kept for one hour, then deleted automatically.
If you write to contact@catsonacid.dev, we have your address and whatever you put in the message, for as long as we need it to deal with what you asked about. Basis: Art. 6(1)(f) (answering people who contact us).
Quite a lot is public inside the app. Any signed-in user can see your nickname, your profile photo (if you set one), bio, your home city and — if you set them — your home Bezirk and Kiez, your level and karma points, leaderboard position, your full karma history (every reward you've earned), your giveaway reputation, and every finding or giveaway you've posted — published together with the Bezirk and Kiez the item falls in, and normally shown together with your nickname, except that some of this changes if you turn on Anonymous Profile in Settings — see below. The exception is Anonymous Findings in Settings: while it is on, each finding you post is recorded as anonymous, and other users see it labelled "Anonymous" with no name, no profile link, and no way to reach your profile from it. That choice is fixed at the moment you post — turning the setting on later does not hide findings you already posted, and turning it off later does not reveal the ones you posted anonymously. It applies to findings only. Giveaways, and requests and their offers, are exchanges, so they always show your nickname — you and the other person have to chat and meet to hand the item over. We still record internally who posted what, so that karma, moderation, and your own "My Listings" list keep working.
Anonymous Profile in Settings is the second exception. While it is on, other users opening your profile see only your nickname, your profile photo, your bio and your giveaway reputation; your level and karma points, your karma history, your badges, your home city, Bezirk and Kiez, and the list of findings and giveaways you have posted are hidden from them. On leaderboards you still appear with your rank and the points you earned in that round, but without your level or region. Your nickname still appears on the listings you post, in your chats and in notifications, exactly as before. Unlike Anonymous Findings this is not fixed at posting time: it applies while it is on and stops when you turn it off. You always see your own full profile, and we still record everything internally so that karma, moderation and your own lists keep working. Your friends are the exception to what is hidden here: see the paragraphs on friends below.
Your giveaway reputation is built from the exchanges you actually complete. After a giveaway is handed over, each side can rate the other — one of three ratings, plus up to three fixed labels chosen from a short list we provide (there are no free-text reviews). Other users never see an individual rating or who left it: your profile shows only totals — the share of positive ratings once you have at least three of them, how many giveaways you have given and picked up, and the labels you were given most often. Before that threshold your profile simply says you are new. Ratings and no-show reports stop counting after 24 months. If you cancel a reservation we ask why; your answer is not shown to anyone, and a report that the other person did not turn up only ever appears on their profile once different people have reported it more than once — and then only as a count, never as who said it.
When someone shares a listing link, the public preview page shows only the item's title, photo, and category — never coordinates, and never who posted it.
If you report a listing, the reason you chose and any optional details you added are stored with that listing's moderation record — visible only to us, never to the listing's poster or any other user — and kept for as long as that record exists, or the abuse-prevention window described in section 9, whichever is longer.
If you report another user — from their profile or from a chat with them — the reason you chose (harassment, threats or hate; sexual or explicit messages; scam or asking for money or personal data; spam or advertising; a fake or impersonating profile; an offensive name, photo or bio; or something else), any optional details you added, who reported whom, when, and, if you reported from a chat, which chat, are stored with that person's moderation record — visible only to us, never to the person you reported or any other user — and kept for as long as that record exists, or the abuse-prevention window described in section 9, whichever is longer. There is one open report per reporter and person at a time. When you report from a chat, our team may read that chat — every message in that conversation — to review the report, because a report of harassment or a scam cannot be judged on one person's word alone; the app tells you so before you send the report, and we have no other access to chats. We may dismiss the report or suspend the account, and we tell you only if we took action. The person you reported is never told who reported them. If you delete your account, a report you made stays, anonymised, with the rest of your abuse-prevention footprint.
If you block another user, we store that choice — who you blocked and when — so the app can keep the two of you apart: neither of you can message the other or arrange a handover, and neither sees the other's giveaways or requests. The person you blocked is not told. Your block list is visible only to you and to us (we see how many people have blocked an account, as a signal for moderation), and an entry is deleted when you unblock that person, when either account is deleted, or at the latest with the account purge described in section 9.
Friends. You can send another user a friend request from their profile, after you have rated a handover with them, by finding them by nickname, or by opening their invite link. They accept or decline; a decline is not announced to anyone, and either of you can end the friendship at any time without the other being told. When someone joins Gibber through your invite link, we send them a friend request from you automatically, unless you turn that off in Settings → Privacy (“Send a friend request to people I invite”, on by default). We store who asked whom and when, whether and when the request was accepted or declined (a declined request is kept so that the same person is not asked again), and which of your friends passed you on the weekly leaderboard, so that the notice is sent only once per week per friend. Nothing about this is shared with third parties.
The other person sees whether the two of you are friends or a request is pending. The number of friends you have is shown on your public profile; your list of friends and requests is visible only to you. Your friends can see your profile, karma and badges even while Anonymous Profile is on, and they can see which listings are yours and filter the map to them; findings you post anonymously stay anonymous to everyone, friends included. Blocking someone ends the friendship and any request between you. We use friendships for a Friends leaderboard (you and your friends ranked by karma), to mark your friends on every leaderboard, to notify your friends when you post a giveaway, a request or a finding that is not anonymous, to tell you when a friend passes you on the weekly leaderboard, to show your rank among your friends in the weekly results, and for the “Good company” badge (handovers completed with friends). These notifications are controlled by one “Friends” switch in Settings → Notifications; friend requests and acceptances are always delivered. Our team sees how many friends an account has, on the admin console’s user page, as a signal for moderation and never as a way to act on the account. A friendship is deleted at once when either of you ends it or blocks the other, and deleting your account removes your friendships and friend requests immediately, not only at the account purge described in section 9.
We use a small number of service providers to run the app:
| Provider | What they do |
|---|---|
| Railway | Runs our servers and database, and stores uploaded photos |
| Resend | Sends magic-link emails |
| Only if you sign in with Google | |
| Google AdMob | Serves the ads in the free version — see section 11 |
| Expo | App update checks from your device |
| Vercel | Hosts our website, gibber.online, including the shared-link and invite pages |
| ChibiGeo | Turns address searches into map positions |
| Anthropic | Translates posts, bios and chat messages when you ask |
| Grafana | Watches how our servers are doing — response times and errors |
| Sentry | Tells us when the app crashes, so we can fix it |
A word on that last one, because it's the only provider that receives anything automatically from your device. When the app crashes or hits an error, it sends Sentry what went wrong: the error itself, where in our code it happened, your app version, your device model and operating system version, and a short trail of what the app did just before — its own recent warnings and the requests it made to our servers, which can include what you searched for. Your location is removed from those requests before anything is sent, and a report never includes your name, your email, your messages or your photos. Each request carries a random reference code: the report itself doesn't say who you are, but the code lets us find the same request in our own server logs, which do. Sentry deletes each report after 30 days. None of this is used to build a picture of you — only of our own bugs. We rely on it because an app nobody can tell us is broken stays broken, which is our legitimate interest under Art. 6(1)(f) GDPR.
Grafana works on our side, not on your device: it receives measurements from our servers — which requests were made, how long they took and whether they failed. Those measurements can include what you searched for and the IDs of the listings involved, but not your location. The detailed records that can contain your search are deleted after 30 days; the counts and timings our charts are drawn from say nothing about you and are kept for 13 months. We use them to notice when something is slow or broken before you have to tell us, on the same legitimate-interest basis.
Map tiles. The map images come directly from OpenFreeMap (tiles.openfreemap.org), and from Esri (ibasemaps-api.arcgis.com) if you pick the satellite skin. Like any web request, those servers see your device's IP address and which map area you loaded. Requests to Esri also carry Gibber's own access key, which identifies the app, not you. We don't send them anything else.
Address search. Your search text goes to our server, which forwards it to ChibiGeo (chibigeo.com), a geocoding service run by ZeitFlow UG in Berlin, whose own servers stand in Germany. ChibiGeo sees the search text and our server's address, not yours, and does not store what you searched for. Its service sits behind Cloudflare, which runs the network your request travels through and can see it on the way — see section 6.
Translation. When you tap to translate a post, a profile bio, an offer or a chat message — or have "Translate automatically" switched on in Settings — our server sends that text and the language you read in to Anthropic, whose AI model (Claude) does the translation. Anthropic receives the text and the target language, never who wrote it. It does not use them to train its models, and deletes them within 30 days — unless its automated checks flag a request as misuse, in which case it may keep that request for up to two years. We keep the translation on our server next to the original, so we don't ask again, and it is deleted when the original is. The person who wrote the text isn't told it was translated. Basis: Art. 6(1)(f) — letting neighbours understand each other; the setting is yours to switch on or off.
Bezirk and Kiez outlines. The borough and neighbourhood shapes the app draws are served from our own servers — we keep a copy of Berlin's official boundary data, so no third party is involved in loading the shapes themselves. The name labels drawn on top of those shapes are different: they load their font from OpenFreeMap, the same provider the "Map tiles." paragraph above already discloses, and like any web request, that sees your device's IP address. Source: Bezirks- und Ortsteilgrenzen: Geoportal Berlin / ALKIS Berlin Bezirke, ALKIS Berlin Ortsteile — Senatsverwaltung für Stadtentwicklung, Bauen und Wohnen Berlin, Datenlizenz Deutschland – Zero – Version 2.0.
Your account, your posts and your photos live on servers in the EU: we host with Railway in their EU West region, in the Netherlands.
Most of the companies we rely on are US-based, though, so some data does reach the US. Every one of those transfers is covered by one of the two safeguards EU law recognises for this. Google, Expo, Resend, Sentry and Grafana Labs are certified under the EU-US Data Privacy Framework — a scheme the European Commission has ruled gives adequate protection. Vercel and Railway use the European Commission's Standard Contractual Clauses, the standard contract terms for the same purpose. Either way, the protection travels with your data. For Sentry and Grafana we also chose their European regions, so crash reports and server measurements are stored in Germany. ChibiGeo, who handles address searches, is a German company with German servers, but its service sits behind Cloudflare's worldwide network, so a search can pass through a country outside the EU on its way there. Cloudflare's agreement with ChibiGeo covers that with the same Standard Contractual Clauses.
Translations are processed outside the EU: Anthropic, who does them, is a US company and runs its AI models in the US and other countries. Its Data Processing Addendum, part of our contract with it, includes the European Commission's Standard Contractual Clauses for these transfers.
This page sets no cookies and runs no scripts. The app stores your login tokens and settings on your device — that's strictly necessary for it to work, so no cookie banner is needed. For the same reason, it also keeps an on-device copy of what you, signed in, have already seen — your listings, your profile, your favorites, your conversations and messages, and your notifications — plus any message you write while offline, until it can be sent. That copy is what lets the app keep working without a connection: it stays on your device, is used only by the app, and is deleted the moment you log out or delete your account. If you use the free version, the ad software (section 11) additionally stores your consent choice and, only with your consent, uses your device's advertising identifier. There are no analytics cookies anywhere.
The app is for people aged 16 and older. It is not directed at children below that age.
Under GDPR (Articles 15–21) you can ask us for:
Deleting your account. You can do this yourself, any time, in Settings → Delete account → confirm. It takes effect immediately — there is no grace period, and it cannot be undone or recovered.
Deleting your account permanently deletes the account itself, your profile photo, your own giveaways and their photos, your favorites, karma, level, badges, your friendships and friend requests, the record of which wandering cats you found (a Supporter perk), any cat that visited only you, the ratings you received, settings, sessions and device tokens. Your email and nickname become free for a new account.
Three things survive, on purpose, and here's why. Findings you posted are of public property in a public place — never yours to begin with — so they stay up as community content, permanently detached from you and reassigned to a shared "Deleted user" account; once that link is gone, nothing about them is your personal data anymore. Chat messages, reservation records and the ratings you gave other people are shared with whoever you talked to — deleting your side would delete their record of the conversation, and their reputation, too — so those stay visible to the other person, with your name replaced by "Deleted user". And an abuse-prevention footprint — your karma events, exchange records, leaderboard standings, installation records (section 3), and the reports you made — is kept for up to 12 months with no name, email, photo, posts or location attached to it, visible only to us, never to other users, and then erased for good. As part of that footprint we also keep a one-way fingerprint of your email (not the email itself — a fingerprint can't be turned back into it), solely so that if the same email creates a new account within that window, we can recognise it as a return.
Suspended accounts. If we suspend an account, we keep its data exactly as it is while the suspension lasts — nothing is deleted just because someone can't sign in. If the account is then closed, whether because of what led to the suspension or because the person asked us to by email, it is deleted exactly as described above for a self-deletion, including the same 12-month abuse-prevention record.
For access, rectification, restriction, portability, or objection — or if you can't sign in to delete your account yourself — email contact@catsonacid.dev and we'll handle it manually. You can also complain to a data protection authority; for Berlin that's the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, mailbox@datenschutz-berlin.de, datenschutz-berlin.de.
We use HTTPS everywhere, passwordless sign-in (so there's no password to steal), and access controls on our systems. No system is perfectly secure, so we keep what we store to a minimum.
The app is free because the free version shows ads: in the Browse list, roughly one card in fifteen is an ad, always clearly labelled as one. The ads are served by Google AdMob. Supporters (the paid subscription) see no ads at all — and in that case nothing in this section applies to you, because the app never even talks to the ad network.
Before the app requests a single ad, you are asked for your choice in a consent dialog (Google's certified consent tool, implementing the IAB Transparency & Consent Framework): consent to personalised ads, or don't — in which case you still get ads, just non-personalised ones that don't use your data beyond what's technically necessary to show them. Personalised ads are shown only on the basis of your consent, under Art. 6(1)(a) GDPR and §25(1) TDDDG. On iOS, the system additionally asks for tracking permission (Apple's App Tracking Transparency) as part of the same flow.
You can change or withdraw your choice at any time in Settings → Privacy → Ad preferences — withdrawing is as easy as consenting, and takes effect for all future ads. We keep a record of your choice (its date and the technical consent string) with your account as proof of consent; it is deleted with your account.
Google acts as an independent controller for the ad serving itself. How Google uses data when showing ads is described at policies.google.com/technologies/partner-sites. As a US company, Google is covered by the safeguards described in section 6.
We'll update this page whenever things change. If a change is material, we'll surface it inside the app, not just on this page.
This policy exists in English and in German, and both versions are meant to say exactly the same thing. Neither one overrides the other: we have deliberately not written a clause saying one version wins, because they should never differ in the first place. If you do spot a difference, please tell us at contact@catsonacid.dev and we'll correct it. You can switch language at the top of this page.
Cats on Acid UG (haftungsbeschränkt) · HRB 291788, Amtsgericht Charlottenburg · Kolonnenstr. 8, 10827 Berlin, Germany · contact@catsonacid.dev
See also our Terms of Service.