Privacy Policy

PAUL Network – Public Autonomous Uplink Layer
Last updated: 23 September 2026

1. Controller

The controller responsible for processing personal data within PAUL Network is:

Paul Gericke
Schkeuditzer Straße 2
04509 Delitzsch
Germany
Email: [email protected]

2. Account

During registration and account use, PAUL Network may process the email address, chosen display name, cryptographic password hash, account and workspace identifiers, timestamps and necessary security and audit information.

The password itself is not stored in plain text.

Processing is used for registration, login, management of the user's network and the security and functionality of the service.

3. Gateways, nodes, trackers and radio data

Depending on use, PAUL Network may process gateway EUI, internal PAUL identifiers, node and tracker names, technical status data, reception values such as RSSI and SNR, satellite and RTK information, device identifiers and location, radio and coverage data.

The real gateway EUI and exact location information that has not been expressly released for publication are not part of the public view.

4. Gateway location sharing

Supported gateways can be configured as hidden, approximate or exact.

Approximate mode displays an intentionally altered or spatially generalized public position.

Exact mode may publicly display the position expressly released by the user with high precision.

5. Trackers and position data

Trackers are assigned to an account only after deliberate addition or pairing.

Public display of a tracker is disabled by default and can be voluntarily enabled and disabled again by the owner.

When public sharing is enabled, PAUL Network does not publish the exact internally stored coordinate. The position is spatially generalized.

PAUL Network currently uses an H3 resolution 10 area for this public tracker representation.

The DevEUI and exact tracker coordinates remain account-bound and are not provided through the public tracker display.

Depending on the function, generalized historical coverage and position information may also be displayed.

6. Public data and API

Publicly released PAUL IDs or node names, technical measurements and coverage information may be accessible through the website and public API.

The public API is not intended to expose email addresses, password information, real gateway EUIs or exact locations that have not been released for publication.

7. Session cookie

Logged-in accounts use the technically necessary paul_session cookie.

It is used exclusively for login and session management and is configured as HttpOnly and SameSite=Lax and, when used over HTTPS, as Secure.

The session is currently designed for a maximum period of 30 days.

8. Server and security logs

Public web access is provided through a Cloudflare Tunnel. Cloudflare may process technical connection information when providing, transmitting and securing the connection.

The local nginx access log is configured to minimize data and does not log the client IP address or User-Agent.

The PAUL collector logs only technical information intended for operation when handling HTTP requests. Client IP addresses and query strings are not intended to form part of regular collector access logging.

9. Maps and external content

OpenFreeMap is used for parts of the map display. When map content is requested, the browser connects to the relevant map provider and the provider may process technically necessary connection information.

In the logged-in account area, trackers with a valid position may use map services based on OpenStreetMap. The browser then connects to the relevant map infrastructure. This may involve processing the IP address, browser or device information, request time and the requested map area.

Frontend libraries may, until fully hosted locally, be loaded from external content delivery services such as unpkg. The browser also establishes a connection to the relevant provider for these requests.

10. Recipients and service providers

External providers or recipient categories involved in technical operation may include:

• Cloudflare – public web access and connection security,
• OpenFreeMap – map content where used,
• OpenStreetMap Foundation or related OpenStreetMap infrastructure – map content in functions using these services,
• unpkg and its technical infrastructure – external frontend resources while these resources are not fully hosted locally.

11. International data transfers

Use of external service providers may result in processing outside the European Union or European Economic Area.

Cloudflare states that it relies, among other mechanisms, on the EU Standard Contractual Clauses for international transfers from the EEA and additionally on its EU-U.S. Data Privacy Framework certification for transfers to the United States.

12. Retention

Account and assignment information is generally retained while the account or assignment exists or while the data is required to operate the service.

Sessions are currently designed for a maximum period of 30 days.

Gateways and trackers can be removed from an account.

Coverage and historical radio information may be retained on a long-term or permanent basis for network coverage display and analysis, subject to applicable deletion obligations and rights.

13. Legal bases

Depending on the processing activity, the legal bases may include:

• Article 6(1)(b) GDPR for processing necessary to provide account and service functions requested by the user,
• Article 6(1)(f) GDPR for secure and stable operation, troubleshooting and prevention of abuse. The operator's legitimate interests include IT security, service functionality and prevention of abusive access,
• Article 6(1)(a) GDPR where processing or publication is based on voluntary consent.

Consent may be withdrawn with effect for the future.

14. Data subject rights

Subject to the applicable legal requirements, data subjects may have rights including access, rectification, erasure, restriction of processing and data portability as well as, where applicable, the right to object or withdraw consent.

Requests can be sent to [email protected].

Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority.

15. Minors

Where processing is based on consent and an information society service is offered directly to a child, the applicable legal requirements for children's consent apply.

Consent-based public location or tracker sharing by persons under 16 should only be used with any legally required consent of a parent or guardian.

16. Data export

The account may provide a reduced JSON export containing account information, the user's gateways and trackers, PAUL IDs or names and location-sharing settings.

A more extensive access request may be submitted by email.

17. Changes to this Privacy Policy

This Privacy Policy may be updated when functions, technical procedures or legal requirements change.

The current version is identified by the update date shown above.