Legal notice & privacy

This is a courtesy translation. The German version is the legally binding one.

Information pursuant to Section 5 DDG

Christian Dresel
Unterfürberger Str. 52
90768 Fürth
Germany

Contact

Disclaimer for the Overpass service

Data source. Through the Overpass API, this server provides unmodified data from OpenStreetMap (Geofabrik extracts for Europe and North America). The data is collected by the OpenStreetMap community and is neither checked nor edited by me. I give no warranty for its correctness, completeness or currentness. The data is updated regularly as soon as new data becomes available (usually the next day). The data may therefore also be older.

Provision of the service. The service is operated privately, free of charge and without any assurance of availability, response time or a particular query performance. It may be changed, restricted or discontinued at any time without notice, for example for maintenance, data imports or in case of overload. Queries are limited per IP address and may be rejected. No applications should be built on the service where an outage could cause damage (for example navigation, emergency or safety applications).

Use of results. Anyone who reuses query results is themselves responsible for complying with the ODbL (in particular the attribution “© OpenStreetMap contributors”) and for the lawful use of the results. The respective user alone is responsible for queries they send to the server and their contents. Abusive use or use that disrupts operation (for example continuous load, circumventing the limits) may lead to a block.

Statutory liability. Liability for intent and gross negligence, for injury to life, body or health, and under mandatory statutory provisions remains unaffected. Otherwise liability is excluded to the extent permitted by law. Under Sections 7 to 10 DDG, I am not obliged to monitor third-party information that is transmitted.

Liability for links

This site links to external websites (for example OpenStreetMap and the OSM wiki) whose content I have no influence over. The respective operator is always responsible for them. No legal violations were apparent at the time of linking.

Copyright and licence

The texts of these pages written by me are subject to German copyright law. The map data served is © OpenStreetMap contributors and available under the Open Database License (ODbL). The Overpass API is free software (AGPL).

Privacy

Controller is Christian Dresel; for address and email see above.

What data is processed. When you visit this site and the API (/api/ and /api-na/), the server processes technically necessary data:

Web server log (Apache): IP address, date and time, requested URL and method, status code, amount of data transferred, referrer and browser/client identifier (user agent). Retained for 14 days, then deleted automatically.
Overpass log: For each query, the service stores the query text, time, run time and resource consumption, as well as the IP address of the requesting client (it is needed for the per-IP limit). Also retained for 14 days. Therefore, do not send personal or confidential information in query texts.
Usage statistics (start page): A script counts only numbers, namely queries per hour (split by Europe and North America), rejected queries, CPU load and the maximum number of concurrent queries. No IP addresses, browser identifiers or query contents are stored. The figures are anonymous and shown as a chart on the start page (data of the last 31 days).

IPv4, IPv6 and the upstream proxy. My server is located at my home in Fürth. IPv6 requests arrive there directly; I ask that you preferably use IPv6. IPv4 requests are routed through an upstream proxy server in Germany which is not operated by me and over which I have no influence (information about the service: sni.fff.community). The proxy only forwards the encrypted connection based on the server name (SNI) and does not decrypt it (end-to-end HTTPS); it therefore cannot read query texts or responses. For technical reasons, the proxy operator sees the client’s IP address, the server name, and the time and data volume of the connection. Unencrypted HTTP requests over IPv4 are answered by the proxy itself with a redirect to HTTPS. Whether and for how long the proxy operator logs data themselves, I do not know and cannot make any statement on this. For IPv4 requests, my server receives the client’s IPv4 address embedded in an IPv6 address. In the web server log it appears in this embedded form, in the Overpass log as an ordinary IPv4 address. It remains personal data and, like the other log data, is deleted after 14 days. I am not aware of any processing outside Germany.

Purpose and legal basis. The processing serves secure and stable operation, error analysis, limiting the load per user and the prevention of abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the service). The data is not combined with other data, not linked into profiles, not passed on to third parties by my server and not used for advertising (for the proxy on IPv4 see above). The logs are evaluated only manually for troubleshooting and abuse prevention.

Cookies, third parties. These pages set no cookies. The start page and this legal notice do not load external fonts or images. The connection is encrypted via HTTPS (TLS). The certificate is from Let’s Encrypt; no visitor data is transmitted in the process. When you click external links (for example to OpenStreetMap or PayPal), the privacy policies of the respective provider apply.

Web analytics of the start page (Matomo). On the start page (not on the API, not in Overpass Turbo) I use Matomo, open-source software for audience measurement, to see how often the start page is viewed. Matomo runs on the operator’s own server (matomo.dresel.systems); no data is transmitted to third parties. Recorded are the page viewed, the approximate origin (country, city), browser type, operating system, screen resolution and the referrer URL. No cookies are set (Matomo is configured cookieless), and the IP address is shortened at collection (the last two number blocks are removed, 203.0.113.45 becomes 203.0.0.0), so it can no longer be attributed to a specific person. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing and improving the offering). The anonymised analysis data is stored for the longer term in order to compare developments over time. You can switch tracking off here at any time (a script from matomo.dresel.systems is loaded on this page for that purpose):

Web interface Overpass Turbo (/turbo/). The pages and scripts of Overpass Turbo are served by this server, and queries go to this server. To display the map, however, your browser loads map tiles directly from tile.openstreetmap.org, the tile server of the OpenStreetMap Foundation (OSMF, United Kingdom). For technical reasons, the OSMF thereby receives your IP address, the browser identifier and the requested map sections; I have no influence over this processing, and the OSMF privacy policy applies. If you use the place search in Turbo, the search term is sent together with your IP address to nominatim.openstreetmap.org (also OSMF). The legal basis for the map display is Art. 6(1)(f) GDPR (providing a functional map interface); you trigger the place search yourself through your input. If you do not want this, use the API directly (/api/interpreter or /api-na/interpreter) without the web interface. Turbo stores settings and recently used queries locally in your browser’s storage (localStorage); this data does not leave your device.

Your rights. You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority; in Bavaria this is the Bavarian State Office for Data Protection Supervision (BayLDA). Providing the data is not mandatory; without it, however, the server cannot technically be operated. Please send requests by email to the address above. Because the logs are deleted after 14 days, I cannot attribute older accesses any more.