How GratisParkering processes personal data.
Effective date: 7 November 2026 Last updated: 7 November 2026
The controller is VIBECODE AS, org. no. 938 738 750, Gjerdrums vei 12D, 0484 Oslo, Norway ("we"). This policy covers the GratisParkering app for iOS and Android and the website gratisparkering.net. What the app and the website store on your device is described in our Cookies and On-Device Storage notice (gratisparkering.net/en/cookies).
Contact: [email protected] · phone +47 92 08 62 08.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email address (or Apple's relay address if you hide your email), the sign-in method you use (Google, Apple or email and password), internal user IDs, and for email accounts a cryptographically hashed password (never the password itself). Which version of the terms you accepted, and when | Create and run your account, sign you in, send verification and password-reset email, show that you accepted the terms | Contract (GDPR art. 6(1)(b)). The record of when you accepted the terms: legitimate interest in being able to document the agreement (6(1)(f)) |
| Sign-ins on your phones: for each phone a fingerprint (hash) of a refresh token, when the sign-in started and when it was last used | Keep you signed in without signing in every day, and let you sign out everywhere | Contract (6(1)(b)) |
| Location while the app is in use (precise) | Show nearby spots, show routes and travel time, detect arrival | Contract (6(1)(b)). You grant permission in your phone's settings and can withdraw it there |
| Content you share: for a parking spot its location, address, note, photo, tags and rules; for street parking the stretch along the curb, a photo of the sign, the rules and a note to the moderator | Show the spot or stretch to other drivers after approval | Contract (6(1)(b)) |
| Street-parking answers ("Stemmer det med skiltet?", does it match the sign?): which stretch, your answer and when | Find and fix errors in the street parking | Legitimate interest in accurate data (6(1)(f)) |
| In-app activity: upload and approval counts, favorites (a favorite also counts as a "like" for the spot), reports with a reason, badges | Reward programme, favorites, quality control and moderation | Contract (6(1)(b)) and legitimate interest in a safe, accurate service (6(1)(f)) |
| Free months: each grant (which spot, when, number of days), your balance, and when you redeem a month: the App Store code you were given, when it was given, when it expires and whether it was used | Give you the free months you earned, and stop the same month being used twice | Contract (6(1)(b)) |
| Push token (if you allow notifications) | Tell you when a spot you shared is approved or declined. The app asks about notifications when you start a parking timer, turn on zone alerts, start a trial or have shared your first spot. The phone's push token is registered with us only once you have shared a spot. Parking-timer reminders, zone alerts and the reminder before a trial ends are created on the phone and need no push token | Contract (6(1)(b)). Turn notifications off in your phone's settings |
| Parking timer and zone alerts (Pluss, only if you use them): the spot you parked at (its name and the spot's location), when the time runs out, how long before you want a reminder, and whether you turned on alerts before winter parking and other zone rules. On iPhone the spot's name and the time also show in the widget and on the lock screen | Remind you to move the car before the free time ends, and warn you before a zone rule starts where your car or favorites are | Contract (6(1)(b)). Stored only on your phone and not sent to us. Strictly necessary for the feature you switch on yourself (section 3-15(2) of the Norwegian Electronic Communications Act) |
| Subscription status and purchase events (active or expired, product, renewal date; from RevenueCat also which store, whether it is a trial or an offer, the reference of the offer or code you used, for example a partner code or a free month, price and currency, purchase time and the store's transaction IDs) | Give you the access you paid for, customer support and refunds, count how many people redeemed each partner offer, and produce totals for trials and purchases | Contract (6(1)(b)). Counts and totals: legitimate interest (6(1)(f)). Retention under the Bookkeeping Act (6(1)(c)), see section 6 |
| Search text for destinations | Find addresses and places. Recent searches are stored only on your phone | Contract (6(1)(b)) |
| Usage statistics from the app (only if you ticked the box): which steps of the introduction, sign-in and sign-up you reach, which sign-in method you tap, whether you cancel, error codes, which rule a form field did not meet (never what you typed), that you viewed or accepted the terms, that you saw the map for the first time, where you opened the Pluss page from, which plan you picked, whether a purchase was started, completed, cancelled or failed, and whether you tapped "Restore purchases" (no prices or payment details), whether you start or stop a parking timer (and whether the time came from the sign or you picked it, but not where), and whether you turn zone alerts on or off and which alert lead time you choose. Each event carries a time, the platform (iOS/Android), the app version, a random session ID that the app keeps in memory only and creates anew every time it starts, and, while you are signed in, an internal user ID | Find out where people give up when creating an account, getting started or considering Pluss, and make the app easier to use. We look at totals, not at individuals | Consent (art. 6(1)(a), and section 3-15 of the Norwegian Electronic Communications Act because the app reads and sends information from your phone). You consent by ticking the box "Hjelp oss med å forbedre opplevelsen din" (help us improve your experience) on the sign-in screen. It is not ticked in advance. You can withdraw consent at any time under Profile → Konto og innlogging → Del bruksstatistikk, as easily as you gave it |
| Sign-up counts on the server: that an account was created, an email address verified, a verification email resent, the terms accepted and a sign-in succeeded (sign-in method, new or existing account), with a time. No user ID, session ID or IP address | Count how many people get through each step of sign-up | Legitimate interest in improving the service (6(1)(f)). The data comes from requests the app sends anyway to create your account or sign you in |
| Technical logs and security: IP address, time, request. For email sign-in we count failed attempts and emails sent, using a fingerprint (hash) of the email address and, for failed attempts, the IP address. When an account is deleted, we keep a fingerprint of the username for one day so old sign-ins cannot re-create the account | Security, troubleshooting, abuse and password-guessing prevention | Legitimate interest (6(1)(f)) |
| Suspension (timestamp) if you break the terms | Enforce the terms | Legitimate interest (6(1)(f)) |
| Internal account notes: short notes our staff write about your account for customer support and moderation, for example about a request from you, a report or a breach of the terms, and the reason when we give you free time or end it early. With who wrote the note and when. The notes are never shown in the app | Give good customer support, remember what was agreed with you, and enforce the terms the same way for everyone | Legitimate interest in running customer support and a safe service (6(1)(f)). You can object (section 8) |
| Messages to us by email | Answer and help you | Contract (6(1)(b)) or legitimate interest in answering enquiries (6(1)(f)) |
Usage statistics: we produce and store the statistics ourselves, on the same server as the rest of the service (see section 5). They are not sent to analytics companies or anyone else. We never send your email address, password, name, location, advertising ID or device ID with the statistics, and we do not store your IP address with them. Only our moderator sees the statistics, and only as totals. If you don't tick the box, or turn it off, the app sends no usage statistics, and everything in the app works as before.
Photos: photos are downscaled and re-saved before upload, which removes metadata such as GPS position and camera details. Do not upload photos where number plates or faces can be read. We decline or blur such photos during moderation. The moderator uses a photo of a parking sign to check the rules you entered.
Notes: do not write names, phone numbers or other personal data in a note. Approved notes on spots stay in the service after you delete your account (see section 6). The note to the moderator when you add street parking is not shown to other users.
Internal account notes: only our staff with access to the admin tool can write and read them. We keep them short and factual, and never about health or other special categories of personal data. If you ask for access, you get a copy of the notes about you (see section 8).
We don't collect: advertising IDs, tracking data, data from third-party analytics or crash-reporting tools, contacts, background location, your number plate or payment details. Payment happens at Apple or Google.
We never sell personal data and never share it with anyone for marketing.
| Provider | Used for | Data | Where |
|---|---|---|---|
| AINIRO.IO Ltd (Magic Cloud) | Server, database, photo storage, usage statistics, the website | Account, content, activity, usage statistics, push token, purchase events, internal notes, logs | Company in Cyprus (EU). The servers and the database are in New York, USA, at DigitalOcean, LLC |
| Cloudflare, Inc. | Delivers the website and the admin tool, and caches street-parking data and photos closer to you | IP address and the request | EU/US |
| Resend, Inc., sending through Amazon Web Services | Sending verification and password-reset email | Email address and the email's content | US (the company), Ireland (the sending) |
| Uniweb AS | The mailbox [email protected] | What you write to us, and your email address | Norway |
| Google (Google Sign-In, Maps SDK for iOS and Android, Places, Geocoding, Directions, Roads) | Sign-in, the map in the app, address search, a spot's address, route and travel time, placing a spot or a street stretch along the road | Email at sign-in; location, coordinates and search text with each request | US/EU |
| Apple (Sign in with Apple, APNs notifications, App Store) | Sign-in, delivering notifications, payment, redeeming codes | Email or Apple relay address, push, purchases | Ireland/US |
| Google Play | Payment, redeeming codes and notifications on Android | Purchases, push | US/EU |
| RevenueCat, Inc. | Subscription management | A random user ID (not your email address), purchase and subscription status | US |
| Expo (650 Industries, Inc.) | Relaying push notifications about the spots you share, and delivering app updates | Push token and notification text; for updates the IP address, app version and platform | US |
When you tap "Open in Maps", Apple Maps or Google Maps opens, and that app's privacy policy applies. Logos on sponsored spots are loaded from our own server. If you tap "Åpne nettsiden" (open website) on a sponsored spot, the business's website opens, and the business's privacy policy applies.
Apple and Google process the purchase, the payment and your purchase history as independent controllers under their own terms and privacy policies.
Transfers outside the EEA: our servers and database are in the US, and some other providers also process data there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (art. 46). Contact us for a copy of the relevant safeguards.
Go to Profile → Delete account. You confirm with your sign-in method, and deletion happens immediately, as described in section 6. We delete your account data, including your email address, user account and roles, the sign-ins on your phones, push token, favorites, free-month balance and internal account notes, remove your user ID from the usage statistics and the purchase events, and the app deletes your data on the phone. If you used Sign in with Apple, you can remove the app from your Apple ID yourself under Settings → [your name] → Sign in with Apple. A subscription is not cancelled automatically. Cancel it in the App Store or Google Play. You can also request deletion at gratisparkering.net/slett-konto or by writing to [email protected] from the email address linked to the account.
You have the right to access, rectification, erasure, restriction and data portability, and the right to object to processing based on legitimate interest. Access includes the internal notes we have written about your account. Where we rely on consent (usage statistics), you can withdraw it at any time under Profile → Konto og innlogging → Del bruksstatistikk. This does not affect processing that took place before you withdrew it. Write to [email protected]. We reply within one month. You may complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), though we'd appreciate hearing from you first.
All traffic is encrypted (HTTPS). The sign-in and refresh tokens are kept in the phone's secure storage (Keychain or Keystore), passwords are stored only as hashes, and the server keeps only a fingerprint of the refresh token. The admin tool requires a two-step sign-in and is limited to our staff.
The app is made for drivers and is not directed at children. You must be at least 13 to create an account (see section 5 of the Norwegian Personal Data Act). Contact us if a child under 13 has created an account, and we will delete it.
For material changes, we notify you in the app before they take effect. The date at the top shows the current version.
