SnoozeCamp
Art. 13 GDPR
Privacy notice
As of 8 November 2026. This notice applies to snoozecamp.com and app.snoozecamp.com.
1. Controller
Simon Gralki e.v.
Petőfi utca 2/a
9741 Vassurány, Hungary
Email: kontakt@snoozecamp.com
No data protection officer is appointed, because there is no legal duty to do so. If that duty arises, the appointment will be added here.
2. Overview
SnoozeCamp processes the data that running the account, the worker phone and the climate control requires. There are no advertising cookies, no audience tracking and no disclosure for advertising. Fonts are served from our own servers, not from a font network.
The legal bases are, depending on the step, Art. 6(1)(b) GDPR (the contract for the user account) and Art. 6(1)(f) GDPR (operation, security and abuse prevention). Where we rely on legitimate interests, that interest is the safe and working operation of the service. We ask for consent only where it is needed, in particular when you expressly turn on web push in the browser. Registration requires acceptance of the terms of use and acknowledgement of this notice. Processing for the account is based on the contract, not on that acknowledgement.
3. Hosting
The servers are with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Nuremberg, Germany. There is a processing agreement with Hetzner under Art. 28 GDPR. Hetzner provides computing, network and storage and, as a technical necessity, processes traffic data on our behalf. Hosting itself does not transfer data to a third country.
4. Server logs
When you visit, the web server processes the IP address, date and time, the address requested, the status code, the amount of data transferred and the user agent. The purpose is technical operation and defence against attacks. The legal basis is Art. 6(1)(f) GDPR. Logs are deleted or overwritten after 14 days at the latest, unless a concrete security incident requires a longer retention of an extract. They are not combined with the user account unless that is needed to investigate abuse.
5. Account and passkeys
On registration we store the email address, the public key of the passkey, the authenticator identifier, a signature counter, the time you accepted the terms of use (version of 25 October 2026) and technical session data. A sign-in challenge is stored only for a few minutes and then deleted.
Biometric characteristics, such as a fingerprint or a face, do not leave the device. The server sees only the result of the check by the authenticator, not the biometric pattern. Art. 9 GDPR is therefore not affected on the server.
The session is kept in a cookie named snooze_session. The cookie contains a random identifier, is HttpOnly, is set with the Secure attribute in production, and is SameSite=Strict. It is technically required and expires after 30 days. Consent under the German TDDDG is not required, because the cookie only provides the service you requested.
The legal basis is Art. 6(1)(b) GDPR. The data stay stored until the account is deleted. Expired sessions are removed automatically.
6. Vehicle and control data
So the web app can show the state and camper mode can run, we store, for the vehicles you take over, in particular the model and the name you gave, the vehicle identification number, the last reported status (including battery level, remaining range, climate state and lock), the target temperature chosen in SnoozeCamp, the discharge limit, the end time set for camper mode, and the commands that were carried out, with their result.
The latest status stays stored while the vehicle is in the account, and is replaced by each new report. Older status reports in the history are deleted after 30 days. Command records stay until the account is deleted, because they show the actions you triggered.
The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for the short history that makes automation faults visible. The data are not passed to vehicle manufacturers and not used for advertising.
7. Worker phone
From the worker phone we store a name you gave, the public device key and the time of the last connection. The private key stays in the Android keystore. The PIN, the S-PIN and the contents of the manufacturer app are not sent to SnoozeCamp. The manufacturer app is operated on the phone itself.
8. Web push
If you allow notifications in the browser, we store the subscription endpoint and the two keys the browser issues for it. We use them to send short notices, for example that a command failed. The legal basis is Art. 6(1)(b) GDPR together with your permission in the browser.
The message is passed encrypted to the browser’s push service (depending on the browser, a service of Google, Mozilla or Apple). That service sees the endpoint and the encrypted content, not the plaintext. This is technically required to deliver the message. You can withdraw push in the browser or by signing out in the app. The stored endpoint is then deleted. We delete endpoints that have become invalid as soon as the push service reports them as expired.
9. Newsletter
On app.snoozecamp.com you can sign up for news about SnoozeCamp. For this we store the email address, the chosen language, the time of sign-up and the wording of the consent you saw. The legal basis is your consent under Art. 6(1)(a) GDPR. Signing up is voluntary and has no effect on a user account.
Before the first mailing we will ask you by email to confirm the address. Unconfirmed addresses receive no mailings. You can withdraw your consent at any time with effect for the future, through the unsubscribe link in every message or by email to kontakt@snoozecamp.com. The address is then deleted. It is not passed on to third parties and is stored at Hetzner as described in section 3.
10. Cookies and local storage
We do not set tracking, marketing or third-party cookies. Besides the session cookie, the website and the web app store on the device the chosen appearance (light or dark) and the chosen language. That stays on the device and is not sent to the server.
11. Fonts
Instrument Sans and Space Grotesk are delivered as files from snoozecamp.com and app.snoozecamp.com. Loading the fonts does not create a connection to Google or any other font provider.
12. Recipients
The recipients are ourselves and Hetzner Online GmbH as processor. If web push is on, the push service of the browser is added, as described in section 8. A transfer to a third country can arise if that push service is operated outside the European Economic Area. It happens only because you turned push on, and only to the extent required for it. Otherwise we do not sell data and do not pass it on for third parties’ own purposes.
13. Duty to provide data
The email address and creating a passkey are required for the contract. Without them we cannot keep an account. Vehicle data are required if you want to use camper mode and the status display. Web push is voluntary.
14. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Deleting the account in the app usually fulfils a request to erase the account data.
You can complain to a supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the place of the alleged infringement. For the place of business in Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9–11., 1055 Budapest, naih.hu.
Send requests to kontakt@snoozecamp.com.