Last updated: September 8, 2026
This policy covers the Littr website (littr.info) and the Littr apps for iOS and Android.
Littr (“Littr,” “we,” “our,” or “us”) is a community-run litter picking project based in Berlin, Germany, operated by an individual rather than a registered company. For the purposes of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), we are the data controller for the personal data described in this policy.
You can reach us about anything in this policy at contact@littr.info. We have not appointed a Data Protection Officer, as we are not required to.
The litter collection totals shown on our home page and stats page come from a spreadsheet of event weights. It contains collection dates and kilogram totals, not personal information about participants.
We do not ask for your phone number, your real name, your date of birth or your address.
If you mark litter while offline, the mark and its photo are held in a queue on your device only and uploaded when you are back online. Nothing leaves your phone until then.
To be explicit: the Littr apps contain no advertising software, no session recording or screen replay, no social login, and nothing that tracks you across other apps or websites. We do not collect your contacts, your calendar, your health data, your device advertising identifier, or your location while the app is closed or in the background.
Littr works because the community can see where litter is. When you submit a mark, the following becomes visible to other signed in Littr users on the map and in the app's feeds:
The leaderboard shows your username, level, the XP you earned in the selected period, and how many marks and cleanups you have recorded, ranked against other users for the week, the month or all time. Everyone signed in to Littr can see it. Taking part is automatic — if you would rather not appear, contact us.
Please think before you submit. Do not photograph people, faces, number plates, house numbers, letters or documents, and avoid marking litter at a location you would not want associated with you, such as directly outside your own home. Anything visible in a photo is published along with it.
Your email address and password are never shown to other users.
Littr organises real litter picks, and the app has a set of features for running them. They involve more location data than the rest of the app, so they are worth reading properly.
An event has a title, a description, a meeting place and a time, set by whoever organises it. When you join one we record that you joined and when, and if you later withdraw, that too. Other attendees and the organiser can see that you are coming, under your username.
When you check in at an event we record the time, your coordinates, and how far you were from the meeting point — this is what stops someone collecting credit for an event they never attended. If your location is switched off, an organiser can check you in instead, and we record that they were the one who vouched for you. We also record the weight of what you personally collected, if you enter it, because that is what the totals on our website are made of.
During an event you can choose to share your live position with the other people at it, so a group spread across a park can find each other. This is the most sensitive thing Littr does with your data, so it is hedged about deliberately:
While a share is running we store your latest position and the accuracy your phone reported, and replace it as you move. We do not keep a history of where you went. Legal basis: your consent (Art. 6(1)(a) GDPR), which you withdraw by stopping the share.
You can ask to hear about new events near a place that matters to you. If you do, we store that place and the distance you chose — between 1 km and 50 km — so we can work out which new events to tell you about. The place is rounded before we store it, to about a kilometre, because knowing your rough area is enough for this and knowing your address is not.
This one is opt-in by existing: if you have not set an area, there is nothing stored and nothing sent. Removing it deletes it. Legal basis: your consent (Art. 6(1)(a) GDPR).
Each event has a chat room, open from an hour before it starts until two and a half hours after it ends. Everyone at the event can read what you post, alongside your username and the time. Moderators can remove a message, and anyone can report one. People you have blocked, or who have blocked you, cannot see your messages and you cannot see theirs.
Your name stays on your messages after you delete your account. A conversation with half its authors replaced by “deleted user” stops making sense to the people still in it, so we keep the display name attached to what was said. If you want your messages removed as well, ask us.
If you allow notifications, your device gives us a notification token, which we store so we can send to that device and remove when it stops working. There are six kinds, and each can be switched off on its own: event chat, event reminders, activity on litter you marked, new events near you, badges and levels you have earned, and occasional announcements from us. Announcements have their own switch on purpose — a channel you cannot mute is what makes people turn notifications off altogether.
Blocking works in both directions and everywhere a location carries a name: marks, events, attendee lists, live positions, chat and the notifications that announce any of them. Neither of you sees the other. We store who blocked whom and when; we do not tell the person they were blocked.
When you send feedback from the app we receive what you wrote, which kind of feedback it is, and — so we can reproduce a bug — your platform, app version, operating system version and device model. You can attach a screenshot or a short screen recording. Your account email is filled in as the reply address, and you can change it.
If we reply, it arrives as an ordinary email and your answer comes back into the same conversation, so support is a thread rather than a void. If you delete your account, your reply address and any files you attached are deleted; the text of what you told us stays, detached from you, because it is about the product rather than about you.
Photos must be JPEG, PNG, HEIC or WebP, and up to 10 MB. A photo attached to a mark should show litter — not people, faces, number plates, house numbers, letters, documents or anything else that identifies somebody. Sexual content, gore and hateful material are not allowed anywhere on Littr. If you send us feedback from the app you can attach a screenshot or a short screen recording; those go only to us and are never shown to other users.
Because a photo you upload can appear on other people's screens within seconds, uploads are screened automatically before anyone sees them. The image is sent to a specialist content moderation provider, which classifies it for sexual content, violence and self-harm and returns a verdict. Nothing else about you goes with it — not your name, your email address or the location of the mark.
Your photos are not stored by that provider, and are never used to train anyone's AI models. The moderation service we use keeps nothing from these checks: the image is classified in the moment and discarded. It is a content check, not a contribution to a training set.
If the screen flags a photo, the mark is hidden from everybody, including you, and waits for a person to look at it. The automated step never has the last word: a moderator makes the decision, and if they disagree with the screen they restore the mark. Equally, a photo passing the screen is not approval — it only means the classifier saw nothing, and anyone can still report it.
If the provider can't be reached, your upload is allowed through rather than blocked, and the fact that it went unchecked is recorded so it can be screened later.
You can report any mark from the app — as not litter, inappropriate, a privacy problem, or spam — and add a note. A moderator reviews it and either removes the mark or restores it. If a photo shows you or your property, reporting it is the fastest route; you can also email us.
This is the one exception to everything else in this policy about deletion, so it is worth stating plainly. When a photo is flagged, we freeze a record of it — the photo itself, the username, email address and account creation date of whoever uploaded it, and where and when it was taken. That record survives deletion of the account, and is removed only once a moderator has ruled on it.
We do this because some of what an automated screen catches is the kind of material that has to be reportable to the authorities, and someone who has just uploaded it has an obvious reason to delete their account before anyone looks. Our legal basis is our legitimate interest in the safety of the people who use Littr and in being able to establish or defend legal claims (Art. 6(1)(f) and Art. 17(3)(e) GDPR). It applies only to content the screen flagged or a moderator hid — nothing else you upload is held back this way.
We run a moderation dashboard, used by a small number of trusted Littr volunteers, so that we can answer support requests, remove content that shouldn't be there, and correct mistakes. Through it they can see your username, email address, whether your email is verified, when you joined, your score and badges, and the marks, cleanups and photos you have submitted.
Access is limited by role. Most accounts are read-only. A smaller number can edit or remove users, marks and cleanups, adjust scores and award or remove badges. A single senior role can additionally manage the other dashboard accounts and export data in bulk. Dashboard accounts are entirely separate from app accounts — no app login can reach the dashboard — they require a longer password and support two-factor authentication, and their sessions are short-lived and individually revocable.
Separately from the dashboard, event organisers can see who has joined their event, check people in, and remove someone from it. Organisers are grouped into areas covering a part of the city, and the people in an area help run each other's events there. They see attendee usernames and check-in records for their own events, and nothing else about you.
Every change is recorded. Any action that modifies data writes an entry naming who did it, what they changed, before and after, the reason they gave, and the time. Deletions and bulk exports require a written reason. We keep this record so that access to your data is accountable, and we retain it even after the account or mark it refers to is gone.
Both of the following are controlled by you, in the app, under Account → Privacy. Neither ever receives your location, photos, notes, username or email address. Both are handled by specialist providers on our behalf, on their European infrastructure, so the data stays in the EU. They are named in the service providers table below.
When the app or our servers hit an unexpected error, we send a technical report so that we can find and fix it. The report contains the error and its stack trace, your device model, operating system version and app version, and — if you are signed in — your Littr account ID, which is a random identifier. We switch off the features that would otherwise capture screenshots, your screen layout, or the web addresses our app requests (those can contain map coordinates). Expected errors, such as a wrong password or a validation message, are never reported.
Reports are kept for 90 days and then deleted. Legal basis: our legitimate interest in keeping Littr working (Art. 6(1)(f) GDPR). Switch it off under Account → Privacy → Send crash reports and it stops immediately.
If — and only if — you turn on Account → Privacy → Share anonymous usage data, the app sends a small, fixed set of events so we can see which features are actually used. Until you turn it on, the analytics software is never even started.
The complete list of events we may send is: app opened, login, registration, mark submitted (with the size band, how many litter types were ticked, and whether it had been queued offline), mark queued offline, cleanup recorded, leaderboard viewed (with which period), badges viewed, and account deleted. Alongside them we send your device model, operating system and app version, screen size, locale, timezone and network type, plus your Littr account ID. We do not record your screen, your taps, or which pages you look at.
Events are kept for 12 months and then deleted. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching the toggle off — the app stops sending immediately and forgets its analytics identity. Deleting your account also breaks the link between your account ID and any past events.
Under the GDPR we must have a lawful basis for each thing we do with your data. Ours are:
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in, keep you signed in | Username, password hash, email address, session token | Performance of a contract (Art. 6(1)(b)) |
| Verify your email address and let you recover your account | Email address, hashed verification code | Performance of a contract (Art. 6(1)(b)) |
| Publish your marks to the community map and feeds | Photo, location, litter details, username, timestamp | Performance of a contract (Art. 6(1)(b)) — this is the service you signed up for |
| Access your camera, photo library and location | Photos, precise device location | Your consent, given through the operating system's permission prompts (Art. 6(1)(a)) — withdrawable at any time in your device settings |
| Award XP, levels, streaks and badges, and rank the leaderboard | Username, XP award history, mark and cleanup counts | Performance of a contract (Art. 6(1)(b)) |
| Confirm you are old enough to use Littr | Your 16+ confirmation and its date | Legal obligation (Art. 6(1)(c)), read with Art. 8 GDPR |
| Run events: attendance, check-in and the weights collected | Username, join and check-in times, check-in coordinates and distance, weight recorded | Performance of a contract (Art. 6(1)(b)) |
| Show your live position to other people at an event | Your position and its accuracy, while sharing is on | Your consent (Art. 6(1)(a)) — off unless you start a share, withdrawn by stopping it |
| Tell you about new events near a place you chose | An approximate location and a radius | Your consent (Art. 6(1)(a)) — nothing stored unless you set an area |
| Send push notifications you asked for | Device notification token, your per-category choices | Your consent (Art. 6(1)(a)) — per category, and revocable in your device settings |
| Carry event chat, and let you block people | Your messages and display name, who you blocked and when | Performance of a contract (Art. 6(1)(b)), and legitimate interests in a safe community (Art. 6(1)(f)) |
| Answer your feedback and fix what you reported | Your message, reply address, app version, OS version and device model | Legitimate interests (Art. 6(1)(f)) — a working app and a reply you can read |
| Moderate content, answer support requests, and keep a record of what our moderators do | Account and submission data, moderator actions and reasons | Legitimate interests (Art. 6(1)(f)) — a safe community and accountable access to your data |
| Screen uploaded photos automatically before other users see them | The photo itself | Legitimate interests (Art. 6(1)(f)) — nobody should be shown illegal or abusive imagery |
| Hold a record of flagged content pending review, and report it where we must | The flagged photo, uploader username and email, account creation date, location and time | Legitimate interests and legal claims (Art. 6(1)(f), Art. 17(3)(e)) |
| Produce aggregate statistics and litter maps for the website and for community campaigns | Aggregated and anonymised mark data | Legitimate interests (Art. 6(1)(f)) — documenting the community's environmental impact |
| Diagnose crashes and unexpected errors | Error reports, device and app version, account ID | Legitimate interests (Art. 6(1)(f)) — switchable off in the app |
| Understand which features are used, to improve Littr | The usage events listed above, account ID | Your consent (Art. 6(1)(a)) — off unless you opt in |
| Keep the service secure, rate-limit abuse and fake submissions | Server logs, IP address, account and submission activity | Legitimate interests (Art. 6(1)(f)) — running a safe, working service |
| Measure website traffic and page performance | Cookieless, aggregated page view data (Vercel and Google Analytics) | Legitimate interests (Art. 6(1)(f)) — no cookies are set and no profile is built |
| Reply to you, and comply with legal obligations | Your correspondence and account data | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. XP, levels, streaks, badges and leaderboard rank follow simple published point rules, not a profiling system.
You can grant or withdraw any of these at any time in your device settings — on iOS under Settings → Privacy & Security or Settings → Littr, on Android under Settings → Apps → Littr → Permissions. Withdrawing location or camera access means you will not be able to create new marks, but the rest of the app keeps working.
We do not sell, rent or trade your personal information, and we do not share it with advertisers or data brokers. We share data only with the service providers we need in order to run Littr. Each of them acts as our processor — they may only use the data to provide the service to us, under a contract requiring protection equivalent to this policy. The categories are:
For transparency, these are the providers we currently use. If we change one we will update this list.
| Provider | What they do for us |
|---|---|
| DigitalOcean | Hosts our API, moderation dashboard and database (United Kingdom) |
| Amazon Web Services | Stores uploaded photos and sends verification email (EU) |
| Sentry | Error reporting (EU region) |
| PostHog | Usage analytics, only if you opt in (EU region) |
| OpenAI | Automated screening of uploaded photos for prohibited content |
| Vercel | Hosts littr.info and measures page views without cookies |
| Apple | iOS app distribution, map tiles, push notifications to iPhones, and the weather shown on events in the iPhone app |
| Android app distribution, device location services, push notifications to Android phones, cookieless page view measurement on littr.info (Google Analytics), and the spreadsheet holding our aggregate collection weights | |
| OpenStreetMap Foundation | Map tiles in the Android app |
| Open-Meteo | Weather forecasts for event locations, asked for by our servers — used on Android and in event reminders |
We may also disclose information where we are legally required to, where it is necessary to protect the rights, property or safety of Littr or our community, or with your explicit consent.
Our website links to our WhatsApp community group, our Instagram page, our Reddit community and our donation page. If you follow those links and take part, those services collect your data under their own privacy policies, not this one. We can see what any other group member can see — for example your WhatsApp display name and phone number in the group — but we do not export or store that information.
The Littr website does not set advertising or tracking cookies, and our page view measurement is cookieless. That includes Google Analytics, which we run in its consent-denied mode so that it never sets a cookie. The apps do not use cookies; they store your sign-in token in the device's secure storage — the iOS Keychain, or encrypted preferences on Android — so you do not have to log in every time. Signing out or deleting the app clears it.
Our moderation dashboard, which only Littr volunteers can sign in to, sets a single strictly necessary session cookie. It is not used for tracking and it is never set on littr.info or in the apps.
There are two ways to do this, and you do not need our help with either.
Deletion is immediate and cannot be undone, so if you want a copy of your data, download it first.
Deletion removes your email address, password hash, profile photo, XP history, streak and badges, and erases every photo you uploaded from our storage. By default your litter marks go with you — they come off the community map, because a trail of marks is a record of where you walked and leaving it behind should be a choice rather than something that happens by default. In the app you can choose instead to leave them standing as anonymous pins. Either way they are hidden or anonymised rather than destroyed, so that cleanups other people recorded against them, and the points those earned, survive. Once your name is off them and the photographs are destroyed, what is left is a coordinate, a litter type and a date, which is no longer personal data.
Your username is not released back for anyone else to register. We keep a record that it was used and given up, without keeping it attached to you, so that nobody signs up tomorrow and inherits whatever it meant to the people who saw it.
Three things survive deletion, and it is worth being plain about them:
Ask us if you want any of these removed too, and we will.
If you want your marks removed entirely rather than anonymised — for example because a photo shows someone identifiable — ask us and we will do that instead.
If either route doesn't work for you, email us at contact@littr.info and we will action it within 30 days.
No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will notify the competent supervisory authority within 72 hours where required, and tell you directly where the risk to you is high.
You can exercise two of these yourself, straight away and without asking us: download a copy of your data, or delete your account. For anything else, email us.
Under the GDPR you have the right to:
To exercise any of these, email contact@littr.info. We will respond within one month. We do not charge for this, and we will not ask you for more identifying information than we need to be sure it is really your account. If you ask, we will also tell you the specific providers your data has been shared with.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in our case the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), or with the authority where you live or work.
The Littr app is not intended for children under 16. In Germany, the digital age of consent under Art. 8 GDPR is 16, so users under that age may only use the app with the consent of a person holding parental responsibility. Registration requires you to confirm that you meet this condition. We do not knowingly collect personal data from children under 16 without that consent. If you believe a child has created an account, contact us and we will delete it.
Children are very welcome at our in-person litter picking events when accompanied and supervised by an adult — that does not require a Littr account.
Your photos are stored in the European Union, verification email is sent from the EU, and error reports and usage analytics are stored in the EU. Your account, marks and scores are stored in the United Kingdom. The European Commission has decided that the UK provides an adequate level of data protection, so data may flow there from the EEA without additional safeguards; that decision was renewed in March 2026 and runs until 27 December 2031.
Some of our providers are US-headquartered and may access data from outside the EEA for support and operations. Cookieless page view data from Google Analytics is processed by Google on the same basis. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework.
We will update this policy when what we do with your data changes — for example if we add a new provider, or start collecting something new. We will change the “Last updated” date above, and for significant changes we will tell you in the app before they take effect.
Questions about this policy, or about your data:
Email: contact@littr.info
WhatsApp Community: Join our WhatsApp group
Instagram: @litterpickersberlin
Reddit: r/litterpickers
*Approximately, some data may
have been missed and averaged at times.
View our stats
here
Copyright © 2025 Littr | Privacy Policy | Terms of Service