Privacy policy
How Spare-bag processes personal data under the GDPR
Version 1.0 · Last updated: 4 September 2026
Spare-bag is a community-based peer-to-peer platform that helps travellers with unused luggage capacity connect with people who may need help moving personal belongings between locations. Spare-bag facilitates discovery and communication between independent users. It does not provide transport, shipping, logistics, customs, insurance, escrow, delivery guarantees or commercial freight services. This policy explains what personal data we process, why, on what legal basis, how long we keep it and which rights you have.
1. Controller
The controller for the processing described here is the operator of spare-bag.com named in the legal notice (Impressum). Data-protection enquiries can be sent to the contact address published there.
2. Data protection officer and EU representative
Spare-bag appoints a data protection officer only where legally required. If an officer or an EU representative has been appointed, their contact details are published in the legal notice. Where no appointment is required, enquiries are handled by the operator directly.
3. Categories of data and purposes
Account and profile data (email, display name, optional first and last name, country, languages, biography, profile photo) to create and operate your account. Route and listing data (cities, countries, dates, capacity, preferences) to publish your offer or request and match routes. Connection data (contact requests, acceptances, declines, plan details) to enable contact between members. Message data (encrypted chat content and metadata such as sender, timestamps and read state) to deliver conversations. Review and rating data to build community trust. Moderation and reporting data (reports, flags, decisions, appeals) to keep the platform safe and to comply with legal obligations. Authentication, device and log data (IP address, browser data, session and device identifiers, error and audit logs) to secure the service. Support and email data (messages you send us, delivery and unsubscribe status) to answer you and manage notifications.
4. Legal bases
We process data to perform our contract with you under Art. 6(1)(b) GDPR (account, listings, connections, messaging, reviews). We rely on legitimate interests under Art. 6(1)(f) GDPR for security, abuse prevention, moderation, service improvement and product analytics that you have not objected to. We rely on your consent under Art. 6(1)(a) GDPR for optional cookies and similar technologies, for optional notification emails and for optional profile content you choose to publish. We rely on legal obligations under Art. 6(1)(c) GDPR for record keeping, reporting mechanisms and responses to lawful authority requests.
5. Special categories of data
Spare-bag does not ask for special categories of personal data such as health, religion, political opinions or biometric data. Please do not put such information into your profile, listings or messages. If you do, it is processed only because you made it public yourself and can be removed on request.
6. Encrypted messaging
One-to-one chats are end-to-end encrypted in your browser. We store ciphertext only and cannot read the content of those messages. Encryption keys are generated on your device. We do process technical metadata such as who exchanged messages, when, and whether a message was read. If you lose your device keys, past messages cannot be recovered by us.
7. Recipients and processors
We use service providers who process data on our instructions under Art. 28 GDPR: our hosting and application platform, our database and authentication provider (Supabase), and our transactional email provider used for notify.spare-bag.com. Other members only see the profile and listing information you choose to publish; private contact details such as phone numbers, email addresses or WhatsApp details are never shown publicly and are only disclosed when both sides consent.
8. International transfers
Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision or on the European Commission's standard contractual clauses together with additional safeguards where required.
9. Retention
Account and profile data are kept while your account exists. When you delete your account, your profile is anonymised and private contact data is deleted; content that must remain for legal, security or evidential reasons (for example moderation records, reports and acceptance logs) is retained for as long as required. Log data is kept for a short period for security purposes. Listings expire automatically and are removed or archived after expiry. Legal-acceptance records are retained for the duration of the limitation period.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) — including objection to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time with effect for the future. You can export your data and delete your account yourself under Account > My data. You also have the right to lodge a complaint with a supervisory authority, in Germany with the authority responsible for the operator's place of business.
11. Automated decisions and profiling
Spare-bag does not use automated decision-making with legal effect. Route matching and search ranking are simple filters and sorting rules based on the criteria you enter; they do not evaluate your personality and can be reproduced by you at any time in the search interface.
12. Security
We use transport encryption (HTTPS), row-level access control in the database, role-based staff access, encrypted password storage handled by our authentication provider, end-to-end encryption for one-to-one chats, and audit logging for staff actions. No system is perfectly secure; report suspected security issues through the support page.
13. Cookies and similar technologies
Strictly necessary storage is used for your session, language, consent record and local chat keys. Analytics and marketing technologies are used only after your consent and can be withdrawn at any time via 'Cookie settings' in the footer. Details are described in the cookie banner and its category descriptions.
14. Changes to this policy
This policy is versioned. When we make material changes we publish a new version, show the version and date on this page, and ask signed-in members to acknowledge the update where it is legally required. Older versions and acceptance records are retained.
15. Contact
For any privacy request, use the contact address published in the legal notice or the support page. We answer within the statutory deadlines, normally within one month.