Privacy Policy

Types of Cookies We Use

• Essential Cookies: These cookies are necessary for the website to function properly and cannot be switched off in our systems.
• Analytics Cookies: These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously.

Device identifier

On first launch the app creates a record for the installation and receives an identifier and a secret. The identifier is a pseudonym: it is not tied to your name, your email address, your Apple ID or your phone number, and on its own it says nothing about who you are. Settings → This device shows it.

The secret is kept in the phone's own secure store - the Keychain on iOS, the Keystore on Android - and never leaves the device. Our server stores only its SHA-256 hash, so a copy of our database holds nothing that could be replayed as your device.

What the app stores on our server

• Platform, app version and operating system version, so we know which build a report comes from and when to suggest an update.
• The language the app runs in, so that what we send back is in it.
• The time zone your phone reports. A daily summary is timed by your local hour, so this is what decides when it would arrive.
• A salted SHA-256 hash of the address the app registered from. The address itself is never written down. The hash does one job: counting how many devices a single address has registered in the past hour, so nobody can fill the table with invented installations.
• Your notification settings: which subjects you switched on (weather warnings, airport wind, trail closures, events), whether you want a daily summary and at which morning hour, and the quiet hours in which nothing but a weather warning or the summary you timed yourself is delivered.
• Your travel dates, if you enter them. The daily summary can be limited to the days you are actually on the island, and that is what the two dates are for. You type them in yourself, they are cleared as soon as you switch the summary off or to every day, and they are used for nothing else.
• The push token, once you allow notifications. It is the address Expo's push service delivers to; it names the installation, not you, and it is cleared when the phone reports the app gone. Next to it we keep a short log of what was sent - the kind of message, what it was about and when - so the same warning is not sent twice.
• Your purchases: a random purchase identifier the server issues to the installation, and for each package you bought the store product, whether it came from the App Store or Google Play, the store's transaction identifier and the dates. No card number, name or billing address ever reaches us - Apple and Google take the payment.
• The date the app last spoke to the server.

In-app purchases

Four itinerary packages are sold as one-time purchases through the App Store and Google Play; the three-day package is free. To sell without an account, the server gives each installation a random purchase identifier, and the app passes it together with the store's receipt to RevenueCat, which checks the receipt with the store. Our server then asks RevenueCat what the installation owns and records the result: the package, the store product, the store, whether it was a test or a live purchase, the store's transaction identifier and the dates. RevenueCat also notifies our server of later changes, such as a refund, and we keep those notifications.

A purchase belongs to the Apple or Google account it was made with. A reinstall or a new phone is a new installation with no purchases on it; Restore purchases, in the package card and under Settings → Purchases, asks the store for them again.

Usage statistics and crash reports

Only after you explicitly allow usage statistics and error reports, the app sends short usage events to PostHog: the name of a screen or an action (an article opened, a trail filter chosen, a camera started), the app launching or going to the background, and crash reports with the technical trace of the error. Each event carries the phone model, the operating system and app version, the language and the time zone. PostHog discards the address the event came from before storing anything, and derives no location from it. The events are filed under a random identifier that PostHog's library creates on the phone. It is not your name, not the device identifier above and not an advertising identifier, and we never link it to a person.

On iPhone, iOS asks once after the intro with its own tracking dialog: Allow turns usage statistics and error reports on, Ask App Not to Track keeps them off. On Android, one dialog on the home screen offers Allow and Decline. Before consent, the PostHog SDK is not started and no analytics events are collected or sent. The app works the same if you decline. We store your choice, its date and the notice version on your phone. Settings → Privacy → Usage statistics lets you withdraw consent at any time, and on iPhone give it again only while iOS Settings → Privacy & Security → Tracking allows it. Withdrawal stops new collection and blocks pending analytics requests; it does not delete events already received by PostHog. If you opt in again, a new random analytics identifier is created.

Deleting the device does not reach PostHog, which holds the events under its own identifier. Write to info@denis.pt if you want them deleted there as well, and tell us the phone model and the period you used the app, since that identifier is shown nowhere.

Your location

The 3D map has a button that shows where you are. It asks for the location permission while the app is open, draws your position on the map and forgets it when you leave the screen or put the app away. The position is never sent to our server or to anyone else, and nothing stores it.