Privacy policy – Regnkort

This policy explains what data Regnkort handles, why, and what your rights are. It covers the Regnkort app for iPhone and Android and the website regnkort.dk.

The short version

There is no account and no login. We don't know your name, email address or phone number, unless you write to us yourself.
No ads and no tracking. We don't sell data to anyone.
The app reads your location when you tap the recenter button and, if you have a rain alert for your location, when you open the app. Never in the background. The point is used to fetch your forecast and is rounded to a grid of roughly 5–6 km before we request weather data. We only store it as the place of an alert for your location.
If you turn on rain alerts, we store a push key and the alert's place so we can watch the forecast and send you a notification. The notification goes via Expo and Apple or Google. Turn alerts off and we delete it.
The app registers with us using a random ID. It isn't your name, phone number or advertising ID, but it is still personal data because it belongs to your install.
The app uses RevenueCat for prices and purchases. If you have Regnkort Plus, we also store your saved places (spots). Apple or Google handles the payment, and we never see your name or card details.
Our server, database and logs are hosted at Hetzner Online GmbH in the EU.
You can delete your data yourself with "Delete my data" at the bottom of the Plus tab in the app.

Who is responsible

The data controller is:

Bech.Solutions ApS
Borthigsgade 10, 1. th., 2100 København Ø, Denmark
CVR (Danish company registration no.) 45143473
Email: mikkel@bechsolutions.dk

Email us if you have questions about this policy or want to use your rights.

At a glance

The table lists all the data we handle. Legal bases refer to Article 6 of the General Data Protection Regulation (GDPR). The sections below the table go into each one in more detail.

Data	Why	Legal basis	Where	How long
Device registration: random device ID, platform (iOS/Android), when it was created and when the app last made contact	So the app can talk to our server and a Plus subscription can be tied to the install	Contract, Art. 6(1)(b)	Our server at Hetzner in the EU and your phone's Keychain/Keystore	Until you use "Delete my data". Otherwise deleted after 12 months without any contact from the app
Sign-in key (refresh token). We store only a hash of it	So the app can sign in securely to our server without an account	Contract, Art. 6(1)(b)	Our server at Hetzner in the EU (hash) and your phone's Keychain/Keystore	Valid for 90 days. Deleted no later than 30 days after it expires or is revoked
Your location when you tap the recenter button, and the coordinates of whatever place the map shows	To fetch the forecast for that point	Contract, Art. 6(1)(b). Access is controlled by your phone's location permission	Only in our server's memory while the answer is computed	Not stored (but see alerts for your location below)
Push key (Expo push token) and the app's language	To send you rain alerts as notifications in your language	Contract, Art. 6(1)(b)	Our server at Hetzner in the EU. Notifications are sent via Expo (USA) to Apple (APNs) or Google (FCM)	As long as you have alerts turned on. Deleted when you turn them off, use "Delete my data", or when your registration is deleted after 12 months without contact
Rain alerts: the alert's place (a place you chose, or your location as the app last reported it while it was open) and the alert's settings	To watch the forecast for that place and alert you in time	Contract, Art. 6(1)(b)	Our server at Hetzner in the EU	As long as the alert exists. Deleted with the alert, with "Delete my data" or after 12 months without any contact from the app
Log of sent alerts: time, which alert, the forecast it was based on, and your answer to "Was it right?", if you give one	To measure how well alerts land and make them better	Legitimate interest, Art. 6(1)(f)	Our server at Hetzner in the EU	90 days at most
Search text when you look up a place	To find the place you're searching for	Contract, Art. 6(1)(b)	Our server's memory. Passed on to Open-Meteo without your IP address or any ID	Up to 24 hours in memory. May appear in a server log for up to 30 days if the lookup fails
Saved spots (Plus only): name, region, precise coordinates and alert setting	To show your places on the "Spots" tab and keep them in step between phone and server	Contract, Art. 6(1)(b)	Your phone and our server at Hetzner in the EU	Until you delete them, use "Delete my data" or ask us to. Deleted after 12 months without any contact from the app
RevenueCat ID and Plus status (all installs): pseudonymous RevenueCat ID, whether the subscription is active, product, expiry date, store, test or real purchase	To know whether your install has Regnkort Plus	Contract, Art. 6(1)(b)	Our server at Hetzner in the EU	Same as the device registration
Data RevenueCat receives directly from the app: IP address, pseudonymous RevenueCat ID, operating system, app version, language, store country, views of the purchase screen and purchase receipts	To show prices, complete and validate purchases and check your subscription	Contract, Art. 6(1)(b)	RevenueCat (USA)	We ask RevenueCat to delete it when you use "Delete my data", or when we delete your registration after 12 months without contact
Purchase events from RevenueCat: pseudonymous RevenueCat ID, product, price, currency, country, store, transaction IDs and timestamps	To keep your Plus status up to date, avoid handling the same event twice and fix problems with a purchase	Contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) (being able to find and fix problems with your subscription)	Our server at Hetzner in the EU	Deleted no later than 90 days after we receive them, also if you use "Delete my data"
IP address or user ID for rate limiting	To protect the service from abuse and overload	Legitimate interest, Art. 6(1)(f)	Only in our server's memory	A short time, typically about 1 minute. Never written to disk
Server logs: time, which address on the server was called (without coordinates or search text), status code and, for some events, your random user ID or RevenueCat ID. If a place search fails, the search text is included	To run the service, find and fix bugs and detect abuse	Legitimate interest, Art. 6(1)(f)	Our server at Hetzner in the EU	Deleted after 30 days at most
Access logs for the app's server and the website: IP address, time, which page or address was called (without coordinates or search text), referring page and browser type	To run the service and the website and keep them secure	Legitimate interest, Art. 6(1)(f)	Our server at Hetzner in the EU	Deleted after 30 days at most
Emails you send us: your email address, your name if you write it, the content of the email and any screenshots and order IDs	To reply and help you, and to document how we handled a request about your rights	Legitimate interest, Art. 6(1)(f) (being able to answer you), and legal obligation, Art. 6(1)(c), when you use your rights under the GDPR	Our email at Proton AG in Switzerland	Deleted no later than 12 months after our last reply

Your location

Regnkort only asks for location access while you're using the app ("While Using the App"). It asks once after you first open it, and you can say no or change your mind later in your phone's settings. The app never uses your location in the background.

Once you've given permission, this is what happens:

The app reads your position when you tap the recenter button (the arrow in the top-right corner of the map). Your position becomes the centre of the map.
If you have a rain alert for your location, the app also reads your position when you open it and sends it to our server as the alert's place. See Rain alerts.
To fetch the forecast, the app sends that precise point to our server as part of the weather request.
Our server rounds the point to a grid of roughly 5–6 km before it requests any weather data. Only the rounded point leaves our server.
The precise point is used only in our server's memory while the answer is computed. It is not stored and not written to our logs. The logs record which address on the server was called, without coordinates.
The dot that shows where you are is drawn by the map in the app (Apple Maps on iPhone, Google Maps on Android). SeeMaps from Apple and Google.

When you pan the map or search, the app sends the coordinates of whatever place the map is showing in the same way. Those only say something about you if that happens to be where you are.

You can turn location off in your phone's settings (Settings > Regnkort > Location on iPhone) and still use the map and search.

A precise position only gets stored with us if you, as a Plus user, save it as a spot yourself, for example with "Current location", or if you have a rain alert for your location. See Saved spots and Rain alerts.

Searching for places

When you search for a place, the app sends your search text to our server. The server passes the text on to Open-Meteo's place search without your IP address and without any ID. We don't store searches in a database. Results are kept in our server's memory for up to 24 hours, keyed only by the search text, so the next identical search is faster. If a lookup fails, the search text may end up in a server log, which is deleted after 30 days at most.

Registering the app

The first time you open the app, it automatically creates a random ID. It is not your phone's hardware ID or advertising ID, and we don't use it to find out who you are. The app sends this ID and your platform (iOS or Android) to our server, which creates a pseudonymous record holding the ID, the platform, when the record was created and when the app last made contact.

The app keeps the ID and a sign-in key (refresh token) securely in your phone's Keychain (iPhone) or Keystore (Android). Our server stores only a SHA-256 hash of the key, never the key itself. A key is valid for 90 days.

This registration is what lets the app fetch forecasts from our server and lets a Plus subscription be tied to your install.

The app stores only what it needs to work on your phone: its ID, its sign-in keys, your spots and RevenueCat's ID for purchases. That is why no consent is needed under the cookie rules.

Saved spots

With Regnkort Plus you can save up to 100 places on the "Spots" tab. For each spot we store its name, region, coordinates and an alert setting, which is used if you turn alerts on for that place. SeeRain alerts.

Coordinates are stored at full precision, so if you save "Current location", that could be your home address. Spots are stored on your phone and on our server. The copy on your phone may be included in your phone's own backup with Apple or Google.

On iPhone, your spots come back if you reinstall the app on the same phone, because iOS keeps the app's ID in the Keychain. On Android, the app gets a new ID when it is installed again, and the old spots stay on our server until they are deleted after 12 months without contact.

Spots stay on our server until you delete them, use "Delete my data" or ask us to delete them. If your subscription ends, we keep your spots so they are there again if you restart Plus. If we hear nothing from the app for 12 months, we delete them automatically.

Rain alerts and notifications

Everyone can have one free rain alert, and with Regnkort Plus you can have alerts for all your places.

Push key

To send a notification to your phone, we store a push key (Expo push token) and the app's language, so the alert arrives in the language you use the app in. The key is not your phone number or your phone's advertising ID. We keep it while you have alerts turned on, and delete it when you turn alerts off, when you use "Delete my data", or when we delete your registration after 12 months without any contact from the app.

We send alerts through Expo's push service. Expo (650 Industries, Inc., USA) acts as our processor. It receives the push key and the alert's text and passes the notification on to the Apple Push Notification service (iPhone) or Google's Firebase Cloud Messaging (Android), which delivers it to your phone.

The alert's place

An alert is either for a place you chose (such as home) or for your location. If you choose your location, the app sends your position when you open it, and we use the latest position the app sent while it was open. The app does not track your location in the background. The place is stored on our server for as long as the alert exists, so we can check the forecast for it. It is deleted together with the alert.

Log of sent alerts

When we send an alert, we log the time, which alert it was and the forecast it was based on. If you answer "Was it right?", we also store your yes or no. We use the log to measure how well alerts land, and keep it for at most 90 days. Our legitimate interest is being able to see whether the alerts hold up and to make them better.

You can turn alerts off in the app, or turn off notifications for Regnkort in your phone's settings.

Regnkort Plus and RevenueCat

Regnkort Plus is bought through the App Store (Apple) or Google Play (Google). Apple and Google handle the payment as independent controllers under their own terms. We never see your card details, your name, your Apple ID or your email address.

We use RevenueCat, Inc. in the USA to show prices, complete and validate purchases and keep track of whether an install has Plus. RevenueCat acts as our processor. RevenueCat's software starts every time you open the app, even if you haven't bought Plus. It creates a pseudonymous RevenueCat ID and sends it to RevenueCat together with your IP address, your phone's operating system and app version, language and store country. If you buy or restore a purchase, the receipt from Apple or Google is sent too. When you open the purchase screen or the page where you manage your subscription, RevenueCat records that the screen was shown.

Our server links the RevenueCat ID to your device record, asks RevenueCat whether you have Plus, and stores the subscription status: whether it's active, which product, the expiry date, which store, and whether it's a test purchase or a real one.

RevenueCat notifies us when a subscription is bought, renewed or cancelled. We receive this data from RevenueCat, which receives it from the App Store or Google Play. The events can include the pseudonymous RevenueCat ID, product, price, currency, country, store and transaction IDs. We keep them for at most 90 days so we can fix problems if a purchase isn't registered correctly. Our accounts are based on the statements Apple and Google send us, not on these events.

Security and logs

All traffic between the app, the website and our server is encrypted with HTTPS (TLS). The same goes for our server's requests to Open-Meteo, DMI and RevenueCat and the alerts it sends via Expo, and for the app's traffic to RevenueCat.
To protect our server from abuse, we limit how many requests can arrive in a short time. For this we use your IP address or your random user ID. This happens only in our server's memory, typically for about a minute, and is never written to disk.
Our server logs may contain your random user ID or RevenueCat ID, and our access logs contain IP addresses. They are deleted after 30 days at most.
Sign-in keys are stored only as hashes on our server and are kept securely in your phone's Keychain/Keystore.
If you have allowed it in your phone's settings, Apple and Google give us crash reports and aggregated usage statistics about the app. They don't contain your name, and we can't link them to your device record.

Our legitimate interest here is keeping the service secure and stable, preventing abuse and fixing bugs.

Weather data

Our weather providers receive no personal data about you:

OpenMeteo GmbH (Switzerland) receives only the rounded grid coordinates (roughly 5–6 km) and, for place search, the search text without your IP address or any ID.
The Danish Meteorological Institute (DMI) receives nothing. Our server downloads DMI's radar images for the whole area from DMI's open data and looks up your point in them itself.

The public scorecard

The numbers under "We keep score" are computed from fixed points in Danish cities and DMI's radar, not from users' locations, alerts or any other data about you.

Maps from Apple and Google

The map in the app is Apple Maps on iPhone and Google Maps on Android. To show the map, your phone fetches map tiles directly from Apple or Google, which therefore receive your IP address and information about which area the map is showing. If you have given the app access to your location, the map shows a dot where you are. On Android, Google Maps finds your location through Google Play services. Apple and Google handle this data as independent controllers under their own privacy policies. Google LLC is in the USA and is certified under the EU-U.S. Data Privacy Framework.

Who receives data

Hetzner Online GmbH, Germany (processor): runs our server, database, logs and this website in data centres in the EU under a data processing agreement.
RevenueCat, Inc., USA (processor): shows prices, completes and validates purchases and keeps track of subscription status for Regnkort Plus.
650 Industries, Inc. (Expo), USA (processor): passes rain alerts on to Apple and Google. Receives the push key and the alert's text.
Proton AG, Switzerland (processor): provides our email.
Apple and Google (independent controllers): the App Store and Google Play handle purchases and payment, and Apple Maps and Google Maps display the map.
Apple and Google: the Apple Push Notification service and Firebase Cloud Messaging deliver notifications to your phone and receive the push key and the alert's text to do so.
OpenMeteo GmbH, Switzerland: receives rounded coordinates and search text, but no IP address and no ID.

We don't sell data and we don't share it with advertisers.

Transfers outside the EU

Our server, database and logs are at Hetzner Online GmbH in the EU. Our email is hosted by Proton AG in Switzerland, and OpenMeteo GmbH is also in Switzerland. The European Commission has decided that Switzerland provides an adequate level of protection.

RevenueCat, Inc. is in the USA, a third country. The transfer to RevenueCat is based on the European Commission's standard contractual clauses, which are part of our data processing agreement with RevenueCat. Email us if you'd like a copy.

650 Industries, Inc. (Expo) is also in the USA and is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection. Push keys and alert texts are transferred to Expo on that basis.

How long we keep data

Device registration and Plus status: until you use "Delete my data". Otherwise deleted after 12 months without any contact from the app. "Without contact" means the app hasn't connected to our server.
Sign-in keys: deleted no later than 30 days after they expire or are revoked.
Saved spots: until you delete them, use "Delete my data" or ask us to, and at the latest after 12 months without any contact from the app.
Data at RevenueCat: we ask RevenueCat to delete it when you use "Delete my data", or when we delete your registration after 12 months without contact.
Push key and language: while you have alerts turned on, and at the latest until you use "Delete my data" or your registration is deleted after 12 months without contact.
Rain alerts and their places: as long as the alert exists, and no longer than the device registration.
Log of sent alerts and answers to "Was it right?": at most 90 days.
Purchase events: at most 90 days.
Server logs and access logs: at most 30 days.
Database backups: kept encrypted at Hetzner in the EU for at most 30 days. Data you have deleted disappears from the backups as they expire.
Emails to us: no later than 12 months after our last reply.
Search results: up to 24 hours in our server's memory.
Your location: not stored, unless you save it as a spot yourself or have an alert for your location.

Your rights

Under the GDPR you have the right to:

access the data we hold about you
have inaccurate data corrected
have your data deleted
restrict how we use it
receive your data in a common machine-readable format (data portability)
object to processing based on our legitimate interest

You can withdraw location access and permission to send notifications at any time in your phone's settings. We don't use your data for profiling or automated decisions.

You're not obliged to give us any data. Without the app registration, the app can't fetch forecasts, but you can use it perfectly well without sharing your location.

How to delete your data

At the bottom of the Plus tab in the app you'll find "Delete my data". Once you confirm, this happens:

We immediately delete your record on our server. Your saved spots, alerts, push key, Plus status and sign-in keys are deleted with it.
If your install is linked to RevenueCat, we also ask RevenueCat to delete your data.
The app removes its ID, sign-in keys and spots from your phone. The next time you open the app, it starts again like a fresh install. RevenueCat's software in the app may keep its own ID, which is then linked to your new registration.

Database backups are kept encrypted at Hetzner in the EU for at most 30 days. Data you have deleted disappears from the backups as they expire.

Data already in our server logs, access logs, purchase events or the log of sent alerts is not deleted straight away. It is deleted automatically within the periods listed under "How long we keep data". Apple and Google keep their own records of your purchase.

To be sure everything is gone, use "Delete my data" before you delete the app. If you only delete the app, most of what is on your phone disappears, but an iPhone may keep the app's ID and sign-in key in the Keychain. What is left on our server is deleted automatically once the app has had no contact with us for 12 months.

You can also email us at mikkel@bechsolutions.dk if you want access to your data, a copy of it, or to have it deleted, for example because you have already deleted the app. Because we don't know who you are, you need to give us something we can find your data with, such as the order ID from your Apple or Google receipt if you have Plus. If we can't find you from what you send, we'll tell you (GDPR Article 11).

We reply within one month of receiving your request. If the request is complex, this can be extended by up to two months; we'll tell you within the first month and explain why.

Deleting your data does not cancel your subscription. Cancel it in the App Store or Google Play. If you want Plus again later, "Restore purchase" on the Plus tab brings it back.

Children

Regnkort is not aimed at children under 13, and we don't knowingly collect data about children.

This website

regnkort.dk is made of static pages. We use no cookies and no analytics, and the pages load nothing from third parties. The fonts are served from our own server. The numbers under "We keep score" are fetched from our own server (api.regnkort.dk) without cookies and without any ID. Our server keeps access logs (IP address, time, which page was viewed, referring page and browser type) to run the site and keep it secure. This is based on our legitimate interest, and the logs are deleted after 30 days at most.

Changes to this policy

If we change how we handle data, we update this page and the date at the top. The current version is always here.

Complaints

If you're unhappy with how we handle your data, we'd like to hear from you first. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet), or to the data protection authority where you live:

Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
www.datatilsynet.dk · dt@datatilsynet.dk