What we do not do
No account is required. The map, radar and reference materials do not require a name, email or phone number. Only if you create or join a family circle do you choose a display name or nickname for its members. Data are not sold to advertising networks. Payments are processed by the relevant store or payment service; the map does not receive payment-card numbers.
The website
The server keeps an ordinary access log (page address, time, browser type, IP address); it is needed to protect against abuse and is kept for a limited time. Anonymous traffic analytics is used, with no cross-site tracking. Cookies are set only for your own settings: language, interface generation, selected map layers.
The “Ukraine Air Alert Map” apps
There is no login. Online features process notification tokens, territories and technical identifiers as described below.
- Notifications. The server receives an Apple/Google token, platform, language, selected oblast codes and, if configured, official district or community identifiers. Your personal village name or territory label is not sent. Separately, with your consent, selected regions and threat types for monitoring notifications and the consent time are stored. For the Lock Screen card, the server receives its push tokens, selected territories, language and enable settings.
- Location. With permission, coordinates are used on the phone for mapping, radar and places. A rounded location is sent for a confirmed Live report or assessment. Mapping requests also reveal technical request data to providers, such as an IP address and map area.
- API key. If you add your own key, it is stored on the device only and sent in a request header, like any access key.
- Local data. Backpack and kit checklists, medicines, expiry dates, settings and your territory label stay on the device. Personal support words and contact are kept in secure storage; post-exercise responses are not retained. Expiry reminders are scheduled locally through the phone system.
- Live and threat reports. You choose what you see (a drone, a missile…), where it is heading and how many — there is no typed text. Only a grid cell rounded to ≈ 500 m, the time, the type, the direction and the count go to the server; the exact spot is never sent. An explosion is rounded even more coarsely (≈ 5 km) and shown for 30 minutes only. Reports are visible to everyone and kept for up to 72 hours (for the map history); the link between a report and your device is erased after 24 hours. When you rate someone else’s report, the app — with your permission — adds the same rounded point so that a neighbour’s vote counts for more than one from across the country. Nothing is sent until you tap “Send”.
- Device key. A random key is kept in secure storage. The server uses its HMAC fingerprint to associate reports and assessments from one device and limit spam. This is a technical identifier; it contains no name or phone number.
- Compass. The phone’s heading is read on the device — to light up the “where is it heading” arrow and rotate the radar. Compass readings are neither stored nor sent; only the direction you chose for a report goes to the server.
- Family circle. When you choose this feature, the server stores your display name or nickname, the circle name, its members and only the latest confirmed status with its date and time. Access is limited to circle members through a single-use invitation valid for 24 hours. Access uses a random device key whose fingerprint is stored on the server. If you separately enable call-request notifications, the server also stores the device push token to deliver these messages to circle members. Disabling this option removes that subscription; the temporary delivery queue is retained for no longer than three minutes. The circle does not receive your phone book, GPS or status history. A Lock Screen status is sent only after your tap.
- Family messages and shelters. Up to 5 contacts and your message template, as well as saved shelters, entrance coordinates, photos and notes, stay on the device. A family message is passed to your chosen communication app after your action; shelter coordinates are passed to a navigator only when you tap its button.
Where alert data comes from
Alerts and monitoring reports arrive through our server. Maps may contact mapping providers. For environmental data the app contacts SaveEcoBot and Safecast directly; these providers see the IP address and query parameters. Safecast queries use the oblast centre, not your precise GPS position. External sources and phone calls open only after your tap. Full source registry.
Children
The app is not specifically directed at children and does not ask for age.
Deleting data
Local data: My support → Delete my data clears personal words and contact. Edit inventory in the checklists; uninstalling clears local app data subject to system backup rules. Notifications: disable push or remove selected oblasts to send an unsubscribe request. Uninstalling alone sends no request: an invalid token is removed after the corresponding Apple/Google response. Live: the report-device association is kept for up to 24 hours, and the report for up to 72 hours. For data requests use Support. Family circle: leaving, removing a member or disbanding a circle removes the relevant profiles and current statuses and revokes access. Uninstalling alone does not send this request. Disabling monitoring notifications or the Lock Screen card sends a server request; offline requests are retried when connectivity returns.
Changes
If this policy changes, a new update date will appear here, and we will describe substantive changes in words rather than merely rearranging paragraphs.
Contact
Privacy questions go through the Support page.