We do not collect data about you.

In short

• No account, no sign-in. The app works straight after installation.
• No ads, no analytics, no tracking tools. There is no Google Analytics, no advertising pixel and no third-party statistics SDK.
• Your location never reaches our server. We never store it. The one exception is a route to shelter in GROTA: the position and destination then go to a public routing server (section 2).
• Notifications go to provinces, not to people. We do not know who receives them.
• We do not sell or share data with anyone for marketing. There is nothing to sell.

1. What stays on your device only

The app's storage (the browser's localStorage) holds your settings and nothing else:

• My places — the names and coordinates of the points you added yourself;
• the provinces you watch, the language, map and sound settings;
• the buffer of the last 12 hours of history, fetched from the server so that scrubbing stays smooth.

None of this is sent to our server or anywhere else. On Android, system backup is disabled for the app (allowBackup=false), so it does not reach Google Drive either. You remove all of it by uninstalling the app or clearing its data in system settings; in a browser, by clearing the site data.

2. Location

The location permission is optional. It is used only to drop a one-off “I am here” point when you add a place, and to centre the map. The coordinates stay on the device — we do not send them to the server, do not store them and do not pass them to anyone. You can decline and pick the place on the map by hand; the app works exactly the same.

Notifications do not depend on GPS. You pick provinces from a list, and that is the only information about what you watch.

GROTA — where to shelter (Android app)

GROTA uses your location to show the nearest shelter points. The list of points and the search for the nearest one run on the phone, without sending the position. Only this leaves the phone:

• the route on the map — the start position and the chosen point go to the public FOSSGIS routing server (OSRM on OpenStreetMap data), which returns the path. Offline, GROTA shows the straight-line distance and sends nothing;
• address search — the typed address goes to the GUGiK geocoding service, only after you press “Search”;
• the base map — OpenFreeMap tiles for the area you view, as in Strażnik's map; with the map downloaded to the phone nothing is sent;
• aerial photos — orthophoto tiles for the area you view, from Geoportal (GUGiK);
• data packages — the shelter files for a province, downloaded from our server; the file name only says which province;
• Google Maps — only if you tap the navigation button yourself; Google's terms apply from then on.

Places and settings saved in GROTA stay on the device, like Strażnik's My places.

3. Notifications

Android and iOS app

The app subscribes in Firebase Cloud Messaging (Google) to a “topic” that corresponds to a province, for example voiv_lubelskie. We send the alert to the topic, not to individual devices. Our server holds no list of devices and no device identifiers (tokens) — we do not know how many phones watch a given province, or which ones. Google acts as the carrier and processes the app installation identifier under its own privacy policy.

Notifications in a browser

If you enable notifications on the website, the browser issues a push endpoint (an address at Google, Mozilla or Apple, together with encryption keys). We store that address and the chosen province in the server database — otherwise a notification cannot be delivered. This is the only data tied to a particular browser that we keep. The address contains no name, e-mail address or location, and does not let us work out who you are.

The entry disappears when you turn notifications off in the app or in browser settings, and also when the push provider reports that the subscription has expired.

4. What the server sees and stores

Traffic to the server passes through Cloudflare, which sees the IP address and protects the service against overload (under its own policy). On our server:

• the access log is switched off — IP addresses and requested paths are not written to disk;
• the IP address is used only briefly, in memory, for request limits, so that a single sender cannot take the service down for everyone. It does not reach the database or the backups;
• the database holds data about threats, not about people: signals from public sources, snapshots of the map from the last 12 hours, an archive of ADS-B aircraft positions for 14 days, and a log of alerts sent (province, level, time). None of these entries is linked to a user.

Database backups are made every six hours and are encrypted. They contain the browser push subscriptions from section 3 — there is no other user data in the database.

5. Third parties

Each of them sees an ordinary network request carrying your IP address, because otherwise the data could not be delivered. We pass them nothing beyond that:

• Mikrus — hosting of the Strażnik server;
• Cloudflare — tunnel, protection and acceleration of traffic to the server;
• Google Firebase — delivery of notifications to the app;
• GitHub — app downloads, update checks and this page (GitHub Pages);
• OpenFreeMap and CARTO — map tiles, based on OpenStreetMap data;
• FOSSGIS (OSRM routing server) and GUGiK (address geocoding, orthophoto) — in GROTA only, see section 2.

Object photos and illustrations are bundled inside the app — we do not fetch them from outside services. Publishers' pages are read by our server, not by your phone. You open an article link in your own browser, and from that point the publisher's own rules apply.

6. App permissions

• Notifications — to show the alert.
• Location (optional) — the one-off “I am here” point, see section 2.
• Internet and network state — fetching the map state and detecting a lost connection.
• Installing packages — installing an update downloaded from GitHub (Android, outside the Play Store).
• Battery optimisation exemption, waking the screen and full-screen alert — so that the alert arrives while the phone sleeps.
• Vibration — the alert signal.

The app does not ask for access to contacts, photos, files, the microphone or the camera.

7. Your rights and contact

There are no accounts, so there is no record in which we could find you. The only device-related data — a browser push subscription — you delete yourself by turning notifications off. The remaining settings disappear when you uninstall the app or clear its data.

If you want to ask about data processing, request deletion, or point out a mistake in this policy, write through an issue in the project repository.

The app is not directed at children and does not ask for age.

8. Changes to this policy

Changes are described in the changelog together with the release they belong to. The date at the top of this page says when the current version came into force.