Privacy Policy — ExposureCast

Covers: the Android app “ExposureCast”, the legal pages and the contact form on www.rooksbury.com and the product page www.exposurecast.com
Effective: 15 November 2026 · Version: 1.14
Language: This is a translation. The German version (https://www.rooksbury.com/exposurecast/datenschutz) prevails.

This policy explains which personal data arise when you use ExposureCast, visit the legal pages on www.rooksbury.com or the product page www.exposurecast.com, or write to us using the contact form, and which data we process when we send you a press release as a member of an editorial team or a collaboration inquiry as a photographer or platform (section 11a), where they go, and what rights you have (Art. 13 and Art. 14 GDPR).

1. Controller

Michael Schubert, trading as Rooksbury
Rilkestr. 4
86199 Augsburg
Germany
Email: support@rooksbury.com

We have not appointed a data protection officer; as a sole trader we are not required to under § 38(1) of the German Federal Data Protection Act (BDSG).

2. Summary

• No account, no sign-in. The app does not know your name or email address.
• No advertising, no analytics. The app contains no advertising SDK and no analytics or crash-reporting service (section 12).
• Pro is a subscription through Google Play. Google handles the payment; we do not see your payment details. We check whether your subscription is active through the service RevenueCat in the USA, and only once you open the Pro page, buy or restore purchases. For this it receives a random app identifier without name or email address and, if you buy, the purchase receipt from Google Play (section 12).
• Your places, trips and settings are stored only on your device. We receive only what a forecast needs, and the feedback you choose to send.
• Your location is rounded: the app stores your GPS location to 4 decimal places, about 11 metres, and sends it to our server at that precision.
• Some map services are loaded by the app directly. Those providers see your IP address and roughly the map area you are looking at (section 7). The “Rain” layer (depending on the area from Deutscher Wetterdienst, the German weather service, from KNMI in the Netherlands, from the Finnish Meteorological Institute or from Environment and Climate Change Canada in Canada) and the “Clouds” layer (from NASA GIBS in the USA) are loaded only after you agree. Separately, our server asks Deutscher Wetterdienst whether it is raining at your location (section 6); the service sees only our server's IP address.
• Our server stores feedback (“seen / not seen”) without any identifier of your device and deletes it after 24 months (section 8).
• Our server does not store messages sent via the contact form. It forwards them as an email to our mailbox at Google Workspace (section 11).

Are you required to provide data? No; neither the law nor a contract requires you to provide any data to us. Without your location or a place, we cannot compute a forecast for it; without the Pro check (section 12), the Pro features stay off. Feedback, the “Rain” and “Clouds” map layers and the contact form are entirely up to you.

3. What stays on your device

The app stores on your device, in the storage of the app interface and mirrored into the app's Android preferences storage:

• your places with name and coordinates (4 decimal places, ~11 m); for “My location” that is your location;
• trips with stages and date ranges;
• saved opportunities with place, time and your own feedback;
• reminders you have set;
• whether you have agreed to the “Rain” and “Clouds” map layers;
• feedback not yet sent;
• the opportunities shown per place during the last 48 hours, so that you can still rate them after the event;
• the last forecast feed per place;
• a small summary for the home-screen widget (place name, up to three opportunities);
• settings for the interface, the camera and the AR view;
• when and how often the app has asked Google Play for the review card: app version, time and count, without any identifier (section 10);
• only once you have opened the Pro page, bought or restored purchases: in the storage of the RevenueCat component, the random app identifier and the last retrieved subscription status, and after a confirmed subscription a marker telling the app to check at start (section 12);
• if you enter an access code: a time-limited access token (only in the storage of the app interface, not in the Android preferences storage). For us it does not relate to you as a person, except for a code we have assigned personally to a journalist (section 11a).

These data are not sent to us, except as described in sections 5, 8 and 12. They disappear when you clear the app data or uninstall the app. For Android backup see section 10.

Reminders are local notifications. They are scheduled on the device and contain the name of the opportunity, the lead time and the place name. If “Re-check beforehand” is on, the app requests the forecast for the place shortly beforehand (section 5, “Requests while the app is closed”); the place name stays on the device. For these requests the app keeps the tasks (place, time and the ready-made notification texts) in a separate store on the device. It never leaves the device; when you turn the feature off, the app deletes the tasks in it.

Camera: the camera permission is used only as a live background in the AR view. No image leaves the device.

Storing and reading these data on your device, and using location, camera and notifications, is necessary for the app to provide the service you requested (§ 25(2) no. 2 TDDDG). Location, camera and notifications are used only after you grant permission in Android; the camera only locally.

4. Location

When you add “My location” and grant the location permission, the app requests your precise location. After that it refreshes it silently when you open the app and when you return to it; it is stored again and sent to our server again only if you have moved more than 1 km. There is no background location; the app does not even request that permission. The app rounds the location to 4 decimal places (~11 m) when storing it.

If you tap the light-pollution map, the app sends the tapped point to our server unrounded; that is any point on the map, not your location.

The app determines the location through the Google Play services on the device (“Fused Location Provider”). Without Play services, “My location” does not work. Our app itself sends nothing to Google in the process. Whether and which data Play services transmit to Google while locating cannot be determined from our code; it depends on settings of your device for which Google is responsible. Google provides information in its privacy policy (section 15).

Places you search for or pick on the map are also stored with 4 decimal places. Stages in the trip planner are stored as the place search returns them, unrounded; that is the coordinate of a searched place, not your location.

5. Our server api.exposurecast.com

The app fetches forecasts, place search, sky data and map overlays from our own server. The following is sent:

• your IP address and the identifier of the Android WebView (device model, Android and WebView version);
• the coordinates of the selected place (4 decimal places), the place name, for place search the search text, language and date;
• for feedback, its content (section 8);
• if you use recipes (your own conditions under which the app reports a chance): the recipes themselves (name, conditions, time window, minimum duration) together with the coordinates of the place they are evaluated for. This happens when you open recipes and – if you use recipes – when the app loads your chances for a saved place, including for recipe alerts. Our server only evaluates the recipes and does not store them; they stay on your device (section 3).
• for Pro features computed by our server, the RevenueCat app identifier, so that the server can check whether your subscription is active (section 12, “Pro check on our server”).
• with the forecast request, the app's build number (for example 360). Our server only uses it to count how often each app version makes requests per day — without IP address and without an identifier — and keeps these numbers for 30 days.
• only if you switch it on (Settings → “Privacy & legal” → “Count Pro page usage”, off by default): totals of how often the Pro page was opened, from which feature, and how far a purchase got (for example “tapped buy”, “cancelled in Google's purchase sheet”, “trial started”), plus the build number. The app keeps these counts in memory only and sends a total only when you leave the app, usually at most every 5 minutes (after a purchase, the next time you leave the app), without an identifier and without RevenueCat's app ID. Our server stores only totals per calendar week, without IP address, time of day or location; purchases and restores without the feature and without the build number. Switching it off takes effect at once and discards anything not yet sent.

Requests while the app is closed. If you have set a reminder or receive alerts, the app asks our server in the background, up to 2 hours beforehand, for the forecast for that reminder’s place, so the notification is based on up-to-date data (“Re-check beforehand”, can be turned off in Settings under “Notifications”). It sends the same details as when the open app requests the forecast, but without the place name and without the RevenueCat app identifier: the coordinates of the saved place (4 decimal places), your IP address and a marker that this is a background request (it contains no information about you). Instead of the WebView identifier, Android sends its own identifier (device model, Android version). At most 8 such requests per day.

If you turn on “Also in the background” for the aurora alert (off by default; only works with notifications turned on), the app asks our server at night, while it is dark at one of your saved places, at most every 30 minutes and at most 24 times per night, for the most recently measured Kp value — without any location. Our server only sees your IP address, Android’s identifier and the “background request” marker. Only if the value is high enough for one of your saved places and it is dark there does a forecast request for that place follow, as described above; it counts towards the maximum of 8 requests per day.

The app does not determine your location for these requests; it only uses places you have already saved. Whether and when Android allows such requests is up to the system (for example, less often or not at all in battery saver). Our server counts background forecast requests only as a number per day, without IP address and without coordinates. Legal basis as for the other forecast requests (section 13).

Cloudflare. The connection runs through Cloudflare's network (Cloudflare Tunnel). The encrypted connection ends at Cloudflare, so Cloudflare sees every request in full: your IP address, the address including coordinates, place name, search text, the content of feedback and, for Pro users, the RevenueCat app identifier; if you enter an access code, also the code and the access token. Cloudflare passes your IP address on to our server. What Cloudflare logs and for how long is determined by Cloudflare under its own terms (section 15).

Hostinger. The server runs on a rented virtual server at Hostinger. Everything our server stores is kept there.

What the server does with requests:

• It uses your IP address only in memory to limit requests per minute (protection against overload).
• It keeps results in memory for a while so that not every request reaches the data sources again. Keys are rounded coordinates, for place search the search text. Depending on the type this lasts 5 minutes to 24 hours, for the terrain horizon up to 30 days; that entry holds only the place rounded to about 110 m. A restart deletes everything.
• No access log: the server does not write your requests to a log. Only the server's start and error messages remain. One exception: if an access code reaches its daily limit, the server writes the name of the code to the log, but neither your IP address nor a device identifier.
• Developer feature AR recording: for troubleshooting, the app's hidden developer mode (tap the version line seven times) can record orientation-sensor values of the AR view and send them to the server: time, mode, app version, sensor values, markers and the location rounded to 2 decimal places (~1 km). In production the server has this intake switched off; it rejects such recordings and stores nothing. If it is briefly switched on for a diagnosis, stored recordings remain until we delete them by hand; there is no automatic deletion for them.

6. Services our server queries for you

For forecasts and place search our server queries the following services. These providers see the IP address of our server, not yours, but the data we send along.

7. Services the app queries directly

The app loads these services itself. The provider therefore sees your IP address, the WebView identifier and the address of the tile. The tile roughly reveals which map area you are looking at.

Rain and Clouds only after you agree. When you first switch on these layers, the app shows a notice and loads nothing before. For “Rain” it names the weather service whose radar covers the map area (see below) as the source of the radar images; for “Clouds” it names NASA GIBS in the USA and that data protection there is not equivalent to EU law. In all cases the app transmits your IP address and the approximate map area. Only when you choose “Load” is a request sent to the provider; with “Cancel” none is. The app remembers your consent per layer on the device, for “Rain” per weather service: consent to Deutscher Wetterdienst does not cover the others. Rain radar per area: Which weather service supplies the radar images depends on the centre of the map area. It is always exactly one:

• Germany and border areas: Deutscher Wetterdienst (Germany)
• The Netherlands and surroundings: KNMI, the Royal Netherlands Meteorological Institute (Netherlands)
• Finland: the Finnish Meteorological Institute (Finland)
• Canada and the USA: Environment and Climate Change Canada (ECCC), a department of the Government of Canada (Canada)

A radar forecast for the next two hours is available for Germany only; in the other areas the app shows the measurements up to the latest one. If the centre of the map lies outside these areas, the layer stays off and the app shows a notice; it then neither asks for consent nor loads anything. Transfers to third countries: For NASA GIBS (USA) and ECCC (Canada) none of the usual safeguards exist (section 15); that is why we ask. The EU adequacy decision for Canada covers businesses only, not public authorities; for ECCC there are no appropriate safeguards either, and Canadian authorities could access the data. The transfer to ECCC is therefore based on your explicit consent (Art. 49(1)(a) GDPR), which the app obtains with this notice before loading anything. Deutscher Wetterdienst, KNMI and the Finnish Meteorological Institute are located in the EU; for them there is no transfer to a third country. Withdrawal: at any time in the settings under “Privacy & legal” → “Reset map consent”. After that the layers load nothing and ask again the next time you switch them on.

8. Feedback (“seen / not seen”)

When you give feedback, for example whether a predicted opportunity happened, the app sends to our server: a random identifier of the report, the type of report, your verdict, the time, the coordinates of the place (4 decimal places; they appear a second time in the field slot), the phenomenon, the displayed probability and whether it was calibrated, the app version, and the day, the distance to the event, the displayed rating and whether it is a retrospective report. No identifier of your device is included. The server adds the time of receipt. It does not store your IP address with it.

Without a network, the app collects feedback on the device and sends it later.

Purpose: we compare forecast and observation to improve the displayed probabilities.

Consent and withdrawal: feedback reaches us only when you tap one of the buttons yourself; that is your consent (section 13). You can withdraw it at any time by email to support@rooksbury.com; we then delete the reports for the place and time you tell us. Reports still waiting on the device disappear with the app data.

Storage: in a file on our server at Hostinger, for 24 months from receipt. After that the server deletes the report automatically. Hostinger backs up the server once a week and keeps the two most recent weekly backups. A deleted report may therefore remain in these backups for about two more weeks until it is overwritten there.

Because reports carry no identifier of your device, we can match them to you only if you tell us the place and approximate time (section 16).

9. Links you open yourself

Some source credits are links (Open-Meteo, Creative Commons, Deutscher Wetterdienst, KNMI, Finnish Meteorological Institute, Environment and Climate Change Canada). They open in the browser only when you tap them. Only if the map cannot be loaded does the app offer an “Open map” link to OpenStreetMap; this link contains the coordinates of the place, so OpenStreetMap learns them when you tap it. The “Manage subscription” link opens Google Play's subscription management; it contains only the names of our app and of the subscription, no data about you.

10. Android platform

• Backup: the app does not exclude Android backup. If backup is enabled on your device, Android may back up the app data from section 3, including places and trips, to your Google account. This backup goes to Google, not to us.
• WebView: the app shows its interface in the Android System WebView. The WebView may check visited addresses against Google Safe Browsing; the app does not turn this off.
• Location: see section 4.
• Rating on Google Play: After you have used the app for a while, it may ask Google Play to show Google's own review card, at most once per app version and no sooner than 120 days after the last time. Google decides whether the card appears. The stars and text you enter there go to Google Play. The app gets nothing back, not even whether you left a rating. A rating you submit is public, like any rating on Google Play. On the device the app only keeps the app version, time and count of these requests, without any identifier, so that it does not ask too often; this never leaves the device.

11. The legal pages and the contact form on www.rooksbury.com, the product page on www.exposurecast.com

This policy is published on www.rooksbury.com; the ExposureCast product page is on www.exposurecast.com (exposurecast.com redirects there). Both websites are served by our server at Hostinger through Cloudflare's network. When you visit them, Cloudflare and our server see your IP address, the requested address, date and time, and your browser's identifier.

The pages load nothing from other servers: no scripts, fonts, images or stylesheets. They contain no JavaScript, and our server sets no cookies.

No access log: our server does not log visits to these pages. It only records error messages of the web server, for example if a page cannot be read. Such a message may contain the requested address (and, if your browser sends it, the page you came from), but not your IP address: as the sender, our web server only records the connection from the Cloudflare tunnel. These messages are kept in a log store of at most 2 MB. When it is full, the oldest are overwritten; it is deleted when the web server is set up anew. There is no fixed period. The messages may remain in Hostinger's weekly backups (section 8) for up to about two weeks longer.

Cloudflare: when you visit these pages, Cloudflare normally does not set any cookies either. Cloudflare features that would set cookies, insert scripts into the pages or make your browser send reports about failed connections to Cloudflare are switched off for these pages (Bot Fight Mode, email address obfuscation, Network Error Logging). One exception remains: if Cloudflare considers a request suspicious, it may first answer it with its own challenge page and set the technically necessary cookie cf_clearance for it (https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/).

How long Cloudflare stores the access data is determined by Cloudflare; Cloudflare has not published a fixed period. According to its own statement, Cloudflare processes this data only for a limited period of time (https://www.cloudflare.com/trust-hub/gdpr/); details are in Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/).

Contact form. You can write to us at https://www.rooksbury.com/contact. The form asks for your email address and your message, and optionally for your name. Without an email address and a message it accepts nothing, because otherwise we could not reply to you.

When you submit it, your browser sends the details to our server api.exposurecast.com, also through Cloudflare; besides your IP address, Cloudflare also sees the content. Our server turns it into an email to our mailbox support@rooksbury.com and hands it over, encrypted, to the mail service of Google Workspace; it sets your email address as the reply address.

Our server does not store the message, neither in a file nor in a log. It uses your IP address only in memory to accept at most three messages per hour from the same address; this counter expires after one hour. A field in the form that is invisible to people detects automatically filled-in requests; we discard those without sending them.

The message is then kept in our mailbox at Google Workspace (section 15), like any email you write directly to support@rooksbury.com. We use it only to answer your enquiry. Deletion: we delete the message once your enquiry has been dealt with, unless a statutory retention obligation prevents this. Gmail removes deleted emails from the trash after 30 days.

11a. Press, collaboration and partner contacts

This section is not about using the app but about our press and outreach work. We are the controller (section 1).

What we do. We take the names and email addresses of editorial staff from the publicly available legal notices (imprints) of photography media and send them a one-off press release about ExposureCast. We also send individual photographers and platforms a one-off collaboration or partner inquiry if their website explicitly invites such inquiries; in that case we take the address from their public contact page, FAQ or legal notice. Where appropriate, we include a personal, free trial of ExposureCast Pro (an access code that we assign to the recipient).

Purpose and legal basis. We want to inform the press about the app and to initiate collaborations with photographers and platforms. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is press and outreach work for ExposureCast.

Which data. Name, business email address and publication, channel or platform; the source (address of the page and the date we looked it up); the date of sending; where applicable, the access code assigned to you and your reply.

Source of the data (Art. 14(2)(f) GDPR): the publicly available legal notices, contact pages or FAQs of the publications, photographers and platforms concerned.

Recipients. We send and receive these emails through our mailbox at Google Workspace. Google processes them on our behalf, including in the USA and other countries outside the EEA (section 15). If you enter an access code in the app, these requests, like all requests from the app, pass through Cloudflare and our server at Hostinger (section 5). We do not pass the data on to anyone else.

Access code. If you enter the access code assigned to you in the app, section 12 applies to the app. Because we assigned the code to you, we can link an access token that belongs to this code to you. For each code our server keeps only counters: how often it was redeemed in total and on the same day, how often it was refused at the daily limit, and how often an access token for it was accepted or refused. It does not store your IP address or a device identifier for this; as with every request, it uses the IP address only briefly in memory to fend off too many attempts (section 5). The server keeps the counters in a file so that a restart does not erase them; they contain only numbers per code name. If we block the code, the server deletes its counters at the next restart; in Hostinger's weekly backups they remain for up to about two weeks longer. If the code reaches its daily limit, the server writes its name to the log (section 5). An access token is valid for 7 days. We can block a code; after that, no access token belonging to it is valid any more.

Retention. We delete the data 12 months after sending, or, if we correspond afterwards, 12 months after the last message. If you object, we block the data immediately: we then keep only a suppression note with your email address and the date of your objection, so that we do not contact you again. We keep the suppression note for as long as we do press and outreach work and review every three years whether it is still needed.

Objection. You may object to processing for this purpose at any time: without giving reasons insofar as it is direct marketing (Art. 21(2) GDPR), and otherwise on grounds relating to your particular situation (Art. 21(1) GDPR). A short reply to our email is enough, as is a message to support@rooksbury.com. Your other rights are set out in section 16, the right to lodge a complaint in section 17.

12. Purchases and subscription (ExposureCast Pro)

ExposureCast Pro is a subscription you take out in the app through Google Play, monthly or yearly. New subscribers can try it free for 14 days. The free version works without any purchase.

Purchase and payment: Google Play. The Play Store app handles the purchase dialog, payment, free trial, renewal and cancellation. We do not see your payment method, billing details or Google account. Google processes these data under its own responsibility, not on our behalf; for users in the European Economic Area this is Google Ireland Limited, and your contracting party for the purchase there is Google Commerce Limited. Outside the European Economic Area, the Google Play terms of your country state who your contracting party is. Details are in the Google Payments privacy notice (https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en). After the purchase, only the purchase receipt comes back into the app: purchase token, the subscription bought and the time.

Order data from Google. According to the Google Payments privacy notice, Google makes information about a purchase available to the developer you bought from. We see this order information, such as order number, subscription, price and country, in the Play Console and in Google's payment reports. We use it only for questions about your purchase, refunds, bookkeeping and tax.

Subscription check: RevenueCat. So that the app knows whether Pro is active for you, we use RevenueCat as our processor. A RevenueCat component in the app (SDK) talks directly to api.revenuecat.com, and if that fails, to the fallback addresses api-production.8-lives-cat.io and api.rc-backup.com. The SDK only starts when you trigger it yourself: when you open the Pro page (the app then loads the prices in your currency), buy Pro or restore purchases. Once RevenueCat has confirmed an active subscription on your device, the app remembers this and from then on also checks at every start and when you bring the app back to the foreground, so that Pro switches on and off without you doing anything. As long as you do none of this, the SDK does not start: it creates no identifier and does not talk to RevenueCat. A subscription you took out on another device or before reinstalling comes back with “Restore purchases” (on the Pro page and in the settings). The following goes to RevenueCat:

• a random app identifier that the SDK creates itself when it is first used (see above) and stores on your device. We do not link it to a name, an email address or an account;
• when you buy or restore, the purchase receipts from Google Play (purchase token, the subscription bought, time);
• technical details such as device type, operating system, language, region and currency, so that the app can show you prices in your currency;
• your IP address, which arises with every connection.

From purchase receipts and subscription status, RevenueCat produces revenue and subscription statistics for us, such as how many subscriptions are running. RevenueCat receives no places, coordinates or place names. We pass on no other attributes about you, and the SDK's diagnostics feature is switched off. We do not use an advertising ID.

Pro check on our server. Our server api.exposurecast.com computes some Pro features. So that it delivers them only with an active subscription or a valid access code (which we give only to reviewers, testers and journalists, section 11a), the app sends the RevenueCat app identifier along with these requests, or, after an access code has been entered, the access token. Our server uses it to ask RevenueCat whether an active Pro subscription exists for this identifier; RevenueCat sees the IP address of our server, not yours. The server keeps the answer briefly in memory so that it does not have to ask again for every request. It does not write the identifier to a file or a log.

Legal basis: For buying, restoring, checking the subscription of subscribers and the Pro check on our server, Art. 6(1)(b) GDPR: without them we cannot provide the subscription you bought. For loading the prices when you open the Pro page, also Art. 6(1)(b) GDPR: you are looking at our offer before entering into a contract. For the check at start on a device whose subscription has since ended, Art. 6(1)(f) GDPR. Our legitimate interest: to recognise a subscription you take out again in Google Play without any further step on your part. For order data from Google, Art. 6(1)(b) GDPR and, where we are required to keep them, Art. 6(1)(c) GDPR. The SDK only stores the app identifier on your device once you open the Pro page, buy or restore, and reads it again with every request after that. We base this on § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG): you are calling up the purchase yourself at that moment, and without the identifier the app can neither show prices and complete the purchase nor determine whether you have a subscription. Accessing it at start on a device whose subscription has ended likewise serves the subscription you chose earlier (§ 25(2) no. 2 TDDDG); it stops when you clear the app data.

Recipient and third country: RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA (https://www.revenuecat.com/privacy-policy). RevenueCat processes the data only on our behalf; the data processing agreement is part of RevenueCat's terms (https://www.revenuecat.com/dpa). RevenueCat stores the data with Amazon Web Services in the USA, and all of RevenueCat's sub-processors are located in the USA. We have not found that RevenueCat participates in the EU-U.S. Data Privacy Framework. The transfer is therefore based on the EU Standard Contractual Clauses incorporated into that agreement. You can obtain a copy of these safeguards on request at support@rooksbury.com.

Retention and deletion: RevenueCat has not published a fixed period for how long it stores our users' data. The data remain with RevenueCat as long as we use the service, or until we delete your entry; if our contract ends, RevenueCat deletes them under the data processing agreement. Write to us at support@rooksbury.com and we will delete your entry, including the purchase history, at RevenueCat. We find your entry from your details of the purchase. Deleting does not end a subscription: cancel it in Google Play first. If you uninstall the app, the identifier disappears from your device, unless Android restores it from backup (section 10); the entry at RevenueCat remains.

Managing and cancelling your subscription is possible at any time in Google Play; the app links there (“Manage subscription”, section 9).

What this version does not contain:

• No advertising. No advertising SDK is included (and no consent dialog for it). The app only contains a prepared interface and a placeholder area that load nothing and transmit no data.
• No analytics tools, no crash reporting, no tracking. Apart from RevenueCat's subscription statistics (above) and, only with your consent, the Pro page totals (section 5), we do not analyse how you use the app.

If we introduce advertising, we will change this policy before the new version of the app is released.

13. Legal bases

14. Retention

15. Recipients, location and transfers to third countries

The providers from sections 4 to 11a. “Third country” means outside the European Economic Area. For the USA, the European Commission has adopted an adequacy decision only for companies participating in the EU-U.S. Data Privacy Framework (DPF); for Switzerland an adequacy decision exists.

Processing on our behalf: Cloudflare, Hostinger, Google Workspace and RevenueCat process data on our behalf. With all four, a data processing agreement under Art. 28 GDPR applies:

• Cloudflare: the data processing agreement is incorporated by reference into Cloudflare's terms of service (https://www.cloudflare.com/terms/, section 6.1; https://www.cloudflare.com/cloudflare-customer-dpa/). It bases the transfer to the USA on the EU-U.S. Data Privacy Framework, and alternatively on standard contractual clauses.
• Hostinger: the data processing agreement is an annex to Hostinger's terms of service and expressly covers virtual private servers (VPS) (https://www.hostinger.com/legal/dpa).
• Google Workspace (our mailbox support@rooksbury.com, which also receives the messages from the contact form; our emails to editorial offices also go through Google Workspace, section 11a): the basis is Google’s “Cloud Data Processing Addendum” (https://cloud.google.com/terms/data-processing-addendum), which we accepted on 13 September 2026. Under this agreement Google may process the data in any country where Google or its sub-processors maintain facilities, including outside the EEA. For transfers to countries without an adequacy decision, Google applies a transfer solution of its own, of which it informs us, and otherwise standard contractual clauses. For the USA, since 1 September 2023 this has been the EU-U.S. Data Privacy Framework, in which Google LLC participates (https://cloud.google.com/terms/alternative-transfer-solution).
• RevenueCat: the data processing agreement is part of RevenueCat's terms (https://www.revenuecat.com/dpa). For the transfer to the USA it incorporates the EU Standard Contractual Clauses (section 12).

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw consent at any time with effect for the future (Art. 7(3)). An informal message to support@rooksbury.com is sufficient.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR), informally to support@rooksbury.com. You may object to receiving press releases without giving reasons (Art. 21(2) GDPR, section 11a).

Because there is no account and feedback carries no identifier of your device, we can match it on the server only via the place and time you tell us (section 8). We find your entry at RevenueCat from your details of the purchase (section 12). Payment and account data at Google Play are managed by Google; please contact Google about them.

You can revoke the location permission at any time in the Android settings (Settings → Apps → ExposureCast → Permissions).

17. Complaints to the supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, place of work or the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany (postal address: Postfach 1349, 91504 Ansbach)
https://www.lda.bayern.de · Complaints: https://www.lda.bayern.de/de/beschwerde.html

18. Security

The app connects to all services only over encrypted connections (HTTPS).

19. No automated decisions

The app computes probabilities for weather and sky events. It makes no decisions about persons within the meaning of Art. 22 GDPR. We do not process special categories of personal data (Art. 9 GDPR).

20. Children

The app is not directed at children under 16.

21. Changes

We update this policy when the processing changes. The version linked in the app and published at https://www.rooksbury.com/exposurecast/privacy applies.