Privacy, clearly explained

Privacy Policy

This notice explains what data SunnyDaysApp uses, why it is needed, which providers help operate the service, and the choices and rights available to you.

Effective and last updated: August 11, 2026

3. Location, maps, weather and routes

Location permission is optional. If granted, the app may access foreground location to show your position, nearby outdoor places, relevant weather, and navigation or route context. You can deny or withdraw permission in the Android or iOS settings and manually select a map location instead, although some features may then be limited.

SunnyDaysApp does not use your location to build an advertising profile and does not maintain a permanent personal movement history. Most interactive map and local route processing happens on the device. If a server-based route feature is enabled and you request it, the necessary start/end points and route options may be sent to the SunnyDays API solely to return that route.

A requested map tile represents a geographic area. Therefore, the API, CDN or imagery provider delivering that tile can technically infer the area being viewed from the tile coordinates and connection metadata. Weather source data from Meteoblue and DWD is collected by the SunnyDays build system; individual user identities are not sent to those weather-data sources.

When the app needs a readable label for a location, it sends the selected coordinate to the SunnyDays API. The API forwards that coordinate to OpenStreetMap Nominatim using the API server's connection, not the user's direct connection. Nominatim therefore receives the requested coordinate and server connection data, but SunnyDays does not send it your account ID, email address or device ID. Cached provider responses are keyed by a one-way request hash and are not attached to a user profile.

4. Purposes and legal bases

  • Requested app and website functions: performance of a contract or steps taken at your request (Article 6(1)(b) GDPR).
  • Security, fraud prevention, essential logs and service reliability: legitimate interests in operating and protecting SunnyDaysApp (Article 6(1)(f) GDPR).
  • Advertising consent and device storage where required: your consent (Article 6(1)(a) GDPR and applicable ePrivacy rules). You can withdraw it through Settings → Privacy choices.
  • Answering messages and privacy requests: contract-related steps, legal obligations, or legitimate interests depending on the request.
  • Required record keeping: compliance with legal obligations (Article 6(1)(c) GDPR).

6. Local storage, diagnostics and accounts

Favorites, app preferences, cached map/weather content and temporary route state may be stored on your device. You can remove this information through app controls where available, by clearing app storage, or by uninstalling the app. Locally stored diagnostics are disabled in the normal production configuration and are not sent to an external analytics or crash-reporting provider.

Google account sign-in is available where enabled in the distributed app. Google provides a verified provider identifier, email address, display name and verification claims to the SunnyDays API. The API stores the account, entitlement state and hashed refresh-session records in PostgreSQL. Apple sign-in, cloud synchronization and paid subscriptions are not active features at the date of this notice.

7. Website and communications

The SunnyDays website currently has no analytics service, advertising pixels, marketing cookies, account portal or contact form. The web server and its infrastructure providers process ordinary connection/security logs to deliver and protect the site. If you contact SunnyDays by email, the message, your email address and any information you include are used to answer and document the request.

9. Retention

  • Local app data: until you delete it, clear app storage or uninstall the app.
  • Consent records: until withdrawn, reset, no longer required, or renewed under applicable consent rules.
  • Accounts: until you request deletion. The account is disabled and sessions are revoked immediately; primary account data is permanently purged after 30 days. Only a non-identifying purge receipt and anonymized audit event type/timestamp may remain.
  • Reverse-geocoding cache: provider responses are normally fresh for 30 days and may be retained for up to a further 90 days for resilient service before automatic removal; they are not linked to an account.
  • Technical/security logs: only for the rolling period reasonably needed for operations, abuse prevention, incident investigation and legal claims.
  • Support and privacy correspondence: until the request is resolved and thereafter only as needed for evidence, legal duties or limitation periods.
  • Backups: removed through the normal backup rotation after the corresponding live record is deleted.

Data may be retained longer when required by law, a legal claim, fraud/security investigation or an enforceable authority request.

11. Children and families

SunnyDaysApp is a general-audience weather and map service that can be useful to individuals and families; it is not designed or marketed primarily as a children’s service. The app does not ask for a date of birth. Parents and guardians should supervise a child’s use of location, maps, account sign-in, external links and advertising. If SunnyDays becomes aware that personal data was collected from a child contrary to applicable law, it will be deleted or otherwise handled as required.