DE EN

Privacy Policy

This privacy policy explains what personal data the app "SurvKit" processes. It covers the iOS and the Android version and applies exclusively to the app itself.

SurvKit is built strictly according to privacy by design (Art. 25 GDPR): the app processes personal data exclusively locally on your device. There is no server, no account, no cloud, no telemetry and no analytics SDKs. The only exceptions are the voluntary feedback form, the processing of the in-app purchase and the crash reports, which can be switched off - all three described in detail below.

The Android version processes less. It has no feedback form and no crash reports; it goes online for two things only, both of which you trigger yourself: the in-app purchase, which Google Play handles, and downloading offline map packages. The separate section Android version below lists every difference.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the natural person publishing "SurvKit" as an independent developer:

  • Name: B. Neuhaus
  • Address: Allerstraße 26, 12049 Berlin, Germany
  • Email: survkit@borisniehaus.de

Full contact details can also be found in the imprint.

Data protection officer

"SurvKit" is published by a single person as an independent developer. A data protection officer is therefore not legally required and none has been appointed.

No account, no server, no transmission

SurvKit requires no registration and operates no backend. All data you enter is stored exclusively locally on your device and transmitted to no one (the only exception: the feedback form, see below):

  • Emergency profile (e.g. blood type, allergies, emergency contacts) - local, protected by iOS Data Protection
  • Document vault - local, encrypted with AES-256-GCM, key stored in the iOS keychain
  • Location & tracks - kept in memory, or stored locally when you start a recording
  • Supplies, notes, checklists, learning progress - local
  • Messenger messages - end-to-end encrypted (Curve25519 + ChaChaPoly), sent directly to a device within Bluetooth / Wi-Fi range, with no server in between

The legal basis for this purely local processing is the provision of the functions you request (Art. 6(1)(b) GDPR).

Internet connections only at your request

The app only connects to the internet when you actively trigger it. For technical reasons, the respective third party receives your IP address and a user agent:

  • Offline map packages (GitHub Releases): the requested file name; map data © OpenStreetMap (ODbL)
  • Wikipedia articles (Wikipedia REST API): the titles of the requested articles
  • Weather (Open-Meteo): rounded coordinates for the forecast
  • Food barcode lookup (OpenFoodFacts): the scanned barcode number
  • Local AI model (Hugging Face): one-time download of the model file
  • Vehicle manuals: opening the manufacturer portal you selected

We do not log these requests; no identifiers beyond what is technically necessary are transmitted. The legal basis is the provision of the function you explicitly requested (Art. 6(1)(b) GDPR). Downloaded content then works offline.

Feedback form (Supabase)

Under Profile → Send feedback you can send us a message. This is the only way content you enter ever leaves the device, and it is triggered exclusively by you tapping "Send" - nothing is transmitted in the background.

Transmitted are: your feedback text, an optional email address (only if you would like a reply), and - to help classify the report - the app and build version, iOS version, device model and language setting. Not transmitted are your emergency profile, vault contents, location, supplies, notes or any other app data. The recipient is a Supabase database (Supabase Inc.); the key embedded in the app can only insert data, not read it. The legal basis is the handling of your request (Art. 6(1)(b) GDPR).

In-app purchase "SurvKit Pro" (Apple / RevenueCat)

SurvKit can be used without restriction for seven days; after that, extended areas are unlocked via a single one-time in-app purchase (no subscription). The core emergency features remain free permanently. The purchase itself is processed by Apple (StoreKit / App Store); to display the price, validate the purchase and restore purchases, the app uses the SDK of the service provider RevenueCat, Inc.

RevenueCat receives an anonymous app user ID generated by RevenueCat, App Store receipt data, the app version, device type and language setting - no name, no email address, no Apple ID. The purchase status is cached locally; the app does not check in the background. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Details: RevenueCat privacy policy.

Crash reports (Sentry)

If the app crashes, it sends a technical error report on the next start. This function is active after installation. The privacy step during first launch names it explicitly and shows the corresponding switch right next to it; you can turn it off there and at any time later under Profile → About the app → Diagnostics. Switching it off takes effect immediately - the Sentry SDK is shut down and no longer opens a connection.

Only technical details about the crash are transmitted: error message and call stack (stack trace), the location in the program code, app and build version, iOS version, device model, language setting and time zone, plus a pseudonymous installation identifier that the Sentry SDK assigns per device. Not transmitted: screenshots, your GPS location and any content from the emergency profile, document vault, supply list or notes. No usage behaviour is recorded and no user profile is created.

About the IP address: the app does not send it. When the report is delivered, the Sentry server inevitably sees it - that cannot be prevented from within the app. For this project the option "Prevent Storing of IP Addresses" is enabled, so the address is not stored. A rough location derived from it (country and city) does remain stored with the event; this is a server-side Sentry feature and cannot be switched off.

The processor is Functional Software, Inc. ("Sentry"), San Francisco, California, USA. Reports go to the EU region of the service (ingest.de.sentry.io) and are stored in data centres within the European Union. The basis is a data processing agreement (Data Processing Addendum as part of the terms of service); for any transfers to the USA the European Commission's standard contractual clauses apply. Reports are deleted automatically after Sentry's retention periods. Details: Sentry's privacy policy.

The legal basis is our legitimate interest in a stable and error-free app (Art. 6 (1) (f) GDPR). Errors that only occur on particular devices or in particular languages are practically impossible to find otherwise. You can object to this processing at any time by switching the toggle off (Art. 21 GDPR).

Permissions

SurvKit only requests system permissions (location, camera, microphone, notifications, local network / Bluetooth) when a feature needs them - such as the camera for the document scanner or location for the map and compass. Data from these permissions is processed exclusively locally and never transmitted. Notifications are purely local (e.g. expiry dates in your supplies) - there are no push servers. This list describes the iOS version; which permissions the Android version requests, and what for, is listed one by one under Android version.

Android version

The Android version of SurvKit is narrower in scope than the iOS one, and that applies to data processing as well. For it, the following holds:

  • The app connects for offline map packages, for the weather and for the purchase. You trigger all three yourself; nothing goes out on its own. You download map packages by tapping "Download" in the map; the files are hosted on GitHub Releases, which for technical reasons receives your IP address, a user agent and the requested file name (map data © OpenStreetMap, ODbL). After that the map works entirely offline - nothing is fetched while you view it. The weather is fetched from Open-Meteo when you open the weather screen and have granted the location permission. What is transmitted are coordinates rounded to two decimal places - accurate to about a kilometre, enough for a forecast and too coarse for an address. For the purchase, Google's Play Billing library is embedded; it brings the INTERNET and ACCESS_NETWORK_STATE permissions with it in order to report purchases to Google. There is no way to sell in Google's store without it. The code reader looks nothing up: it decodes on the device.
  • Where the app may connect to is settled in the program itself. Every request passes through a single point that permits exactly these six counterparts and rejects everything else: github.com (map packages), api.open-meteo.com (weather), wikipedia.org (articles), world.openfoodfacts.org (food barcodes), www.ema.europa.eu (package leaflets) and huggingface.co (a one-time download of an AI model that then runs on the device). Wikipedia, the package leaflets and the AI model belong to features the Android version does not have yet - they are listed here already so that this text does not lag behind the app. The food scanner, by contrast, is there: it sends the barcode number to OpenFoodFacts and gets back the name, brand, quantity and ingredient list. The comparison against your allergen profile happens on the device - your list of allergens is never transmitted. Once loaded, a product stays available offline. Only what makes up the request is transmitted: a file name, rounded coordinates, an article title, a barcode number. The app sends no cookies, no device identifiers and no advertising IDs; the user agent names the app and its version, because public interfaces require one. There is no service that fetches in the background.
  • The Bluetooth messenger does not use the internet. It connects your phone directly to a device nearby - over Bluetooth LE or the local Wi-Fi, with no server in between, and it works when there is no internet connection at all. Messages are end-to-end encrypted (X25519 for the key exchange, HKDF-SHA256, ChaCha20-Poly1305); to confirm that the device you are talking to is the one you think it is, a safety number of six four-digit groups can be compared - it must read the same on both phones. What is visible to devices in range, while the screen is open, is the display name you choose yourself - do not put your real name there if you would rather not. The history stays on your device; messages you send also end up on the recipient's device, and over that we have no control.
  • No feedback form (no Supabase), no crash reports (no Sentry) and no RevenueCat. The one-time purchase runs directly through Google Play; no further third party is involved. Payment is handled by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) - we see neither your name nor your payment details, only whether this device account owns the product. That yes-or-no value stays on the device.
  • The trial is measured by the device itself. The seven free days are a date in the app's own storage. There is no account, no identifier and no query to us - we do not learn whether or when you use the app.
  • The permissions, named one by one. The app declares thirteen entries in its manifest, which come down to seven things. Each is requested only when you open the feature that needs it - none at startup:
  • Notifications (POST_NOTIFICATIONS) for the reminder about expiring supplies. Requested only once you enter your first expiry date; the notification is created on the device, without any push server.
  • Start after reboot (RECEIVE_BOOT_COMPLETED) so those reminders survive a restart of the phone.
  • Location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) for the position display in the compass - coordinates, altitude, UTM and MGRS -, for your own position on the map, for track recording and for the weather. In every case but one the position stays on the device: it is displayed, or stored there if you start a recording. The one exception is the weather - coordinates rounded to two decimal places go to Open-Meteo, because a forecast without a place is not a forecast. Compass and map also work without this permission, simply without the position. Below Android 12 the Bluetooth scan additionally requires location; that is a rule of the system and serves to find devices there, not to locate you.
  • Microphone (RECORD_AUDIO) for the noise meter. Nothing is recorded. The app computes the loudness from the live signal and discards it immediately; none of it is stored or sent.
  • Camera (CAMERA) for the code reader and the document scanner. The code reader evaluates the image on the device and discards it; the document scanner puts the capture straight into the encrypted vault on your device. No image leaves the phone.
  • Bluetooth (BLUETOOTH_SCAN, BLUETOOTH_CONNECT, BLUETOOTH_ADVERTISE; below Android 12 BLUETOOTH and BLUETOOTH_ADMIN) for the Bluetooth messenger. Requested when you open that screen. The scan carries the neverForLocation flag: it serves to find devices and is not used to derive your location. If you decline, the messenger keeps working over the local Wi-Fi. Bluetooth is not a requirement for the app - if the device has none, only this one screen is missing.
  • Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION) for track recording on the map. It is the only thing that keeps running while the app is closed - and only while you have started it: from "start recording" to "stop recording", never automatically, never after a restart of the phone. A notification with a stop button stays visible in the status bar the whole time. The recorded track is stored on the device and sent nowhere; you can delete it again in the app.
  • The libraries add: com.android.vending.BILLING, INTERNET and ACCESS_NETWORK_STATE for the purchase, plus USE_BIOMETRIC and USE_FINGERPRINT for the app lock and the vault.
  • Encryption via the Android Keystore. The document vault encrypts with AES-256-GCM; the master key lives in the device's keystore and cannot be extracted. Fingerprint, face or device code can be placed in front of it. Where the text above refers to iOS Data Protection and the keychain, the Android keystore takes that place.
  • Backup and export work as described: only when you trigger them, encrypted with your password, stored wherever you put them.

The offline map, the weather, the Bluetooth messenger and the food scanner are now included and described above. As soon as the Android version gains another of the features that only the iOS version has so far - Wikipedia, package leaflets or the AI assistant - this section will be updated beforehand. The six counterparts that come into question for that are already listed above in full.

Storage period and deletion

All data resides exclusively on your device and remains stored until you delete it in the app or uninstall the app. An encrypted export (backup) only happens when you trigger it yourself, and is stored wherever you choose to save it.

Your rights

You have the rights under Art. 15-21 GDPR (access, rectification, erasure, restriction, objection, data portability) as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Since all data resides locally on your device, you can exercise access, rectification and erasure at any time directly in the app. For any questions, contact survkit@borisniehaus.de.

Apple and Google as distribution platforms

SurvKit is distributed via the Apple App Store and via Google Play. Obtaining the app through either store is subject to Apple's or Google's own data processing (e.g. in the context of your account and the download), is governed by their privacy policies and is outside the controller's sphere of influence.

Cookies and tracking

SurvKit uses no cookies, performs no tracking and embeds no analytics or advertising SDKs. There are no advertising identifiers, no profiling and no cross-device recognition. The only diagnostics SDK embedded is Sentry for crash reports - limited to crashes, without usage behaviour and switchable off at any time (see above). The Android version does not contain even that.

Last updated

2026-09-15

← Back to the app page