Privacy Policy

Controller and contact

Tassilo Bouwman, Landgutgasse 40, 1100 Wien, Österreich, t.bouwman@me.com, is responsible for personal-data processing for TidePilot on iPhone, iPad, Mac, Apple Watch, widgets and Shortcuts.

Devices, iCloud and location

There is no app account, advertising or cross-app tracking. Favourites, settings and cached water levels are stored on your devices. With iCloud Sync, favourites and custom stations are also stored in your private CloudKit container at Apple. The app and its extensions share local data through an app group.

With your permission, location is used to find nearby stations on your device. Background location supports nearby widgets and alerts when you travel. You can revoke access in system settings. Station IDs requested from the server can reveal an approximate area. Custom pins send the name and precise coordinates you choose to the server; these can correspond to your own location. Town searches send the search text and an approximate map region to Apple Maps. Apple Maps and system location services are subject to Apple's privacy policy: https://www.apple.com/legal/privacy/.

Backend and custom stations

The app obtains water levels from waterlevels.bouwman.me, hosted by Hetzner Online GmbH in Germany. Requests include station IDs, time ranges and app version; your IP address is processed to deliver the response. The service uses aggregate station and app-version request counts for operation. Custom names and coordinates are stored to compute predictions on the server from FES2022 and EOT20. A custom station has no app account attached, but its ID can be associated with your push token if included in alerts or widget refreshes. Active pins remain stored until a deletion request reaches the server; removed pins are erased within 30 days of that request.

Alerts and silent widget refreshes

If you enable alerts, the server stores your APNs push token, station IDs, alert preferences and delivery information. It sends alerts through Apple. Switching alerts off requests deletion of these subscriptions; a failed network request may delay deletion. Subscriptions without an app refresh are removed after 90 days; alert history after 30 days.

Widgets and Watch complications can register separately for silent background updates even when visible alerts are off. This sends the APNs token, widget station IDs, platform, app build and time zone. Turning alerts off does not delete this separate registration. Removing all widgets/complications requests deletion when the app next checks them and can reach the server. The scheduled cleanup removes registrations not refreshed for 60 days. Invalid tokens may be removed sooner.

Purposes, legal bases and recipients

Providing requested predictions, custom stations, alerts and widget updates relies on Art. 6(1)(b) GDPR. Secure operation and aggregate service monitoring rely on Art. 6(1)(f); the legitimate interest is keeping the service reliable and secure. Location access is optional and controlled by system permission. Without it, nearby features are unavailable; without a push token the server cannot deliver pushes. There is no automated decision-making with legal or similarly significant effects.

Hetzner hosts the backend. Apple handles CloudKit, Maps, push delivery and purchases; its processing can involve countries outside the EEA under the arrangements described in Apple's privacy policy. Water-data providers receive server requests, rather than device requests. Credits are available in Settings. App purchases use StoreKit; the app checks entitlements on the device. Payment processing and refund requests are handled by Apple; statutory consumer rights remain unaffected.

Retention and rights

Backend backups are retained for 14 days; deleted data can remain in them until expiry. Technical logs rotate at a fixed size, which is not a fixed number of days. Local and iCloud data remain until removed by you through the relevant app or system controls.

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw any consent without affecting prior lawful processing. Contact me above; I may need a station ID or push token to locate data, and will not require unrelated identity data. You may complain to the Austrian Datenschutzbehörde (https://www.dsb.gv.at/) or your local supervisory authority.

Security and changes

App/backend communication uses HTTPS. Server and backup access is restricted. No system guarantees perfect security. This policy will be updated when processing changes. Updated 2026-10-14.