aeriusaerius

This is the same version shown inside the aerius app. Visiting this website is covered by the website’s separate privacy policy.

Privacy Policy

1. Controller

Controller under the GDPR:

Daniel Fieger

Breitenmorgen 5

76709 Kronau

Email: info@aerius-app.com

2. Overview

aerius is a location-based app that lets you leave short messages ("drops") at places, share moving status beacons, post in location-based group chats, and chat with people nearby. To provide these features we process personal data as described below. We use no advertising, no tracking, and no analytics services.

3. Data we process

  • Account data: email address, username and password (the password is stored only in encrypted/hashed form by our auth provider), an optional profile picture, and optional profile details (a short "about me" bio and an approximate place).
  • Location data: your device location (GPS), to show nearby content, place your own drops/statuses/group chats and — only if you enable background notifications — notify you when you enter a message's radius. An active status continuously updates its position while the app is open.
  • Content: your drops (text, category, position, radius, lifetime, optional image), statuses (text, position, radius), group chats (title, position, radius, optional cover image), chat messages and ratings (thumbs up/down).
  • Social data: friendships, blocked users, items you hide, and reports you submit (content/user + optional reason).
  • Feedback: when you contact us via the feedback feature in settings, we store your message together with the chosen category and technical details (app version, platform) in order to handle your request.
  • Push token: to deliver notifications, a device-specific push token is created and stored — only in a real app build and only with your permission.
  • Technical data: data needed to operate and secure the service (e.g. timestamps, IP/connection data on server access, counters for spam/rate limits).

4. Purposes and legal bases (Art. 6 GDPR)

  • Providing the app's features and performing the user relationship — Art. 6(1)(b) GDPR.
  • Location features, push/background notifications, camera/photo access — consent via the respective device permissions, Art. 6(1)(a) GDPR (revocable at any time).
  • Security, anti-abuse/spam, moderation (reporting, blocking, rate limits) — legitimate interest, Art. 6(1)(f) GDPR.

5. Recipients and processors

  • Supabase (authentication, database, file storage): hosts your account, content and location data. Region/hosting: Central EU (Frankfurt). A data processing agreement under Art. 28 GDPR is in place with Supabase.
  • Expo (push notifications): the push token and a notification's display text are transmitted for delivery via Expo's push service and the operating systems' push services (Apple APNs / Google FCM). The content of your messages is not transmitted: the notification only contains the sender's name or the chat title plus the neutral wording "New message". The actual text is loaded by the app directly from the database when you open it.
  • Google Firebase Cloud Messaging (FCM, Android only): Android devices can only receive notifications through this Google service — the operating system provides no alternative. Transmitted are the device's push token and the display text described above. From Firebase we use this delivery service only, no other Firebase products (no analytics, no database, no crash reporting).
  • Google Maps (map rendering, Android only): map usage may transmit location/usage data to Google; Google's privacy notice also applies.
  • Apple Maps/MapKit (map rendering, iOS only): map tiles are loaded via Apple's map service; connection and viewport data may be transmitted to Apple.
  • App stores (Apple App Store, Google Play): distribution of the app.

Expo (USA) and Google (USA) may transfer data to the US in this context. Where data is transferred to third countries (outside the EU/EEA), we rely on appropriate safeguards (e.g. EU Standard Contractual Clauses or participation in the EU-US Data Privacy Framework).

6. Public visibility of content

Important: drops, statuses, group chats and profile details (username, profile picture) are visible to other nearby users; the approximate place follows from where you place them. In anonymous group chats your name and profile picture are hidden from other users. This anonymity is pseudonymous, not absolute: technically an internal identifier stays linked to your message. So do not post sensitive or identifying information you would not want associated with you.

6a. Reporting, moderation and shared content

You can report content and users — including individual chat messages and messages in anonymous group chats. When you report something, the specific reported content (text, and any image) is transmitted to the operator for review and stored there. The operator may view this content, identify its author — including in anonymous chats, since anonymity applies towards other users, not towards moderation — and take action (remove content, ban the user). For a reported direct message, the operator sees only the reported message itself, not the rest of the private conversation. Private conversations are not read without cause. Legal basis: legitimate interest in safety and abuse prevention and compliance with legal obligations (including notice-and-action procedures under the Digital Services Act) — Art. 6(1)(f) and (c) GDPR. Reports are retained for as long as needed to handle them and keep them auditable.

7. Local storage on your device

Some data is stored only locally on your device (e.g. your filter and vibration settings, a cached data store, already-shown notifications). This data is necessary for operation and is not used for analytics or advertising.

7a. Shared links

When you share a drop, the app creates a link (https://aerius-app.com/…) that contains only the random content ID — no personal data and no location. Recipients only see the content itself once they are inside its radius. Visiting the linked website is covered by the website's separate privacy policy.

8. Retention

We keep data while your account exists or as long as needed for the purposes above. You can delete or pause content yourself; time-limited drops/group chats expire automatically. When you delete your account, related account and content data is removed without undue delay, at the latest within 30 days; statutory retention obligations remain unaffected.

9. Data security

We take appropriate technical and organizational measures to protect your data:

  • Encrypted transmission (HTTPS/TLS) between the app and our servers.
  • Passwords are never stored in plain text; our auth provider stores them hashed using state-of-the-art methods (bcrypt).
  • Access restrictions at the database level: every table is protected by access rules (Row Level Security) so that users can in principle only access data intended for them; server-side measures (e.g. rate limits) curb abuse.
  • Regular maintenance and updates of the components used.

However, complete security of data transmission over the internet cannot be guaranteed.

No end-to-end encryption. Messages are encrypted in transit (HTTPS/TLS) and stored on encrypted media, but they are not end-to-end encrypted. This means we, as the operator, could technically access chat content. We do not do so routinely — only when content is reported to us and we have to review it, or where we are legally required to. Push notifications deliberately contain no message text, so no content passes through the delivery services of Apple, Google or Expo. If you need to exchange particularly sensitive information, please use an end-to-end encrypted service.

10. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw any consent at any time with future effect. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, contact: info@aerius-app.com.

11. Account and data deletion

You can delete your account and related data directly in the app (Account → "Data & account" → "Delete account") or by request to the email above. After deletion, your account and content data are removed; statutory retention obligations remain unaffected. On request you can obtain a copy of your data ("Export my data").

12. Device permissions

  • Location (foreground and — optionally — background): for proximity features and radius notifications.
  • Notifications/push: for alerts about replies and messages nearby.
  • Camera / photos: only when you add a profile picture or an image to content.

You can revoke these permissions in your device settings at any time.

13. Children

aerius is not directed at children. Minimum age to use: 16. If the age required for consent is lower, a guardian's consent is required.

14. Changes to this policy

We may update this privacy policy. The version published in the app applies.

Last updated: July 25, 2026