aeriusaerius

Privacy Policy

1. Controller

Controller under the GDPR:

Daniel Fieger

Breitenmorgen 5

76709 Kronau

Email: info@aerius-app.com

2. Overview

aerius is a location-based app that lets you leave short messages ("drops") at places, share moving status beacons, post in location-based group chats, and chat with people nearby. To provide these features we process personal data as described below. We use no advertising, no tracking, and no analytics services.

3. Data we process

  • Account data: email address, username and password (the password is stored only in encrypted/hashed form by our auth provider), an optional profile picture, and optional profile details (a short "about me" bio and an approximate place).
  • Location data: your device location (GPS), to show nearby content and place your own drops/statuses/group chats. If you additionally grant the background permission ("Always allow"), we process your location for two clearly separated purposes, each chosen by you: (a) alerting you when you enter a drop's area — the app hands the operating system a list of circles, which only wakes it briefly when you cross a boundary; when you leave the covered area, the app fetches the drops around your new position once in the background so alerts keep working. (b) keeping your active status visible — while you share a status, the app updates its position even when the app is closed or the screen is locked; your device shows a persistent indicator during that time. Without the background permission both stop as soon as you close the app. There is no continuous recording of your movements: outside these two purposes your location is neither collected nor stored.
  • Content: your drops (text, category, position, radius, lifetime, optional image), statuses (text, position, radius), group chats (title, position, radius, optional cover image), chat messages and ratings (thumbs up/down).
  • Social data: friendships, blocked users and items you hide.
  • Saved items and visits: which drops you have saved ("heart") or bookmarked for later, and which drops you have already entered. A visit is verified when you enter and then stored as a plain link "you ↔ this drop" with a timestamp — your position itself is not stored. It keeps a drop you have read readable for you, including on a new device. Since a drop sits at a fixed place, this list does reveal which places you have been to; you can view it via the data export and delete it with your account.
  • History: earlier versions of your status and — if you edit a drop's text afterwards — the previous versions of that text. The text versions are not visible to other users; they exist solely for moderation (see 6a).
  • Moderation data: reports you submit (content/user + optional reason) and warnings the operator has issued to you (wording and time).
  • Feedback: when you contact us via the feedback feature in settings, we store your message together with the chosen category and technical details (app version, platform) in order to handle your request.
  • Push token: to deliver notifications, a device-specific push token is created and stored — only in a real app build and only with your permission.
  • Technical data: data needed to operate and secure the service (e.g. timestamps, IP/connection data on server access, counters for spam/rate limits).

4. Purposes and legal bases (Art. 6 GDPR)

  • Providing the app's features and performing the user relationship — Art. 6(1)(b) GDPR.
  • Location features, push/background notifications, camera/photo access — consent via the respective device permissions, Art. 6(1)(a) GDPR (revocable at any time).
  • Security, anti-abuse/spam, moderation (reporting, blocking, rate limits) — legitimate interest, Art. 6(1)(f) GDPR.

5. Recipients and processors

  • Supabase (authentication, database, file storage): hosts your account, content and location data. Region/hosting: Central EU (Frankfurt). A data processing agreement under Art. 28 GDPR is in place with Supabase.
  • Expo (push notifications): the push token and a notification's display text are transmitted for delivery via Expo's push service and the operating systems' push services (Apple APNs / Google FCM). The content of your messages is not transmitted: the notification only contains the sender's name or the chat title plus a neutral wording ("New message", "New friend request", "You are now friends"). The actual text is loaded by the app directly from the database when you open it.
  • Google Firebase Cloud Messaging (FCM, Android only): Android devices can only receive notifications through this Google service — the operating system provides no alternative. Transmitted are the device's push token and the display text described above. From Firebase we use this delivery service only, no other Firebase products (no analytics, no database, no crash reporting).
  • Google Maps (map rendering, Android only): map usage may transmit location/usage data to Google; Google's privacy notice also applies.
  • Apple Maps/MapKit (map rendering, iOS only): map tiles are loaded via Apple's map service; connection and viewport data may be transmitted to Apple.
  • On-device translation (Google ML Kit on Android, Apple Translation on iOS): if you ask for a foreign-language drop to be translated, this happens on your device — the text is transmitted neither to us nor to any third party. However, the first time you use a language pair, your device downloads a language model from Google (Android) or Apple (iOS); this creates a connection to that provider involving the usual connection data (e.g. IP address). Afterwards the device translates without an internet connection. The feature only runs when you explicitly request it.
  • App stores (Apple App Store, Google Play): distribution of the app.

Expo (USA), Google (USA) and Apple (USA) may transfer data to the US in this context. Where data is transferred to third countries (outside the EU/EEA), we rely on appropriate safeguards (e.g. EU Standard Contractual Clauses or participation in the EU-US Data Privacy Framework).

6. Public visibility of content

Important: drops, statuses, group chats and profile details (username, profile picture) are visible to other nearby users; the approximate place follows from where you place them. In anonymous group chats your name and profile picture are hidden from other users. This anonymity is pseudonymous, not absolute: technically an internal identifier stays linked to your message. So do not post sensitive or identifying information you would not want associated with you.

6a. Reporting, moderation and shared content

You can report content and users — including individual chat messages and messages in anonymous group chats. When you report something, the specific reported content (text, and any image) is transmitted to the operator for review and stored there. The operator may view this content, identify its author — including in anonymous chats, since anonymity applies towards other users, not towards moderation — and take action (remove content, ban the user). For a reported direct message, the operator sees only the reported message itself, not the rest of the private conversation. Private conversations are not read without cause. If a review results in a warning, you receive it as a message in the app; its wording and time are logged so that repeated violations remain traceable. If a reported drop was edited after the report, the operator sees the version that applied at the time of the report — otherwise a report could be defused by rewriting the text afterwards. Legal basis: legitimate interest in safety and abuse prevention and compliance with legal obligations (including notice-and-action procedures under the Digital Services Act) — Art. 6(1)(f) and (c) GDPR. Reports, warnings and text versions are retained for as long as needed to handle them and keep them auditable.

7. Local storage on your device

Some data is stored only locally on your device (e.g. your filter and display settings, a cached data store, already-shown notifications, the texts of drops you have visited and translations you requested). This data is necessary for operation and is not used for analytics or advertising.

7a. Shared links

When you share a drop, the app creates a link (https://aerius-app.com/…) that contains only the random content ID — no personal data and no location. Recipients only see the content itself once they are inside its radius. Visiting the linked website is covered by the website's separate privacy policy.

8. Retention

We keep data while your account exists or as long as needed for the purposes above. You can delete or pause content yourself; time-limited drops/group chats expire automatically. When you delete your account, related account and content data is removed without undue delay, at the latest within 30 days; statutory retention obligations remain unaffected.

9. Data security

We take appropriate technical and organizational measures to protect your data:

  • Encrypted transmission (HTTPS/TLS) between the app and our servers.
  • Passwords are never stored in plain text; our auth provider stores them hashed using state-of-the-art methods (bcrypt).
  • Access restrictions at the database level: every table is protected by access rules (Row Level Security) so that users can in principle only access data intended for them; server-side measures (e.g. rate limits) curb abuse.
  • Images from chats are kept in a non-public store: they are served only via short-lived signed addresses, and the store checks on every request whether you belong to that chat. A shared address expires and is of no use to third parties.
  • Regular maintenance and updates of the components used.

However, complete security of data transmission over the internet cannot be guaranteed.

No end-to-end encryption. Messages are encrypted in transit (HTTPS/TLS) and stored on encrypted media, but they are not end-to-end encrypted. This means we, as the operator, could technically access chat content. We do not do so routinely — only when content is reported to us and we have to review it, or where we are legally required to. Push notifications deliberately contain no message text, so no content passes through the delivery services of Apple, Google or Expo. If you need to exchange particularly sensitive information, please use an end-to-end encrypted service.

10. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw any consent at any time with future effect. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, contact: info@aerius-app.com.

11. Account and data deletion

You can delete your account and related data directly in the app (Account → "Data & account" → "Delete account") or by request to the email above. After deletion, your account and content data are removed; statutory retention obligations remain unaffected. On request you can obtain a copy of your data ("Export my data").

12. Device permissions

  • Location (foreground): for proximity features and to place your own content.
  • Location (background, optional, "Always allow"): for exactly two purposes — alerting you when you enter a drop's area, and keeping your active status visible (see 3). The app remains fully usable without this permission; both features then end when you close the app.
  • Notifications/push: for alerts about replies and messages nearby.
  • Camera / photos: only when you add a profile picture or an image to content.

You can revoke these permissions in your device settings at any time.

13. Children

aerius is not directed at children. Minimum age to use: 16. If the age required for consent is lower, a guardian's consent is required.

14. Changes to this policy

We may update this privacy policy. The version published in the app applies.

Last updated: August 22, 2026