Apira – Privacy Policy

• What we process:
  • your account: name, email address, and your password in hashed form;
  • the places you save and your notification radius;
  • the push token of your device and related identifiers;
  • if you turn on “Location”, your device’s last known location.
• Why: to show you wildfire information on a map, and to alert you when something is detected near your saved places or, if you turn this on, near your last known location.
• What we do not do:
  • no advertising;
  • no selling of data;
  • no analytics or tracking tools of our own in the app (section 4.7 explains what Google collects when it displays the map);
  • no profiling for advertising or to assess you. The only automated step is checking whether an event is within your radius (see 4.5), which has no legal or similarly significant effect on you (Art. 22 GDPR);
  • no use of your data to train AI.
  • Other users and organisations never see your location or saved places.
• Your location: we only store it on our server with your consent. You can withdraw your consent at any time under Profile → Location.
• Where: our servers are in Germany. Some providers that deliver push notifications or app updates, or display maps, are in the USA (see section 7).
• Deleting your account: in the app under Profile → Delete account, or without the app at https://app.apira.eu/legal/delete-account/.
• Contact: hello@apira.eu

Iosif Koutsoumpidis, trading as “APIRA”
Urbacher Weg 82C, 51149 Köln, Germany
Email: hello@apira.eu · Phone: +49 1522 1347101

Legal notice (Impressum): https://app.apira.eu/legal/impressum/

We have not appointed a data protection officer. Please send all data protection questions to hello@apira.eu.

Section 9 says how long we keep each item. Section 6 says who receives data. Wherever we rely on Art. 6(1)(f) GDPR, section 4 names our legitimate interest.

To create an account, you give us:

• a name. A first name or nickname is enough. We only use it to greet you in the app. Our administrators can also see it.
• your email address;
• a password. We store it only in hashed form, never in plain text.

We then send you an email with a verification link through our email service provider (section 6). Saved places and alerts only work after you verify your email address.

We also store:

• when the account was created and when it was verified;
• your notification radius (20 km by default, adjustable from 1 to 100 km).

Legal basis: Art. 6(1)(b) GDPR. We cannot open an account for you without a name, an email address and a password.

Using Apira without an account. At the moment you need an account with a verified email address to use Apira.

You can save places that matter to you, such as your home or a holiday home. For each place we store:

• the title you choose;
• the address you chose;
• the coordinates, which you can adjust by moving the pin.

Section 4.6 explains how the address search works.

Your notification radius applies to all your saved places and, if you turn on “Location”, to your last known location.

Saved places often show where you live. Other users and organisations cannot see them. Only we and our technical service providers (section 6) can access them, and only as far as needed to run Apira.

Legal basis: Art. 6(1)(b) GDPR.

Apira can use your device’s location in two ways. Both work only while Apira is open on your screen. Apira does not ask for background location permission and never reads your location while the app is closed or in the background.

(a) Your position on the map. While the “Location” setting (see (b)) is on and you allow location access, the app shows where you are on the map. Showing it does not by itself send your position to our server; what the setting sends is described in (b). (In the Android app, Google learns which map area is shown when it loads the map, see 4.7.)

(b) Alerts near your location (only with your consent). The “Location” setting in Profile is off until you turn it on. Before you turn it on, the app explains what happens (see the in-app disclosure). You can also turn it on with the locate button on the map, after the same explanation. While it is on:

• The app sends your position to our server when you open the map, and then, while the app is open, each time your position changes, if about a minute has passed or you have moved about 200 metres since the last update. While you are travelling, this can be every few seconds.
• On the server we store only your last known position (latitude and longitude) and when it was last sent, with your account. Each update overwrites the one before. We do not keep a history of your positions. Our notification records do note when an alert was sent because of your last known location, and the distance (see 4.5).
• We compare your last known position with new satellite heat detections, Civil Protection posts and incidents. If one of them is within your notification radius, we notify you, even when the app is closed.
• Your position is only updated while the app is open, so it can be out of date.

Withdrawing your consent. You can withdraw your consent at any time, with effect for the future, by turning off Profile → Location or, in the Android and iOS apps, by revoking location access in your phone settings. We delete your stored position when you turn the setting off or log out, and, in the Android and iOS apps, the next time you open Apira if you revoked location access. Withdrawing your consent does not affect the lawfulness of the processing before it (Art. 7(3) GDPR).

Approximate location. On Android, Apira asks only for your approximate location. On iPhone you can switch off “Precise Location”; the map and alerts then use that approximate position.

Web app. The web app works the same way, using your browser’s location feature. In the web app, we delete your stored position when you turn Location off or log out.

Who sees it: we do not share your location with other users, organisations or advertisers, and we do not use it for anything else.

Legal basis:

• Your position on the map: Art. 6(1)(b) GDPR. Reading the location on your device for this: § 25(2) No. 2 TDDDG.
• Alerts near your location (sending, storing and matching your position on our server): Art. 6(1)(a) GDPR, your consent. Reading the location on your device for this: § 25(1) TDDDG (your consent), and in the alternative § 25(2) No. 2 TDDDG.

What we store:

• If you allow notifications, the app obtains a push token from your phone’s operating system:
  • on Android, through Google Firebase Cloud Messaging (FCM). Google’s Firebase library creates a push token and a Firebase Installation ID when the app first starts, and registers them with Google. Apira only fetches the token and sends it to Expo and to our server if you allow notifications. On Android 12 and older, Android does not ask for permission; Apira asks you first;
  • on iOS, through the Apple Push Notification service (APNs).
• The app then registers this token directly with the Expo push service. It sends an installation ID that the Expo library creates and stores on your device, the app identifier and the device token. Expo sees your device’s IP address and returns an Expo push token.
• We store the Expo push token with your account, together with:
  • the platform (Android or iOS);
  • a device label, “Apira Android” or “Apira iOS”, which helps us troubleshoot delivery. We do not read your device’s name.

How a notification travels:

• When an alert is due, our server sends the Expo push token, the notification title and text, and the ID and map position of the event to Expo.
• Expo forwards them to Google (Android) or Apple (iOS), which deliver the notification to your device.
• The text can include:
  • the title of your saved place and the distance (for example “2.3 km from Home”);
  • the text of a Civil Protection post or of an incident.
• Depending on your phone settings, notifications may appear on your lock screen.

Your choices:

• Notifications are optional. You can use the map without them.
• You can turn them off in your phone’s settings.
• Turning notifications off does not delete your push token. It is deleted when you log out on that device or delete your account.

Legal basis:

• Art. 6(1)(b) GDPR.
• Storing and reading the token and the installation IDs on your device: § 25(2) No. 2 TDDDG.

Every few minutes we check for new data. We notify you when one of the following is within your notification radius of a saved place or, if you turned on “Location”, of your last known location:

• a new satellite heat detection (NASA FIRMS);
• a Civil Protection post by @112Greece on X that names an area with a fire or tells people to move away, if we were able to place that area on the map automatically;
• an incident that a registered organisation published and chose to send to nearby users.

For each alert we record:

• which event it was;
• whether it matched one of your saved places (and which one) or your last known location;
• the distance;
• when it was sent.

We use these records so that you don’t get the same alert twice, and to fix problems.

Organisations that publish incidents only see how many users an incident notification will reach. They never see who those users are or where they are.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (our legitimate interest in reliable alerts without duplicates). For alerts based on your last known location: Art. 6(1)(a) GDPR (your consent, see 4.3) and Art. 6(1)(f) GDPR.

No automated decisions. Matching alerts to places happens automatically, but it does not lead to any decision about you with legal or similarly significant effects (Art. 22 GDPR).

When you search for an address to save a place:

• the text you type goes to our server;
• our server passes it to the Google Places API, together with a fixed language code (Greek) and a random session identifier created by the app;
• Google does not receive your IP address or your account details from us;
• we keep search results on our server for a short time (address suggestions for up to 1 hour, place details for up to 24 hours). They are not linked to your account. The session identifier only reaches Google when a result is not already stored. The address and pin you confirm are saved as your place (4.2).

The address search uses the Google Places API, and Google’s attribution requirements apply. Google processes the search text under the Google Privacy Policy (https://policies.google.com/privacy).

Legal basis: Art. 6(1)(b) GDPR.

Android app. The map comes from the Google Maps SDK for Android.

• When the map loads, your device connects directly to Google.
• According to Google, the Maps SDK collects:
  • your IP address;
  • device details, such as the operating system version, model, brand and form factor, and the SDK version;
  • a pseudonymous Maps SDK identifier, which Google uses to count daily users;
  • crash data from the map component;
  • how you pan and zoom the map.
• Google also learns which map area you are looking at, because it has to send the matching map data.
• Google uses this data to provide the map, and also for its own purposes, such as maintaining and improving its services. For that use, Google is an independent controller.
• Your use of Google Maps features is subject to:
  • the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps/);
  • the Google Privacy Policy (https://policies.google.com/privacy).
• Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in offering a reliable, familiar map. You can object (section 10). However, the Android app cannot show the map without Google.

iOS app. The map comes from Apple Maps. Your device connects directly to Apple, which processes your IP address and map requests under its privacy policy (https://www.apple.com/legal/privacy/).

Web app (app.apira.eu). Your browser loads map images directly from:

• Esri (satellite view; Environmental Systems Research Institute, Inc., USA), delivered through Amazon CloudFront;
• the OpenStreetMap Foundation (street map; United Kingdom), delivered through its CDN provider Fastly, Inc. (USA).

The screens for adding and editing a place in the web app load the same map images. Esri, the OpenStreetMap Foundation and their CDN providers receive your IP address and the map area you are looking at. Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in showing a map in the browser version of Apira.

Burnt-area layer. Our own server fetches the burnt-area layer from the EU’s EFFIS service and passes it to the app. EFFIS receives no data about you.

When the app or the web app talks to our server, we process:

• your IP address;
• the date and time;
• the requested address (URL), which can include address search text;
• the response status and the amount of data;
• the app or browser version.

What we use it for:

• To limit how many requests can be made, we keep a counter linked to your IP address or account for one minute.
• We use our web server and application logs to keep Apira secure and working, and to find errors.
• We keep these logs for at most 14 days. They do not contain push tokens.
• Our background job system keeps records of completed jobs for up to 60 minutes and of failed jobs for up to 7 days. These records may contain your account ID or, in encrypted form, a report you sent (section 4.12).

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in a secure and stable service. You can object (section 10).

If you email or call us, we process your message and your contact details to answer you.

Legal basis:

• Art. 6(1)(b) GDPR for questions about your account;
• Art. 6(1)(c) GDPR where the law requires us to handle and document your request: requests to exercise your data protection rights (Art. 12 and 15–22 GDPR) and reports of illegal content (Art. 16 DSA);
• Art. 6(1)(f) GDPR in all other cases, based on our legitimate interest in answering enquiries that do not concern your account.

This section is for staff of organisations that publish incidents in Apira’s admin panel (platform.app.apira.eu).

What we process:

• your name, email address and password (hashed);
• your organisation and your role;
• the dates of your invitation and activation;
• the invitation and password-reset emails we send you through our email service provider (section 6);
• the incidents you created;
• session data while you are logged in: IP address, browser, and the time you were last active. A session ends after 120 minutes without activity, and expired session records are deleted within a day. Visitors to the login and password-reset pages also get a session record;
• if someone requests a password reset for an email address on the admin panel’s public reset page: that email address and a hashed reset token. The reset link works for 60 minutes, and we delete expired requests daily, so we keep them for about 25 hours at most.

The admin panel’s incident map loads map images from the OpenStreetMap Foundation, through its CDN provider Fastly (USA), directly in your browser. They receive your IP address and the map area (see 4.7 and section 7). The admin panel uses strictly necessary session and security cookies (section 5).

Where the data comes from: your organisation’s team owner, or us.

Who sees it: your organisation’s team owner and our administrators.

Published incidents show the name of your organisation, not your name. If you are removed from your organisation, your admin access ends, but your Apira account stays until you delete it (section 11). Only when the account is deleted is the link between you and the incidents you created removed. The incidents stay published under your organisation’s name.

Legal basis:

• Art. 6(1)(b) GDPR (your account);
• Art. 6(1)(f) GDPR, based on our and your organisation’s legitimate interest in secure publishing that can be traced, and in a working admin panel.

Apira loads public information from these sources. We send none of them personal data about you:

• satellite fire detections from NASA FIRMS;
• burnt areas from the European Forest Fire Information System (EFFIS) of the Copernicus Emergency Management Service;
• public posts of @112Greece, through the official X API.

Apira shows only the text of these posts and loads no images from X. If you open a post on X, X processes your data under its own privacy policy (https://x.com/en/privacy).

How we place 112 posts on the map:

• We send only the public text of the post to an AI language model through OpenRouter (OpenRouter, Inc., USA), which picks out the place names.
• We then look up those place names with Google.
• No user data is involved.

We do not use your data to train AI models.

Anyone can report content in Apira that they consider illegal (Terms of Use, section 6.4). This also applies if you do not use Apira. In the app, you can also use “Report” in an incident’s view to report an incident as illegal, false or misleading, offensive, or for another reason.

What we process: your name and email address (if you give them; a report made with “Report” in the app always includes the name and email address of your account), the reason and content of your report, the content concerned, and our decision.

How in-app reports reach us: the app sends your report to our server, which emails it to us at hello@apira.eu through our email service provider (section 6). We keep no table of reports in Apira’s database. While a report is being sent, it is held in encrypted form in our background job system; if sending fails, that encrypted record is kept for up to 7 days (section 4.8).

Why: to examine the report, decide on it, tell you and the organisation concerned about our decision, and document it.

Who receives it:

• the organisation that published the content, without your identity unless it is needed to handle the report;
• authorities, where the law requires it (for example Art. 18 DSA, if we suspect a threat to someone’s life or safety).

Legal basis:

• reports of illegal content: Art. 6(1)(c) GDPR together with Art. 16 DSA;
• reports for other reasons (false or misleading, offensive, other): Art. 6(1)(f) GDPR, based on our legitimate interest in keeping the map accurate and safe.

How long: 1 year after our decision.

The Android and iOS apps check for updates through Expo’s update service each time they start, so that we can deliver fixes without a new store release:

• The app sends u.expo.dev a random EAS client ID, which the update library creates and stores on your device, together with the platform (Android or iOS), the app’s runtime version, the update channel and the ID of the update the app is running.
• Expo sees your device’s IP address.
• If an update is available, the app downloads it from Expo and stores it on your device.

Legal basis:

• Art. 6(1)(f) GDPR, based on our legitimate interest in delivering fixes quickly and keeping the app secure and working;
• storing the EAS client ID and downloaded updates on your device: § 25(2) No. 2 TDDDG.

Apira only stores information on your device, or reads information from it, where this is strictly necessary for a function you asked for (§ 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG), or with your consent (§ 25(1) TDDDG):

1. Login token. It keeps you signed in. The mobile apps store it in your device’s secure storage (iOS Keychain / Android Keystore). The web app stores it in your browser’s local storage.
2. Push token and related identifiers. If you allow notifications, the app obtains a push token: on Android from Google’s Firebase library, which also creates a Firebase Installation ID; on iOS from Apple (APNs token). The Expo library also creates an installation ID on your device and sends it to Expo with the token (section 4.4). On Android, the Firebase library creates its identifiers when the app first starts; Apira fetches and sends the token only if you allow notifications.
3. Your location. Read only if you allow it, and only while the app is open. For alerts near your location we read it with your consent (section 4.3).
4. Temporary copies of map and layer data (a cache), so the map loads quickly.
5. A copy of your account details (name, email address, verification status, notification radius), so the app can open quickly. It is kept in the same storage as the login token and deleted when you log out.
6. App updates. The update library stores a random EAS client ID and downloaded updates on your device, and sends the client ID to Expo when the app checks for updates (section 4.13).

The apps and the web app use no cookies, advertising identifiers, or analytics or tracking tools of our own. Section 4.7 explains what the Google Maps SDK in the Android app stores and collects for Google. The admin panel for organisations (section 4.10) uses strictly necessary session and security cookies.

Our processors. These service providers process data for us under a data processing agreement (Art. 28 GDPR):

¹ Our agency engages Amazon Web Services as its sub-processor (Art. 28(2) and (4) GDPR), because sending emails and storing backups run in the agency’s AWS account.

Independent controllers. These recipients process data under their own responsibility:

• Apple (Apple Push Notification service, and Apple Maps if used on iOS) delivers notifications to iPhones. https://www.apple.com/legal/privacy/
• Google (Google Maps SDK in the Android app; Places API search text from our server). https://policies.google.com/privacy
• Esri (delivered through Amazon CloudFront) and the OpenStreetMap Foundation (delivered through Fastly): map images in the web app and, for OpenStreetMap, in the admin panel.
• X, only if you open a post on X (section 4.11). https://x.com/en/privacy
• Authorities, only where the law requires us to disclose data.

We do not sell your data and do not share it for advertising. Everyone who receives personal data from Apira, meaning our processors and the third-party services and SDKs named in this section (Google, Apple, Esri, the OpenStreetMap Foundation), is bound by contract or by their own legally binding privacy commitments to protect it at least as well as this policy describes.

Some recipients process data in the USA: Expo; Google; Apple; for the web app, Esri and Amazon Web Services (CloudFront, which delivers Esri’s map images); Fastly, which delivers OpenStreetMap map images.

• If a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).
• In addition, or if a recipient is not certified, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in that recipient’s data processing terms.
• For the OpenStreetMap Foundation (United Kingdom), the EU’s adequacy decision for the UK applies (renewed in December 2025).

You can ask us for a copy of these safeguards at hello@apira.eu.

• Needed for an account: name, email address and password. Without them you cannot use Apira.
• Optional: saved places, location (the “Location” setting: your position on the map and alerts near you) and notifications. Without them, the related features do not work: alerts for places, alerts near you, and push delivery.

No law requires you to provide data.

You have the right:

• to access your data (Art. 15 GDPR);
• to have it corrected (Art. 16);
• to have it erased (Art. 17);
• to restrict processing (Art. 18);
• to data portability (Art. 20);
• to withdraw your consent at any time, with effect for the future (Art. 7(3)). We ask for your consent for alerts near your location (the “Location” setting, section 4.3). You withdraw it by turning that setting off or, in the Android and iOS apps, by revoking location access in your phone settings.

To use these rights, write to hello@apira.eu, preferably from your account’s email address. Otherwise we will verify your identity in another way. We answer within one month (Art. 12(3) GDPR).

Right to object (Art. 21 GDPR). Some processing is based on Art. 6(1)(f) GDPR: technical access data and logs, the map in the Android app, the map images in the web app, notification records, the app update check, reports that are not about illegal content, some of our correspondence, and parts of the admin panel. You can object to it at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds, or the processing is needed to establish, exercise or defend legal claims. Write to hello@apira.eu.

Right to complain (Art. 77 GDPR). You can complain to any data protection supervisory authority. The authority responsible for us is: the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany (postal address: Postfach 20 04 44, 40102 Düsseldorf), https://www.ldi.nrw.de.

You can also complain to the authority in the country where you live or work. In Greece this is the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, https://www.dpa.gr.

• In the app: Profile → Delete account, then type DELETE to confirm. You do not need your password. If your email address is not yet verified, you can do this from the “Verify your email” screen.
• Without the app: go to https://app.apira.eu/legal/delete-account/, or email hello@apira.eu from your account’s email address.

What we delete straight away:

• your account;
• your saved places;
• your last known location;
• your push tokens and login tokens;
• your notification records;
• any password-reset requests for your email address.

What remains for a while:

• server and application logs, for up to 14 days;
• records of failed background jobs, which may contain your account ID or an encrypted report, for up to 7 days;
• backups, for up to 7 days;
• delivery records at our email service provider, under its own retention rules;
• reports you sent us (by email or with “Report” in the app), for 1 year after our decision (section 4.12);
• if you asked by email, our correspondence about your request (see section 9).

Apart from this, we keep nothing about you. If you published incidents for an organisation, they stay published under the organisation’s name, without a link to you.

Details: https://app.apira.eu/legal/delete-account/.

Apira is not meant for children. You must be at least 16 years old to create an account. If we learn that an account belongs to someone younger, we delete it.

• All connections between the app and our server are encrypted (HTTPS/TLS).
• We store passwords only in hashed form.
• In the mobile apps, login tokens are kept in your device’s secure storage; in the web app, in your browser’s local storage. On our server we store only a hashed form of each token.
• Our server is in a data centre in Germany.
• Only named people who need it to run Apira can access user data.
• We limit the number of requests to protect against misuse.

No system is completely secure. If a data breach is likely to put you at high risk, we will tell you (Art. 34 GDPR).

We update this policy when Apira or the law changes. The version date is at the top. Before important changes take effect, we tell you in the app or by email.