The Shelter — Privacy Policy
Last updated:
0. Who we are
The Shelter ("the app", "we", "us") shows recent earthquakes, sends earthquake alerts for your area, and lets people share whether they felt shaking. The app and its servers are operated by Alexey Komarov, an individual developer. Contact: [email protected].
We built the app to work with as little personal data as possible: you can use it without an account, our servers never receive your precise location, we do not sell data, we show no ads, and the app contains no third-party analytics or advertising SDKs and no tracking.
1. What we collect and why
1.1 Without an account
| data | why | where it lives |
|---|---|---|
| A random installation ID created by the app, and a device secret the server issues for it | to register this installation for earthquake alerts and let only it change its own settings | our database (Cloudflare D1) |
| Your push notification token (and, if you allow Live Activities, the Live Activity tokens Apple issues) | to deliver alerts to this device | our database |
| Your approximate alert area: a map cell of roughly 40 km, never your coordinates | to decide which earthquakes are near enough to alert you | our database |
| If you have not shared your location: an approximate area derived from your network address (IP-based geolocation provided by Cloudflare), stored the same way as a ~40 km cell | so alerts work before you allow location access; such a device is alerted only for large earthquakes | our database (the IP address itself is not stored) |
| Your alert settings: magnitude and distance thresholds, quiet hours, time zone, language, notification permission state (for example "delivered quietly") | to send the alerts you asked for, at the times you allow, in your language | our database |
| App version and iOS version | compatibility and the right alert format | our database |
| A device-integrity key (Apple App Attest) | to check that requests come from the genuine app | our database |
Your precise location (when you allow it) is used on your device to show nearby earthquakes and your distance to them. Only the ~40 km cell above leaves the device for alerts. Location is read while the app is open; the app does not track you in the background — your alert area is updated when you open the app.
Some things stay only on your device and never reach us: your emergency contacts (an SOS message is written in Apple's Messages app and sent by you), your saved podcasts and your display preferences.
1.2 If you sign in with Apple (optional)
Signing in is needed only to publish felt reports and to keep your profile across devices.
| data | why |
|---|---|
| Apple's stable user identifier for this app, and the email address Apple shares (often a private relay address) | to create and recover your account |
| An account ID and sessions (per signed-in device, with the app version) | to keep you signed in; sessions expire and can be revoked |
| Apple's refresh token, stored encrypted (AES-256) | Apple requires us to revoke it when you delete your account |
Your public profile: the display name and tag you choose (for example Name#0042) and an emoji avatar | shown next to your public felt reports |
1.3 Felt reports ("Warn mates") — public
When you report shaking, we store the intensity you chose, the time, an area of about 1 km (your position is rounded on your device before it is sent), the earthquake it matches (if any), and your account. Felt reports are public: other users and our public data files show the intensity, the ~1 km area, the time and your display name / tag. Your account ID and email are never published. A daily anonymized archive of reports (no account, no display name) is published for research and kept indefinitely.
1.4 Keeping the community safe: complaints, blocking and the name filter
- Complaints. Signed in, you can report another person's felt report (tap its pin on the map, then "Report this"). We store the complaint (the report it concerns, a reason, the time and your account), review it, and can hide reports and suspend or ban accounts that break our Terms of Use. Reports that collect complaints may be hidden automatically.
- Blocking. Signed in, you can block another user. We store that you blocked them (your account and theirs) so the reports they publish under a name are hidden from you (reports published without a name show no one's identity and stay on your map as anonymous counts); the block is erased when you unblock them or delete your account.
- Name filter. Display names are checked automatically when you choose them, for length, allowed characters, reserved words and offensive words. A name that fails the check is not saved.
1.5 "Did You Feel It?" reports to the USGS (optional)
After a felt report the app can offer to send a report to the U.S. Geological Survey's "Did You Feel It?" program as well. It says first that your precise location and the time go to the USGS. If you agree, the USGS form opens in the app with those details filled in, and it is sent only if you submit it there (a later version may send it for you after the same consent). Either way it goes directly from your device to the USGS: we do not receive or store it. The USGS privacy policy applies: https://www.usgs.gov/policies-and-notices. You can turn the offer off in Profile → Settings → "Report to USGS after each report".
1.6 Source suggestions and content complaints
Messages you send with the "+" (New source) button in News, Videos and Podcasts, or with the "…" button on an event, article, video or podcast ("Content complaint"), are stored with their type, the item they refer to, your language and app version, and — if you are signed in — your account (otherwise your installation ID). Only the operator reads them; they are never published and never leave our database. They are deleted automatically 180 days after we receive them. Deleting your account erases the ones you sent while signed in immediately.
1.7 What we do not collect
No contacts, photos, microphone, health or fitness data, browsing history or advertising identifier, and no precise location on our servers. No data is used for advertising, tracking or profiling, and none is sold.
2. Services that process data for us, and content from others
- Cloudflare (hosting, database, storage, network security) runs our servers and databases. Cloudflare processes IP addresses to deliver and protect the service (for example rate limiting) and to derive the approximate network location in §1.1. Our servers' operational logs (request, time, result) are kept by Cloudflare for a few days. We do not store IP addresses in our databases.
- Apple: Sign in with Apple, the Apple Push Notification service (alerts and Live Activities), App Attest, and Apple Maps (the map tiles, and place names looked up for the map header).
- Public files — earthquake data, region data and app settings — are downloaded from our servers and from GitHub and jsDelivr. Like any web server, these services see your IP address and the file requested; no account data is sent.
- Content you choose to open comes straight from its provider, who sees your IP address and applies its own privacy policy:
- News: the headline list comes from Google News; an article opens in an in-app browser from its publisher's site.
- Videos: videos play in an in-app web view that loads YouTube's own page (Google's privacy policy applies, and YouTube may set its cookies in that web view). If YouTube asks you to sign in, "Sign in to YouTube" opens Google's own sign-in page; the app never reads or stores your Google credentials.
- Podcasts: the directory comes from Apple's podcast search; episodes stream from their publishers.
- Story of the day: short texts from our servers; a tap opens the cited source.
Our service providers may process data outside your country (Cloudflare's network is global; Apple, Google and GitHub are US companies). Where the GDPR applies, those transfers rely on the providers' data-processing terms, including the EU Standard Contractual Clauses.
3. How long we keep data
| data | retention |
|---|---|
| Alert registration (installation ID, token, area, settings) | while the app is installed and registered; tokens Apple reports as invalid are removed after 30 days; removed immediately when you delete your account (for devices linked to it) |
| Account, sessions, Apple token | until you delete your account (see §4); expired or revoked sessions are cleaned up automatically |
| Felt reports (identifiable) and the complaints about them | up to 400 days in the live database, then deleted automatically (the service started in September 2026, so no report has reached that age yet); the anonymized archive is kept indefinitely |
| Blocks | until you unblock the user or delete your account |
| Source suggestions and content complaints | 180 days after we receive them, then deleted automatically; erased immediately when you delete your account (for messages sent while signed in) |
| Backups | point-in-time recovery for 7 days; encrypted offline exports kept by the operator for 30 days |
4. Deleting your account
In the app: Profile → Settings (the gear button) → "Delete my profile". Deletion takes effect immediately: all your sessions are signed out, your public profile is erased, your felt reports are anonymized (account and display name removed), the messages you sent while signed in are erased, the devices linked to your account are unregistered, and your Apple authorization is revoked. Your account record is kept for 30 days so you can restore it by signing in again — the app then asks "Restore your account?" (a restored account starts without the erased profile and without the anonymized reports); after 30 days it is deleted permanently.
You can also stop using Sign in with Apple for The Shelter in iOS Settings (your Apple Account → Sign in with Apple): Apple then tells us, and we end your sessions; if you delete your Apple Account, we delete your Shelter account. Deleting the app removes the alert registration from your device; the server copy of an installation that is not linked to an account stops receiving alerts once Apple reports its token invalid.
5. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or the CCPA) you can ask for access to, a copy of, correction of, or deletion of your data, and object to or restrict its processing. Most of this is available in the app (edit your profile, delete your account). For anything else write to [email protected]; we answer within one month.
Where the GDPR or the UK GDPR applies, we rely on:
- performance of the service you asked for (Art. 6(1)(b)) for alerts, your account and publishing your felt reports;
- legitimate interests (Art. 6(1)(f)) for security, abuse prevention and moderation, the network-derived alert area, and the anonymized research archive;
- your consent (Art. 6(1)(a)) for location access, notifications and a "Did You Feel It?" report to the USGS — you can withdraw it at any time in iOS Settings or in the app.
You may also complain to your data protection authority (in the United Kingdom, the Information Commissioner's Office: https://ico.org.uk).
6. Children
The Shelter is not directed at children under 13, or under the higher age your country sets for consenting to online services (up to 16 in parts of the EU), and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
7. Security
Traffic is encrypted (TLS). Apple refresh tokens are encrypted at rest; device secrets and the session refresh tokens of our own sign-in are stored only as hashes. The app settings and the earthquake feed are cryptographically signed so the app can detect tampering.
8. Changes
We will post changes here and update the date above; material changes will also be announced in the app.