Privacy policy

Device registration and notifications

The app or the browser creates a random device id and a secret key for itself and registers them with the server; the server stores only a hash of the key. The iPhone app registers only when you turn on alerts, save a place or use station mode; the website only when you turn on alerts on the “Alerts” page.

The registration holds:

• the notification address: on iPhone the Apple Push Notification service (APNs) device token, on the web the browser’s Web Push subscription (endpoint and encryption keys); if you use Live Activities, a push-to-start token,
• language, intensity threshold, critical alert preference, app and operating system version,
• your saved places: the name you give and coordinates rounded to about 100 m (0.001°),
• on iPhone, if “Alerts where I am” is on, your last location rounded to about 1 km (0.01°),
• when you were last notified and for which earthquakes.

How alerts are computed

For every earthquake the server computes the expected shaking at your saved places and notifies you when it reaches your threshold. Notifications are delivered through Apple (APNs) or your browser’s push service (for example Google, Mozilla or Apple); these services see only the notification content and address.

“Did you feel it” reports

When you report shaking, the location you send is reduced to an H3 cell (resolution 8) of about 0.7 km², roughly 1 km across, as soon as it reaches the server; the exact coordinates are neither stored nor logged. The cell, the intensity you chose, the time, the platform and a random id your device keeps (to merge repeated reports) are stored. That id is not linked to your device registration.

Per-cell summaries are shown publicly on earthquake pages.

Station mode (phone as a sensor)

Station mode runs only when you turn it on and the iPhone is charging and still. Motion data is processed on the phone; raw sensor data is never sent.

Only the following is sent to the server: an H3 cell (resolution 7) of about 5 km², clock offset, sample rate and background noise (regular “I am listening” heartbeats), and, when the phone detects shaking, the trigger time, peak acceleration and classifier values. These records are linked to your device id.

Apple App Attest is used to reject fake data: Apple confirms that the app is genuine and unmodified; the server keeps the result and the public part of the key on the device. Community detection is experimental and currently runs in shadow mode; this data is not used to send alerts, only to measure how well the method works.

What stays on your device

The iPhone app asks for your location only while you use it, and uses it to estimate the expected intensity where you are, to find nearby assembly areas and for felt reports. Nearby assembly areas are stored on the phone for offline use. The “I’m safe” message goes through the iOS share sheet to the people you choose; it is not sent to us.

The website uses no cookies. Your browser keeps only your theme choice, a random id for felt reports and, if you turned on alerts, the device id, key and chosen place (local storage).

Technical data

Requests to the site and the server pass through Cloudflare. Your IP address is used in memory for rate limiting to prevent abuse and is not written to the database. The basemap is served from Cloudflare R2, earthquake data from our own server.

Retention and deletion

• Device registration, places, last location, the list of notifications sent, the App Attest attestation, station mode heartbeats and triggers: until the device registration is deleted. Deleting the registration deletes all of them together.
• On iPhone, Settings → “Delete my data” deletes the device registration from the server immediately and clears the places, last location, offline assembly areas and keys on the phone, and ends Live Activities. “Did you feel it” reports are not deleted because they are anonymous cells.
• On the web, turning alerts off on the “Alerts” page deletes your device registration immediately. A browser subscription the push service reports as gone is removed automatically.
• One-time App Attest challenges are valid for 5 minutes; expired ones are deleted within 10 minutes.
• Test triggers and drill simulations: 7 days. A drill record contains the device position rounded to about 100 m.
• “Did you feel it” reports: kept indefinitely at cell level together with the random id the app or browser generated; that id is not linked to your device registration.
• Database backups are kept encrypted in Cloudflare R2. Because of the 30-day recovery window and the base backup that covers it, data of a deleted device can remain in backups for up to about 31 days.
• Server logs are kept for 30 days. Some warning lines can contain a device id; coordinates, push tokens and secret keys are never written to the logs.

App Store privacy label summary

The App Store privacy details of the iPhone app match this policy:

• Precise location: your saved places and, for “Alerts where I am”, your last location; for app functionality, linked to your device id, no tracking. The server rounds places to about 100 m and the last location to about 1 km.
• Coarse location: “Did you feel it” reports on cells of about 0.7 km² (roughly 1 km across); not linked to you.
• Device ID: the app-generated device id and the push token; linked to your device registration.
• Other data: station mode summaries (peak acceleration, a cell of about 5 km²); linked to your device id.
• Not collected: tracking, contact info, diagnostics, analytics.

Data sources

Earthquake data comes from AFAD, Boğaziçi University Kandilli Observatory and Earthquake Research Institute, EMSC and USGS and is shown with attribution. Assembly areas and map data © OpenStreetMap contributors (ODbL), basemap by Protomaps, faults from GEM Global Active Faults (CC BY-SA 4.0).

Children

Deprem is not directed at children and does not knowingly collect personal data from children.

Contact and your rights

You can delete your data yourself: on iPhone with Settings → “Delete my data”, on the web with “Turn off alerts” on the “Alerts” page. For other access or correction requests under GDPR and the Turkish KVKK, contact: via deprem.sayfa.app. Including your device id speeds up the request.

If this policy changes, the new version is published on this page with its update date.