Privacy Policy

1. Who we are

PrepperApp (the PrepperApp and PrepAlert apps and the website prepperapp.net) is made by Michael Stuut, an independent developer in Hoorn, the Netherlands. He is the controller of your data within the meaning of the GDPR.

• Name: Michael Stuut (PrepperApp), Hoorn, the Netherlands
• Email for privacy questions: privacy@prepperapp.net

There is no separate data protection officer: your question goes straight to Michael.

2. What data we collect

Account details (name, email address, encrypted password), the data you enter yourself and share with your household (supplies, emergency plan, evacuation plan, home map, emergency contacts, family card), the trips, routes, campsites and logs you save yourself, and technical data needed to make the app work (device type, app version, error reports). We only store location when you share or record it yourself: a shared emergency location (the latest position and at most 30 days of history), live location sharing (positions are deleted afterwards), trips, campsites or log entries you save with a location, and your walks on the website if you turn that on in the app (see 'Walks and trips'). Emergency contacts and family members you enter are other people's data; only enter what is needed. If you buy Pro, we store the purchase number Apple or Google gives us with your account, so Pro works on all your devices and on the website; we don't receive payment details.

3. Signing in with Apple or Google

You can also sign in with Apple or Google. In that case we only receive a fixed, anonymous user ID, your email address (with Apple possibly a relay address if you hide your email) and, if you allow it, your name. We never receive your password and share nothing about your use of PrepperApp with Apple or Google. If you already have an account with the same, confirmed email address, signing in with Google is linked to it.

4. Encryption

End-to-end encrypted (only your devices and the recipient's can read it, we can't): chat messages in the current chat version, the family chat, routes you share between accounts, the places on Our map, live location and buddy location. If encryption is on for your household (this happens automatically once every member has the new app and there is a recovery code), also: your supplies, water storage, shopping list, your household's goal and maintenance, the emergency plan with emergency contacts, the evacuation plan, the home map, your equipment (energy, fuel, survival kits), the family card, a shared emergency location, your family status and messages with 'Are you safe?'. For a meeting point our server then only sees the location to about 1 kilometre, so we can warn you about danger there. What our server still sees: who is in your household, how much there is, when something changed and the order and grouping of entries (such as the floor on the home map or which meeting point comes first). If your account has its own key (this happens automatically in the new app), your damage file is encrypted with it: only your devices and a linked browser can read it. If encryption is not (yet) on for your household, this data is readable by our server; the family card, emergency location and family status then use a key derived from your household that our server can create. A call for help always goes out, even if it briefly can't be encrypted. The trips you save are end-to-end encrypted if your account has its own key (this happens automatically in the new app), also when you share them with another account; with a share link the key is in the link itself, after the # sign, and that part never reaches our server. Without your own key, our server can read them. For routes, the iPhone app still has an older path via Apple iCloud that is not end-to-end encrypted; it is used when a recipient cannot be reached through an account or sharing via our server fails, and when you share a whole journey with someone on iPhone. Older chat messages from before the current chat version use a key that follows from the conversation; our server could in principle read those, and they are deleted after 90 days. You can still read them, but new messages only go through the current chat version. Medical details (allergies, medication, conditions) are not sent to the server with the family card: the app leaves them out (and the server also removes them from an older, readable card), and keeps only the latest version of the card. Your medical profile, medication, document vault, financial prep, diary, sleep log, tick bite reports and the policy number in your damage file are kept only on your phone and are no longer sent to our server; we delete any older copy on the server after a short transition period. On Android, what is kept only on your phone is included in the Android backup in your own Google account, if you have that backup turned on; the document vault is not included. When data is switched to encrypted, the server keeps the old readable version for a short while as a backup and then deletes it: for what you share with your household after 7 days, once a device has checked that everything opens; for your own trips, walks and damage file after 30 days.

5. Walks and trips

Walks on the website: this is off until you turn it on yourself. If you turn on 'Walks on the website' in the app, the app sends every recorded walk to our server so you can view it on prepperapp.net. What is sent: the line you walked without the first and last 200 metres, the elevation per point, the name, the type of activity, the date with start and end time, distance, duration and ascent, the place and country, the journey the walk belongs to (name and dates) and your markers (type, note and time). What is not sent: photos, day notes, overnight stays, the time per point, and markers within 200 metres of the start or the end or without a location. If your account has its own key (this happens automatically in the new app), this data is end-to-end encrypted with it: only your devices and a linked browser can read it, our server can't. Without that key our server can read it. Only you can see it when you are logged in; we share it with no one and there is no public link. You can remove it whenever you want: per walk or everything at once, on the website (Dashboard › Outdoors › Walks) or from the app. We keep it until you remove it or delete your account. Trips: journeys (trips) you record in the app are sent to our server automatically when you are logged in, with the name, the dates, a short description of the area, the distance, the ascent and the number of nights, and the route rounded to about 1 kilometre. If your account has its own key (this happens automatically in the new app), all of this is end-to-end encrypted and our server can't read it; without that key it can. You can remove a trip on the website (Dashboard › Outdoors › Trips); after that our server no longer stores it, even if the app sends it again. Sharing with your family: from version 3.5, 'Share my walks with my family' is a setting in the app (Settings › Account and privacy). When it is on, the whole track of every walk you record, including the start and end, goes to the members of your household, with its name, your note and your markers. If you already used the app, it is on, as it was before; if you are new, you choose yourself and nothing goes to your family until then. If you turn it off, new walks are no longer shared; what has already been shared stays with your family. Let family follow along: this is off until you turn it on for a trip yourself. If you do, our server creates a secret link (prepperapp.net/volg/…) that you send to others yourself. Anyone with that link can then see, without an account: the name and dates of the trip, your first name, the stops (place rounded to about 1 metre, town, country, dates, nights and your note), the line of your trip, the distance, your last known location and up to 100 reduced photos. This data is not end-to-end encrypted: our server can read it. Search engines do not index the page. You can stop at any time with 'Stop sharing'; the link then stops working and we delete everything from our server immediately. Anyone with the link can leave a heart or a short message (up to 200 characters) under a name of their choice; these are visible to everyone with the link and you can delete them in the app. We don't store an IP address with a message, only an encrypted code that changes every day, to limit abuse. Visitors can turn on a notification for a new stop or when you've arrived safely; for that we keep that browser's notification address with this trip until the notification is turned off or sharing stops.

6. PrepAlert and warnings on the dashboard

PrepAlert is our app for official warnings. It works without an account; what the app does with your data then is described in the PrepAlert privacy policy.

If you sign in to PrepAlert with your PrepperApp account, this privacy policy also applies to that account. We then store which devices are linked to your account (the kind of device and when it was last active) and, if you turn it on in the app, a backup of your PrepAlert places (name and location), settings and family groups (group name and code). We also link the installation number of that PrepAlert app to your account, so we can see per device whether it has PrepAlert Pro.

With PrepperApp Pro, your dashboard shows the warnings for your own places: the places from that PrepAlert backup, the meeting points from your emergency plan and places you add on the website. The latter are stored only in your browser. To fetch warnings, the website only sends a location rounded to about 1 km to our warning service, without saying who you are.

7. Where your data is stored

Our servers run with a European hosting provider, within the EU. We show no ads, do not share data with advertisers and do not sell data to third parties. Our hosting provider is STRATO (Germany, EU), the same company we use to send email.

8. Recipients and processors

Some features send data to other services. We send email (password resets, invitations, replies to the contact form) via STRATO. Push notifications go through Apple (iPhone) and Google Firebase (Android); a notification contains a short text and sometimes the name of a household member. Purchases go through the App Store or Google Play. The iPhone app can also share your household via Apple iCloud. Maps: on the website the map tiles come from our own server, so OpenStreetMap does not see your IP address; the map data is © OpenStreetMap contributors. If you look up an address, postcode or place on the website, our server forwards only that search text to PDOK (the Dutch government's address service) and/or Photon (Komoot, based on OpenStreetMap); they do not see your IP address, and we do not store the search text. In new versions of the app, the tiles of the app's own map also come from our server; older versions still fetch them directly from OpenStreetMap, which then sees your IP address. The topographic map in the app comes from OpenTopoMap; that service sees your IP address and which part of the map you are viewing. Some map screens use Apple's map (iPhone) or Google Maps (Android); Apple or Google then sees your IP address and which part of the map you are viewing. Weather: from version 3.5 of the iPhone app and version 1.3 of the Android app, the app asks our server for the weather, and our server gets it from Apple Weather. Your location, rounded to about 1 km, the language, the time zone and the country are sent along; Apple does not see who you are or your IP address, and we do not keep track of who asked for which location. If our server cannot be reached, the app asks the Norwegian weather institute MET Norway directly, which then sees your IP address and that rounded location. Older versions of the app get the weather from Open-Meteo, which sees your IP address and the location. Air quality comes from Open-Meteo in all versions. The weather per stop of a trip (from version 3.8 of the iPhone app and 1.4 of the Android app) also comes from Open-Meteo, with the stop's location rounded to about 1 km and the date; Open-Meteo then sees your IP address. Elevation: if a route has no elevation data and you open the elevation profile, the app sends about 50 points of that route, including the start and end, to open-elevation to fetch the elevation. Places nearby: when you have a route generated, the app asks Overpass (a search service for OpenStreetMap) which places are nearby, sending the centre and radius of that area; for the elevation profile, the area around the route is sent to fetch the surface type. Place name: to show a place name or country (the starting point of a recorded route, your location for weather and alerts) or to look up the address of a meeting point, the iPhone app sends that location or address to Apple; on Android this goes through your phone's place-name service, usually Google's. Product information when you scan a barcode, route planning (start and end point, via Geoapify) and alerts go through small helper services of ours at Cloudflare. AI questions: see 'AI questions (Google Gemini)'.

9. AI questions (Google Gemini)

The apps first use the AI on your own device; nothing goes to us or anyone else. If that isn't available, the app can send your question via our server to Google Gemini. From version 3.5 of the iPhone app, and in the Android app, this only happens after you have given permission in the app; without your permission no AI question goes to our server or to Google. You can undo your choice in the app.

What is sent: your question and limited context, such as your emergency kit, route or the number of people in your household, but never your name, email address or account. From that version on, the app also never adds the names and dosages of your medication (what you type in your question yourself is sent). The medical assessment is never sent to Gemini, and the coach gets no personal data in the cloud (no supplies, family or trips). We do not store AI questions.

We use the free version of Gemini. Under its terms, Google may keep what you send, have it reviewed by people and use it to improve its services and AI models. So don't type anything in your question that you don't want to share with Google. We ourselves never use your data to train AI models. The website does not send questions to any AI service.

10. Transfers outside the EU

Our own servers and backups are in the EU. Some recipients are also outside the European Economic Area, mainly in the United States:

• Apple: push notifications, iCloud, Sign in with Apple, maps, place names and the App Store.
• Google: push notifications (Firebase), Sign in with Google, Google Play, place names on Android and Gemini for AI questions.
• Cloudflare: our small helper services for product information, route planning and warnings.

These companies take part in the EU-US Data Privacy Framework; the European Commission has decided that data is adequately protected under it. Where that does not apply, they use the European Commission's standard contractual clauses. If an app contacts another service from 'Recipients and processors' directly, that service sees your IP address; it may also be outside the EU.

11. Why we may do this (legal bases)

The GDPR only allows personal data to be used with a valid reason, a legal basis. Per processing activity:

• Your account, what you store in the apps and on the website, sharing with your household, chat, push notifications, Pro and the PrepAlert backup: needed to provide the service you use (performance of a contract, Article 6(1)(b) GDPR).
• What you turn on yourself, such as location sharing, walks on the website, letting family follow along, browser notifications and the newsletter: your consent (Article 6(1)(a)). You can withdraw it at any time by turning it off again or unsubscribing.
• AI questions via our server to Google Gemini: your consent (Article 6(1)(a)), which the app asks for first.
• Anonymous usage statistics, the website's visitor count, log files, security and preventing abuse, and moderating the community: our legitimate interest in a safe service that works and keeps improving (Article 6(1)(f)). You can object to this.
• Your question via the contact form or by email: our legitimate interest in being able to reply (Article 6(1)(f)).
• What the law requires us to keep, such as our accounts: a legal obligation (Article 6(1)(c)).

Health data, such as your medical profile and medication, stays on your phone; we do not process it on our server. The server also strips medical data from the family card.

12. Cookies & local storage

The website uses no cookies for tracking or advertising, and no services from Google Analytics, Facebook or other ad networks. In your browser we only keep what's needed for the site to work: a login token so you stay signed in, your language and display preferences, small settings such as a collapsed list or 'don't ask about notifications again', the key for your encrypted chat and your chat contacts (name and code; these stay in this browser after you log out so you don't lose them). After linking with your app, your browser also keeps your own encryption key (stored encrypted with a key the browser doesn't let anyone read out) and, if you opened an invitation link, briefly the secret from that link (at most 14 days). Both are cleared when you log out. To see how often pages are viewed, we count visits anonymously on our own server: your browser gets a random number per tab that disappears when you close the tab, for this count we don't store your IP address (only the country derived from it) and we share nothing with third parties. Fonts are served from our own server. Map tiles also come from our own server, no longer directly from OpenStreetMap, so OpenStreetMap does not see your IP address (the map data remains © OpenStreetMap contributors). Because we only use necessary storage and anonymous statistics, no consent banner is needed. If you choose a country for the emergency number on the dashboard, that choice is also stored only in your browser. The visitor count only counts on prepperapp.net itself and never sends secret parts of an address: a follow, family, share or invitation link is counted without the code in it (for example as '/volg/:token'), and query parameters are never included. If you're logged in, the website also keeps an encrypted copy of your most recently loaded dashboard data in your browser, plus the site's own files (code, styling and the first-aid guides), so the dashboard and first-aid steps open without internet too. That copy stays on this device, isn't sent to us or anyone else, and is deleted when you log out.

13. Log files

Our web server keeps a log to detect outages and abuse. It contains a shortened IP address (for IPv4 without the last number, for IPv6 only the first part), the time, the type of request and a shortened path, without search parameters, invitation codes or IDs. During an outage the web server's error log may contain a full IP address. We keep both for 7 days. The logs of our app server contain no email addresses, IP addresses, locations or content of your data. To limit abuse we briefly use your IP address in memory (for example for a maximum number of login attempts per minute); it is not stored.

14. How long we keep data

Account details and what you keep in the app: until you delete it yourself or delete your account; we then delete it from our server immediately (it can remain in backups until those are cleaned up, see the end of this paragraph). What is on your phone itself stays there until you delete the app (iPhone) or have it wiped in the app (Android: the app asks this after you delete your account). Messages and posts in the community remain under 'Deleted account'. Walks on the website and trips: until you remove them or delete your account. Expired login sessions: 30 days after expiry (of your latest session we only keep platform and time, for 'last active'). Password reset and email confirmation links: 1 day after use or expiry. Family card: only the latest version. Family status: 30 days, except the latest per person. Shared emergency location: 30 days, except the latest. Live location: positions are deleted afterwards. Data of a household without members: 30 days. Anonymous usage statistics: 90 days (purchases per country, without personal data, longer). Web server log files: 7 days. Chat messages: 90 days; messages older than 90 days are deleted from the server. The Android app keeps messages that are already on your device itself; the iPhone app and the website only show what is still on the server, so older chat history disappears there. Emergency alerts (SOS) and buddy alarms: 90 days after the alert and the last response to it; an activated emergency plan: 90 days after you end it (it stays as long as it is active). Contact form messages: 1 year after the last message or reply. Your newsletter subscription: until you unsubscribe, via the unsubscribe link at the bottom of every newsletter. Backups on our server are deleted automatically after 30 days; only the two most recent backups of each kind are kept as a fallback until newer ones exist. A trip you let others follow ('Let family follow along'): until you stop sharing, or automatically one year after the last update. PrepAlert backup and linked devices: until you delete them or your account; for PrepAlert without an account, see the PrepAlert privacy policy. The Pro purchase number: as long as your account exists.

15. Your rights

Under the GDPR you have these rights:

• Access: to know what data we hold about you and get a copy.
• Rectification: to have incorrect data corrected. You can change a lot yourself in the app or on the website.
• Erasure: to have your account and data deleted. You can do this yourself in the app (Settings › Account & privacy › Delete account); see also Delete account.
• Restriction: to have processing limited for a while, for example while we look into your request.
• Portability: to receive your data in a common file format (JSON). You can do this yourself on the website: Your account › Download your data (at most 3 times an hour). What is stored encrypted on our server stays encrypted in that file. If that doesn't work for you, email us and we'll send you the files.
• Objection: to what we do on the basis of our legitimate interest, such as the statistics.
• Withdrawing consent: for anything based on your consent, such as AI questions to Gemini, location sharing or the newsletter. What has already happened remains lawful.

Email your request to privacy@prepperapp.net, preferably from your account's email address, so we know it's you. We reply within one month. We make no decisions about you that are taken solely by a computer (no automated decision-making or profiling).

Unhappy with how we handle your data? Let us know first, and we'll look for a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the data protection authority of the country where you live.

16. Children

You must be at least 16 to create an account yourself. Younger family members can be added through the household of a parent or guardian; that parent or guardian decides what data about the child is entered.

17. Changes

If we change this privacy policy, you'll see it from the date at the top. For an important change we'll also let you know in the app or by email. This policy is written in Dutch; if a translation differs, the Dutch text applies.

18. Contact

Questions about this privacy policy or your data? Email privacy@prepperapp.net or use the contact form.