Privacy Policy

App: Smogi – Air Quality Index (UAQI), for iPhone, iPad and Apple Watch
Developer: Mykhailo Monchak
Last updated: October 22, 2026
Contact: contact@smogi.app

1. Overview

Smogi ("the App") shows real-time, historical and forecast air quality for your location. This Privacy Policy explains what data we collect, why we collect it, who it is shared with, and what rights you have. It also covers this website (Section 13).

By using the App, you agree to the practices described in this policy. If you do not agree, please uninstall the App and stop using it.

2. Data We Collect

2.1 Location Data

• What: Your device's GPS coordinates (latitude and longitude).
• When: The App asks for location access only "While Using the App". It never asks for "Always" access and does not track you in the background. iOS may let the App refresh air quality in the background (roughly once an hour, at times iOS chooses). Those refreshes use the location last obtained while the App was open.
• Why: To fetch air quality for where you are.
• On our server: Coordinates are rounded to 3 decimal places (about 100 m) before use. The rounded coordinates are stored in our cache together with the air quality readings for that spot, so that nearby requests can be answered without another lookup. The cache entries hold no device identifier, IP address or account, so they cannot be linked to you. They expire automatically after about 4 days. See Sections 4 and 8.
• If location access is off: The App sends no coordinates. Our server then estimates an approximate location from your IP address (city level) using Cloudflare's network data, so it can still show air quality nearby. That approximate location is handled the same way as above.

2.2 Device Identifiers

• DeviceCheck token: We use Apple's DeviceCheck framework to create a short-lived, anonymous token that proves a request comes from a genuine App installation. It is sent with each request to our server, checked, and discarded. It cannot identify you and is not shared with third parties.
• Advertising Identifier (IDFA): The App asks for permission via App Tracking Transparency (ATT). If you allow it, your IDFA is shared with Meta (Facebook SDK) for ad measurement. If you decline, no IDFA is collected or shared.

2.3 Subscription and Purchase Data

• What: Purchases, receipts and subscription status are handled entirely by Apple through StoreKit.
• We do not receive: your name, payment details or billing address.
• What we keep: whether your subscription is active, stored only on your device. We have no user accounts and do not link your subscription to any personal identifier.

2.4 Crash Reports, Performance Data and Logs

• Provider: Sentry (Functional Software, Inc.). Data is stored in Sentry's EU region (Germany).
• What is collected:
  • Crash reports and error logs: stack traces, device model, OS version and app version.
  • Performance traces and app log messages. Our log messages are written to avoid personal data.
  • Your IP address, which Sentry uses to estimate your country.
  • Session replays: a visual reconstruction of the App's screens for 10% of sessions and for sessions where an error occurs. Text and images are masked by default.
  • For installs that came from an Apple Search Ads campaign, the campaign, ad group and keyword IDs (see Section 2.6).
• Purpose: To find and fix bugs and improve stability and performance.
• Retention: 90 days. See sentry.io/privacy.

2.5 Session Recording and Usage Analytics

• Providers: Smartlook (Smartsupp.com, s.r.o.) and Microsoft Clarity.
• What is collected: recordings of how the App's screens are used (taps, scrolls, screen views), heatmaps, and session details such as device type, OS version and session length. The App has no account system and no text fields for names, emails or contact details, so none are recorded.
• Purpose: To understand how people use the App and improve its design.
• Retention: Per each provider's policy, typically 1–3 months. See Smartlook's privacy policy and the Microsoft Privacy Statement.

2.6 Advertising Attribution

Apple Search Ads.

• What: When the App first opens, it asks Apple's AdServices framework whether the install came from an Apple Search Ads campaign. If it did, the App receives the campaign, ad group and keyword IDs. This does not need ATT permission and contains no personal identifiers.
• Where it is used: These IDs are attached to the crash reports in Section 2.4 and to the analytics events in Section 2.6 (Meta).
• Purpose: To measure which ad campaigns bring people who find the App useful.

Meta (Facebook SDK).

• What is collected: App install and open events, subscription purchase events, and events from the subscription screen (shown, plan selected, purchase started, completed or cancelled). If you allow ATT, your IDFA is included. If you decline, events are sent without it.
• Purpose: To measure the effectiveness of advertising.
• Sharing: Meta may combine this data with data from other Meta products under Meta's Privacy Policy.

2.7 Data Stored on Your Devices

• What: The latest air quality response (readings, forecast, history, health recommendations) and its location.
• Where: On your iPhone or iPad. It is shared with the App's widgets and sent to your paired Apple Watch, so they can show it without a network request.
• Server copy: We keep no server-side copy linked to your device.

3. Data We Do Not Collect

• Your name, email address or any account credentials. The App has no accounts.
• Background location or location history.
• Contacts, photos, microphone or camera data.
• Health or fitness data (HealthKit or similar).
• Data from children, knowingly (see Section 9).

4. Our Backend Service

Air quality data comes from our own backend, which runs on Cloudflare Workers. Each request includes:

• Your rounded GPS coordinates, if location access is on.
• A DeviceCheck token, for request authentication. It is discarded after validation.
• Your plan (free or PRO), which decides how often data is refreshed and whether the forecast is included.
• Your device language code, for localized texts.

Google: Air quality data comes from the Google Air Quality API. Our server sends Google the rounded coordinates and nothing else that could identify you. See Google's Privacy Policy.

Upstash: Our cache of air quality readings (Section 2.1) is hosted by Upstash, Inc. on Upstash Redis.

Cloudflare: All requests pass through Cloudflare's network. Cloudflare processes request metadata (such as your IP address and time of the request) for security, abuse prevention and approximate location (Section 2.1). Our server's request logs, which include the request address and therefore the rounded coordinates, are kept by Cloudflare for up to 7 days. See Cloudflare's Privacy Policy.

5. How We Share Your Data

We do not sell your personal data. Data is shared only with these service providers:

6. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), the United Kingdom and Switzerland:

• Performance of a contract (Art. 6(1)(b) GDPR): showing air quality for your location, and delivering the PRO features you subscribed to.
• Legitimate interests (Art. 6(1)(f) GDPR): server caching, security, crash and performance monitoring, usage analytics, and measuring our Apple Search Ads campaigns.
• Consent (Art. 6(1)(a) GDPR): sharing your IDFA with Meta, only if you allow ATT. Location access is also given through your iOS permission and can be withdrawn at any time.

7. Your Rights

EEA, UK and Swiss residents (GDPR / UK GDPR)

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit how we process your data.
• Objection: object to processing based on legitimate interests.
• Portability: receive your data in a machine-readable format.
• Withdraw consent: at any time in iOS Settings → Privacy & Security → Tracking (for ATT) or → Location Services (for location).

Because we have no accounts and keep no identifiers linked to you, we may be unable to find data that relates to you specifically. Tell us what you need and we will help as far as we can.

California residents (CCPA / CPRA)

• Right to know what personal information we collect, use and share.
• Right to delete personal information.
• Right to opt out of sale or sharing: we do not sell personal information. To stop sharing for cross-context advertising, decline or revoke ATT permission.
• Right to non-discrimination: using your rights will not affect your access to the App.

All users

• Manage or cancel a subscription: in the App Store (Settings → your name → Subscriptions).
• Stop ad tracking: decline or revoke ATT permission in iOS Settings.
• Stop location use: turn off location access for Smogi in iOS Settings. The App will then use an approximate IP-based location (Section 2.1).
• Other requests: email us to opt out of session replay and recordings, or for any other request.

To use any of these rights, contact contact@smogi.app. We will reply within 30 days, or sooner if the law requires.

8. Data Retention

9. Children's Privacy

The App is not directed at children under 13, or under 16 in the EEA where applicable. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact contact@smogi.app and we will delete it promptly.

10. Health Information Disclaimer

The air quality data and health recommendations in the App are for information only. They come from the Google Air Quality API and are not medical advice. Do not rely on them for medical decisions. Consult a qualified healthcare professional about health concerns related to air quality.

11. Security

• All network communication uses HTTPS/TLS.
• DeviceCheck tokens prevent unauthorized use of our server.
• We keep no user database and no accounts.
• Third-party SDKs are integrated following their providers' security guidance.

No transmission over the internet is completely secure. If a data breach affects you, we will notify you as required by law.

12. International Data Transfers

Your data may be processed outside your country, including in the United States, where several of our providers operate. Where the law requires it (for example under the GDPR), these transfers rely on adequacy decisions (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses adopted by the European Commission.

13. This Website

This website is a static site hosted on Cloudflare.

• Cookies: none, and no advertising or tracking scripts.
• Analytics: Cloudflare Web Analytics, which is cookieless, counts visits and pages in aggregate without identifying visitors.
• Request metadata: Cloudflare processes your IP address and request details to deliver the site and protect it from abuse.

14. Changes to This Policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above. For material changes we will, where feasible, also tell you in the App. If you keep using the App after a change, that means you accept the updated policy.

15. Contact

For privacy questions, requests or complaints:

Email: contact@smogi.app
Developer: Mykhailo Monchak

If you are in the EEA or the UK and are not satisfied with our reply, you have the right to complain to your local data protection authority.