MAP-ALERTSPrivacy Policy
Website map-alerts.live, the MAP-ALERTS Android app and the Telegram bot @mapalertsua_bot · version 2.0, effective 21 October 2026
Contents:
- General provisions
- Controller and contact
- Processing principles
- What data, why, on what basis, for how long
- Location
- Android app permissions
- Recipients
- International transfers
- Security
- Retention and deletion
- Your rights
- How to exercise your rights
- Children
- Cookies and local storage
- Automated decision-making
- Changes to this policy
1. General provisions
1.1. This Privacy Policy explains what personal data is processed when you use the website map-alerts.live, the MAP-ALERTS Android app and the Telegram bot @mapalertsua_bot (together, the “Service”), for what purposes, on what legal basis, to whom it may be disclosed, how long it is kept and what rights you have.
1.2. Processing is carried out in accordance with the Law of Ukraine “On Personal Data Protection” No. 2297-VI (the “Law”) and, for users located in the European Union or the European Economic Area, Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) where it applies.
1.3. The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “consent” have the meanings given in the Law and the GDPR. Anonymous and aggregated data that cannot identify a person is not personal data.
1.4. The Service provides reference information from open sources and is not an official warning system. Features that require your consent are enabled only after a separate confirmation in the interface.
2. Controller and contact
2.1. The controller of personal data is the developer and owner of the MAP-ALERTS service named as the developer on the app’s Google Play listing (“we”, the “Controller”).
2.2. For any question about data processing or to exercise your rights, contact us via:
- Telegram bot @mapalertsua_bot (commands /privacy, /delete, or a message)
2.3. We have not appointed an EU representative or a Data Protection Officer, as the scale and nature of the processing do not require it; all requests are handled by the Controller directly.
3. Processing principles
- Data minimisation: we process only the data a feature cannot work without; precise coordinates are never sent to the server.
- Purpose limitation: data is used only for the purposes in section 4 and is not combined with data from other sources.
- Storage limitation: data is kept no longer than necessary (section 10) and deleted automatically.
- Transparency and control: features that send data to the server can be turned off by you at any time.
- No commercial use: no ads, no sale of data, no profiling, no advertising identifiers (Advertising ID) and no third-party analytics SDKs.
4. What data, why, on what basis, for how long
4.1. Data that stays on your device
Settings (theme, map layers, target types, voice, siren), the “Near me” point with precise coordinates, radius, saved shelters and offline map, the latest received target and alert data, the event log. This data is kept in the browser’s or app’s local storage, is not sent to us and is not processed by us. You can delete it by clearing site data in your browser, using “Clear storage” in Android app settings, or uninstalling the app.
4.2. Data received by the Service’s server
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Notification subscription (only if you consent and turn notifications on): delivery token (Firebase Cloud Messaging in the app or the browser’s Web Push subscription), a point rounded to ~1 km on the device, radius, selected target types, data source, quiet-hours settings, an “app” flag, the list of available voice sounds, an invite-link code (if you arrived via one), subscription creation and update dates | Sending notifications about aerial targets near the chosen point and air-raid alerts in your area, including when the Service is closed | Your consent (Art. 11(1)(1) of the Law; Art. 6(1)(a) GDPR), given in a confirmation dialog before notifications are enabled; withdraw it by turning notifications off | While notifications are on. Turning them off deletes the subscription immediately; it is also deleted automatically once the delivery service reports the token invalid (app uninstalled, permission revoked) |
| Technical request data: IP address, browser/OS type and version (User-Agent), request time | Delivering data to your device, protection against overload and abuse (rate limiting), filtering automated traffic, security | The Controller’s legitimate interest in operating and securing the Service (Art. 11(1)(6) of the Law; Art. 6(1)(f) GDPR) | Held by the Service’s server in memory only (minutes) and not written to logs. The content delivery network (section 7.1) may keep short-term technical logs under its own rules |
| Anonymous usage statistics: categories from a closed list — new or returning visit (determined by the device itself), referral source category (e.g. “search”, “Telegram”), interface language, screen size (small / medium / large), device type (phone / desktop), OS and browser family, website or app, theme, notification permission state, time on screen, which features were used | Understanding load and feature usage to improve the Service | Legitimate interest (Art. 11(1)(6) of the Law; Art. 6(1)(f) GDPR) | The server receives and stores no identifiers, IP addresses, page URLs or coordinates: categories are added to daily totals immediately. Aggregated counters — up to 400 days |
| “Online now” counter: a random pseudonymous identifier of the tab or app (not linked to a person, device or account) | Counting concurrent visitors to monitor load | Legitimate interest (Art. 11(1)(6) of the Law; Art. 6(1)(f) GDPR) | In server memory only, no longer than a few minutes after the last activity; never written |
| Invite links: the code of the link you arrived through | Knowing which posts bring visitors | Legitimate interest | Aggregated daily counters per code only, up to 120 days; no visitor identifiers |
| Requests to us: your email address or Telegram account and the content of the request | Handling and answering the request, fulfilling your rights | Legitimate interest and the Controller’s obligations under the Law / GDPR (Art. 6(1)(c), (f) GDPR) | Up to 12 months after the request is closed |
4.3. Telegram bot @mapalertsua_bot
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Telegram chat ID, name and @username (provided by Telegram to any bot you start), the chosen zone — regions, a city or a point with a radius rounded to ~1 km — notification settings, invite-link code, start and update dates | Sending target and alert notifications for your zone; user support and abuse prevention (service messages to the administrator about new users and data deletions) | Your consent and performance of the service you requested (Art. 11(1)(1), (5) of the Law; Art. 6(1)(a), (b) GDPR) | Until deleted with /delete or on your request. The zone point is deleted automatically if you block the bot or do not enable notifications within a month. /stop only turns notifications off |
The bot does not ask for your phone number, contacts or any other data and keeps no location history. Messages in Telegram are also processed by Telegram under its own privacy policy.
4.4. What we do not collect
Names, phone numbers, email addresses (except in requests to us), photos, contacts, files, payment data, advertising identifiers, location history, background location, health data or other special categories of data (Art. 7 of the Law; Art. 9 GDPR). The app does not send crash reports or diagnostics.
5. Location
5.1. The Service determines your location only after your action (the “My location” button) and with operating-system or browser permission; you can also pick a point on the map manually without granting permission. Distance to targets, “heading your way” and nearby shelters are calculated on the device.
5.2. A point is sent to the server only for notifications, after your separate consent, and is rounded to 0.01° (about 1 km) on the device (for the Telegram bot — on the bot’s server before storage), so it reveals an area, not an address. Only the latest point is stored, with no history. The point is updated only when you change it yourself (via “My location” or on the map).
5.3. Location is never determined or tracked in the background; the app does not request background location permission. You can revoke location permission at any time in Android or browser settings.
6. Android app permissions
- Location (precise and approximate) — to determine your point on request (section 5). Optional.
- Notifications — to show target and alert notifications. Optional.
- Ignore battery optimisation — requested only after your action in “Notification reliability”, so the system does not delay urgent notifications. Optional.
- Internet, vibration, keep screen on — receiving data, signals, voice announcements while moving.
7. Recipients
7.1. The following service providers (processors, or independent operators of their own services) process data only to the extent needed for their function:
- Google (Firebase Cloud Messaging) — delivering notifications to the app: device token and notification text.
- Browser Web Push services (Google, Mozilla, Apple, Microsoft — depending on your browser) — delivering website notifications: subscription endpoint and encrypted payload.
- bunny.net content delivery network (BunnyWay d.o.o., Slovenia, EU) — delivers pages and data, protects against attacks; processes technical request data.
- Hosting provider — provides the server the Service runs on; has no access to data for its own purposes.
- OpenStreetMap Foundation / OpenStreetMap France — raster base map (if chosen, or when the vector map is unavailable). In the app, map tiles are loaded through our server, so these services do not see your IP address; on the website your browser may load them directly.
- Google Fonts — website fonts (your browser loads them from Google servers, which see your IP address and browser type).
- OpenFreeMap and jsDelivr — the vector base map (default; another base map can be chosen in settings): map tiles and the MapLibre library are loaded by your browser or the app directly from these services, which see your IP address and browser type.
- Telegram — operation of the bot.
- Google Play — app distribution; Google processes installation data under its own policy.
7.2. We do not sell personal data, do not “share” it for cross-context behavioural advertising and do not disclose it to third parties for advertising, marketing or profiling.
7.3. Data may be disclosed to public authorities only where and as expressly required by law, on the basis of a properly issued request or court decision, and only to the minimum extent necessary. Owing to data minimisation (section 3) we hold no data that would identify you or your address.
7.4. Target and alert data is obtained from open sources (including NEPTUN, mapa.ua and monitoring channels); none of your data is sent to them.
8. International transfers
Some providers in section 7 process data outside Ukraine, including in EU member states and the United States. Such transfers comply with Art. 29 of the Law — to states ensuring adequate protection of personal data, or based on your consent or necessity for the service you requested — and, for EU users, rely on safeguards under Chapter V GDPR (adequacy decisions, including the EU–US Data Privacy Framework, or standard contractual clauses).
9. Security
- All connections to the Service are encrypted (HTTPS / TLS); Web Push payloads are additionally end-to-end encrypted.
- Only the Controller has access to the servers and data; the administrative interface is not reachable from the internet.
- Access keys and service credentials are stored separately from the code with restricted permissions.
- Backups are access-restricted and used only for recovery from failures.
- Data minimisation and point rounding limit the impact of any possible incident.
No method of transmission or storage is completely secure. In the event of a personal data breach we will take steps to mitigate it and notify the Ukrainian Parliament Commissioner for Human Rights, the competent EU supervisory authority and/or you where and within the time limits required by law.
10. Retention and deletion
- Notification subscription — while notifications are on; turning them off deletes it immediately (4.2).
- Telegram bot data — until /delete or your request; the zone point — automatically after the bot is blocked or after a month without notifications enabled (4.3).
- Technical request data and the “online” identifier — in memory only, minutes.
- Aggregated statistics — up to 400 days; invite-link counters — up to 120 days (no personal data).
- Requests — up to 12 months after closure.
- Backups are refreshed automatically; deleted data disappears from them on the next refresh, and from archived copies no later than 30 days.
11. Your rights
11.1. Under Art. 8 of the Law you have the right to: know the sources, location and purpose of processing of your personal data and the location of the Controller; receive information on access conditions and on third parties to whom data is disclosed; access your data; receive an answer on whether your data is processed, and its content, within 30 calendar days; submit a reasoned objection to processing; demand rectification or destruction of data processed unlawfully or that is inaccurate; protection against unlawful processing, accidental loss, destruction or damage; withdraw consent; know how automated processing works; protection against automated decisions with legal effects; and lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or a court.
11.2. Where the GDPR applies, you also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21), withdrawal of consent at any time without affecting the lawfulness of prior processing (Art. 7(3)), and the right to lodge a complaint with the data protection supervisory authority of the EU member state of your residence, workplace or alleged infringement.
12. How to exercise your rights
- Withdraw consent and delete the notification subscription — turn notifications off in the Service (immediate deletion) or uninstall the app.
- Delete Telegram bot data — command /delete; to see what the bot stores — /privacy.
- Delete data on your device — clear site data in the browser or the app’s storage in Android settings.
- Other requests (access, copy of data, objection) — via the contacts in section 2.
As the Service has no accounts, we can locate your data only by a technical identifier: for the bot, send your request from the same Telegram account; for notifications, the in-app control is the simplest way. We do not ask for identity documents beyond what is necessary to confirm the request concerns your data. We respond free of charge within 30 calendar days (for GDPR requests — within one month, extendable as provided by Art. 12(3) GDPR).
13. Children
The Service is not directed at children and is not intended for persons under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us (section 2) and we will delete it.
14. Cookies and local storage
The Service does not use cookies for advertising or tracking and sets no third-party cookies. Browser or app local storage is used for your settings and offline use (4.1), and for the random “online” counter identifier and “first visit of the day / week / month” flags, from which the server counts only aggregated totals (4.2). You can clear storage at any time.
15. Automated decision-making
The Service automatically selects which notifications to send based on the distance and type of a target relative to the point you chose. This is not automated decision-making producing legal or similarly significant effects (Art. 22 GDPR) and is not profiling.
16. Changes to this policy
We may update this Policy as the Service or the law changes. The current version, with its date, is always available at https://map-alerts.live/privacy/en. We will announce material changes — in particular new data categories or purposes — in the Service before they take effect and, where processing is based on consent, ask for it again.
This Policy is drawn up in Ukrainian; this English translation is provided for convenience. In case of discrepancy, the Ukrainian version prevails.