Privacy Policy

1Who we are

Stopzone is operated by Shreyas Garehatti Sridhara, a sole proprietor (“Stopzone”, “we”, “us”, “our”), of Sri Krupa, 3rd Cross, 2nd Phase, Davalagiri Badavane, Chitradurga, Karnataka 577501, India. We are the controller of the personal information described in this notice.

Contact: support@stopzone.app

Uniqron is the trading name under which that sole proprietorship publishes its software. It is not a separate company and not a separate controller; you may see it on your receipt from Apple.

We have not appointed a Data Protection Officer, and are not required to: our core activities do not consist of large-scale regular and systematic monitoring, and we process no special-category data.

2How Stopzone works, and what this notice covers

Stopzone is a proximity alarm. You pick a stop, the app stores that stop’s name and coordinates on your phone, and while a session is running the app compares your position to that stop and rings an alarm when you get close. Every part of that calculation happens on the device.

The alarm needs no network at all. Between the moment you tap Start and the moment it rings, nothing the alarm depends on requires a connection — a hard architectural requirement, because an alarm that depends on a connection is an alarm that fails in a tunnel. The app works identically in a tunnel, in aeroplane mode, and with no signal. If you have agreed to analytics, the app may send the events described in section 7 while a session happens to be running; those events carry no stop, no coordinate, and no distance, they play no part in the alarm, and none of them is sent at all if you decline. The consequence for your privacy is that we could not build a profile of your movements even if we wanted to, because the data never arrives.

This notice covers the Stopzone iOS app, including its widgets, Live Activity, and Shortcuts/Siri actions; the site at https://stopzone.app; and support correspondence.

It does not cover Apple’s handling of your Apple Account, your purchase, your device backups, or the Maps search described in section 8 — Apple is an independent controller for those, see Apple’s Privacy Policy — nor your mobile network operator, nor any third-party site we link to. Your use of the app is also governed by our Terms and Conditions.

3What stays on your device

The following is stored in the app’s private container on your iPhone. None of it is sent to us, to our backend, or to any processor.

Two consequences worth stating plainly:

• If you delete the app, this data is gone. We hold no server-side copy and cannot restore it. If you use iCloud or encrypted device backups, Apple may retain a copy under Apple’s terms.
• We cannot produce this data in response to a request, because we do not have it. You hold the only copy.

4What you give us directly

There is no sign-up, so in ordinary use you give us nothing. The exceptions:

The app’s “Contact support” button pre-fills an email from a fixed allow-list containing only your Support ID, the app and build version, your iOS version, and a short entitlement status string. It contains no stop name, no coordinate, and no text you have written elsewhere in the app.

About the Support ID. It is an eight-character code shown in Settings, derived by hashing the anonymous identifier your subscription belongs to. Ambiguous characters are excluded so it can be read aloud. It reveals no part of the underlying identifier, and it is not a credential — no part of our system accepts it as proof of anything.

It is also short, which means two subscribers could in principle be issued the same one. So we treat it as sufficient only for requests that cannot expose or destroy anything. To disclose the contents of your record, correct it, or delete it, we also need the Apple transaction identifier from your receipt. If a Support ID matches more than one record, we act on none of them and ask for the transaction identifier instead.

4.1 Whether you have to provide this information

5What our backend stores

Our backend runs on Convex and holds three things. This is all of them.

Your subscription record. One per subscriber, and the only user-linked data we hold anywhere. It contains the anonymous identifier your subscription provider generated for your install (not an email, not a device ID, not an advertising identifier), a stable equivalent that survives reinstalls, your Support ID, whether the subscription is active, which product was purchased, when the current period ends, and timestamps we use to apply events in the right order. There is no name, no email address, no device information, and no location in it.

Our remote configuration. A single document, identical for every user, holding paywall and onboarding settings, defaults, feature switches, and the analytics allow-list. It contains no user data. Your app fetches it over HTTPS with no identifier attached, and the endpoint accepts no parameter that could select one user’s data over another’s, because there is none to select.

Rate-limiting counters. To stop someone hammering our endpoints, we count requests in fixed windows against a hashed key. We do not store raw IP addresses, and the hash is not reversible into one. Rows are deleted automatically 24 hours after their window closes.

What we do not have. There is no store of stops, coordinates, sessions, or telemetry of any kind. Adding one would require a data protection impact assessment and an update to this notice. Analytics travel from the app directly to Mixpanel and Firebase (section 7); they never pass through our backend.

Server logs. Convex and Vercel process connection metadata, including IP addresses, transiently in order to serve requests. Our own logging is restricted to an event identifier, an event type, a status code, and a latency figure. We do not log request bodies, tokens, or identifiers in plain text.

6Device permissions

We never request Always location authorization. The key is absent from the app entirely. Stopzone cannot track you in the background when you have not started a session, because it never has permission to.

We do not use Bluetooth beacons, Wi-Fi scanning, motion data, the advertising identifier, or App Tracking Transparency, because we do not track you across other companies’ apps or websites.

7Analytics and crash reporting

We ask first. Analytics and crash reporting are off until you agree. We ask once, in a plain prompt separate from any other choice, with refusing presented as readily as accepting. Until you agree, nothing in this section is sent and the Mixpanel and Firebase SDKs are not initialised. You can change your answer at any time in Settings → Privacy, and withdrawing is as easy as giving. Our legal basis is your consent (section 10).

Every event is a name drawn from a closed list compiled into the app, optionally carrying enumerated values or booleans. With one exception, our analytics cannot carry free text, because there is no free-text field to put it in — the exception is the optional referral code below. The events fall into four categories:

Three things worth stating plainly:

• The referral code is the one thing you type that our analytics can send. It is a short code that passed a character-and-length check on your device; input that fails the check never leaves your phone, and if you skip the field nothing is sent.
• Session events carry the mode and the outcome, and nothing else. Which stop you chose, where it is, how far away you were, and how long you travelled all stay on your phone.
• Not every event is switched on, and our configuration can only ever mute events — it cannot invent one, because the list is fixed in the app’s source code.

The complete list of event names is available on request at support@stopzone.app.

The identifier attached to these events is your anonymous subscription identifier. It is not your name, email, phone number, Apple Account, or advertising identifier. Mixpanel and Firebase also derive device model, OS version, app version, locale, and a coarse IP-derived country or region. We do not send them a precise location and have enabled no feature that would collect one.

Crash reporting. With your consent, Firebase Crashlytics receives crash and non-fatal error reports containing a stack trace, device model, OS version, and app version. Our logging is redacted by default: no location, no stop name, no entitlement token, and no Support ID may reach a logger.

We never send: coordinates, stop names, or any text you have written other than an optional referral code.

8Third parties who process data for us

Searching for a stop is the one action in the app that sends anything location-shaped off your device, and it goes to Apple, not to us. When you type into the stop search, iOS sends your query — and, if we know it, a roughly city-sized region to bias results — to Apple. When you drop a pin or use your current location, iOS sends that coordinate to Apple to get back a name. We do not receive the query, the region, the coordinate, or the result, and none of it appears in any analytics event. Once a stop is saved, no further network call is made for it, including during the session that wakes you. If you would rather not use search, drop a pin manually.

We also disclose information when we must: under valid legal process; to prevent an imminent threat to someone’s life or safety; and, if Stopzone is ever sold or merged, subscription records would transfer, and we would tell you first.

We do not sell your personal information, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising or automated decision-making producing legal or similarly significant effects.

9What we never collect

We do not collect, receive, store, or transmit:

• your GPS coordinates, past or present;
• the names or addresses of your stops;
• your journey history, routes, travel times, or arrival times;
• your home or work address;
• your name, email address (unless you write to us), postal address, or phone number;
• your contacts, calendar, photos, camera, microphone, or health data;
• your advertising identifier, or any cross-app or cross-site tracking identifier;
• your payment card details;
• audio from your device — the voices are pre-recorded clips shipped inside the app;
• any free text you type in the app, with the single exception of an optional referral code (sections 4 and 7).

10Why we process information, and our legal bases

If you are in the EEA, the UK, or Switzerland:

Why analytics rely on consent. Analytics and crash reporting involve storing and reading information on your device that is not strictly necessary to deliver the service you asked for. Section 25(1) TDDDG, implementing Art. 5(3) ePrivacy, permits that only with consent — there is no legitimate-interests route through it. Rather than run one rule in Germany and another elsewhere, we ask everyone. Withdrawing consent stops further collection immediately and does not affect what came before; to delete what was already collected, see section 13.

Where we rely on legitimate interests we have balanced them against your rights, principally because the information is not identifying and is minimised by design. You may object at any time.

We process no special-category data under Art. 9 GDPR. The rested-minutes figure is arithmetic on sessions you generated; it is not a health measurement and we make no medical or wellness claim.

11International transfers

We operate from India; our processors operate principally from the United States and, in some cases, the European Union. If you are in the EEA, the UK, or Switzerland, your information may therefore be transferred outside your region. Where it is, the transfer relies on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum where the UK GDPR applies), incorporated into our agreements with each processor in section 8. Given the categories involved — an anonymous subscription record and analytics events that carry no content beyond an optional referral code — the impact is inherently limited. You may request a copy of the safeguards by writing to support@stopzone.app.

12How long we keep information

When we no longer have a lawful basis to keep something, we delete it or isolate it from further processing until deletion is possible.

13Your privacy rights

Depending on where you live you may have rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and the right not to be subject to a decision based solely on automated processing — we make none.

How to exercise them: email support@stopzone.app. If your request concerns your subscription, include your Support ID; if you are asking us to disclose, correct, or delete the record, include the Apple transaction identifier from your receipt as well, for the reason in section 4. We respond within 30 days, and within one month where the GDPR applies, extendable by two further months for complex requests, in which case we will tell you within the first month. We charge nothing, unless a request is manifestly unfounded or excessive.

The honest limitation. Art. 11 GDPR addresses our situation: a controller who cannot identify a data subject need not acquire additional information solely to comply. We hold no name, no postal address, and no device identifier, and no email address unless you have written to us — in which case we hold that correspondence and can act on a request about it directly. Beyond that: a request about data on your device we cannot help with, because we do not have it — deleting the app removes it completely. A request about your subscription record we can act on with the identifiers above; without them we cannot locate you, and we will not ask you for identity documents to manufacture an identification we deliberately never created. Analytics can be muted instantly in Settings → Privacy, or deleted at Mixpanel on request. Payment data is held by Apple.

Deleting your subscription record does not cancel your subscription — only Apple can do that — and we may need to keep the transaction record for tax purposes (section 12).

Complaints. Please tell us first at support@stopzone.app. You may also complain to a supervisory authority: in the EEA, the authority for your country of residence, work, or the alleged infringement (list); in Germany, your Land’s Landesbeauftragte für Datenschutz; in the UK, the ICO (ico.org.uk); in Switzerland, the FDPIC; in India, the Data Protection Board (section 15).

14United States state privacy rights

If you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights under your state’s privacy law.

Categories collected in the last twelve months

Categories use the CCPA’s own labels.

We have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, and do not do so now. We have not sold or shared the personal information of consumers we know to be under 16. Sources are you, your device, and our subscription and payment providers. Disclosures are made only to the service providers in section 8, under contracts prohibiting them from using the information for their own purposes.

You may request to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, or targeted advertising (there is nothing to opt out of), and not be discriminated against for exercising any of them. Email support@stopzone.app with your Support ID and, for requests to know, access, correct, delete, or port, the Apple transaction identifier. The Support ID locates a record but does not verify it is yours; where one matches more than one record we act on none and come back to you. An authorised agent may act for you with written, signed permission we may verify with you directly.

Appeals. If we decline and you live in a state with an appeal right (Colorado, Connecticut, Delaware, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia), reply with the word “Appeal” and we will review within the period your state allows, and tell you how to contact your Attorney General.

California “Shine the Light.” We disclose no personal information to third parties for their direct marketing purposes, because we run no direct marketing programme.

15India \u2014 Digital Personal Data Protection Act, 2023

We operate from India and process personal data as a Data Fiduciary under the DPDP Act, 2023, in respect of the limited categories in section 5.

As a Data Principal you have the right to access a summary of your personal data and our processing, to correction and erasure, to nominate another person to exercise your rights in the event of death or incapacity, and to grievance redressal.

Grievance officer: Shreyas Garehatti Sridhara — support@stopzone.app, at the address in section 1. We acknowledge a grievance within 7 days and resolve it within 30 days. If you are not satisfied you may approach the Data Protection Board of India. Where processing depends on consent, you may withdraw it with the same ease with which it was given.

16How we keep information safe

The strongest control we have is architectural: information we never receive cannot be breached. On top of that:

• All traffic is HTTPS with TLS 1.2 or higher, enforced at the app level with no exceptions.
• The app ships with no server secret. Credentials live in the backend environment, never in the app or the repository.
• Requests that write to your subscription record are authenticated, and every value written is verified against our subscription provider’s own API rather than taken from the caller.
• Rate limits are keyed on a hash, never a raw IP, and rows are pruned automatically.
• Anything sensitive cached on device uses the iOS Keychain.
• Secrets scanning and dependency vulnerability scanning run on every change.
• A suite of privacy tests gates every release, asserting that no coordinate, stop name, or user-authored text can reach an analytics payload or a log, and that background location authorization cannot be added to the app.

No system is perfectly secure, and transmission over the internet is never risk-free. If a breach affects personal information we hold and poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay.

17Children and young people

Stopzone is intended for people aged 16 and over, and our Terms of Service require that. We do not knowingly collect personal information from anyone under 16. We do not direct the app at children, we run no advertising, and — because there is no account, profile, social feature, user-generated content, or messaging — there is no mechanism by which a child could disclose personal information to us or to another user through it.

If you believe someone under 16 has provided us with personal information, write to support@stopzone.app and we will delete what we hold.

18The website, cookies, and tracking signals

stopzone.app sets no cookies. It runs no analytics script, advertising pixel, tag manager, session-replay tool, or third-party embed. It is a set of static pages, so there is no consent banner because there is nothing to consent to. Our host, Vercel, processes connection metadata including IP addresses in order to serve the pages (section 5).

The iOS app uses no cookies and no tracking SDK. The only web content it displays is this notice, our Terms and Conditions, and our Impressum, opened from Settings and loaded from stopzone.app in a reader that runs no JavaScript, keeps no cookies or storage, and cannot navigate anywhere else. It does not use the advertising identifier and never presents an App Tracking Transparency prompt.

Share links. When you share a week summary, the link is a fixed URL identical for every user. It carries no code, no identifier, no coordinate, and no personal information.

Do Not Track and Global Privacy Control. There is still no finalised industry standard for Do Not Track, and we do not respond to it; California law requires us to say so. We honour Global Privacy Control where applicable, though in practice it changes nothing, because we neither sell personal information nor share it for cross-context behavioural advertising.

19Apple App Store privacy labels

The app ships a privacy manifest declaring its required-reason API usage, as do our third-party SDKs.

20Changes to this notice

We may update this notice. The version number and “Last updated” date at the top tell you which version you are reading.

If we make a material change — a new category of data, a new purpose, a new processor receiving personal information, or any change to the promise that your location stays on your device — we will tell you in the app before it takes effect, and where the law requires consent we will ask for it rather than assume it. We keep prior versions and will send you one on request.

21How to contact us

Email: support@stopzone.app

Post: Shreyas Garehatti Sridhara Sri Krupa, 3rd Cross 2nd Phase, Davalagiri Badavane Chitradurga, Karnataka 577501 India

For anything about your payment, refund, or billing, Apple is the merchant of record — see Apple Support and our Terms and Conditions.