Legal

Privacy policy

This is a translation to help you read it. The German version is the one that applies.

This explains which personal data is processed when you visit this website, sign up for the newsletter and use the Plitsch app for iPhone.

As of 28 October 2026

Controller

Jürgen Alker, Friedensallee 54a, 22765 Hamburg, Germany
Email: rain@plitsch.app · Phone: +49 40 288 033 09

Plitsch is a project by Jürgen Alker. Where this says “we”, it means him. More in the Imprint.

Website hosting

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, Vercel automatically processes what your browser sends: IP address, date and time, the address requested, the page you came from, and browser and operating system. Vercel derives country and city from the IP address. This is needed to deliver the page to you and protect it from attacks.

Vercel processes this data on our behalf under a data processing agreement (Art. 28 GDPR, vercel.com/legal/dpa). Vercel also uses part of the data itself, such as the IP address, to fend off denial-of-service attacks. Vercel keeps the data only as long as needed for that. Vercel names no fixed period. In our Vercel account we see access data for at most one day. We do not analyse it.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure website that works.

Visitor statistics

We use Fathom Analytics (Conva Ventures Inc., 26 Bastion Square, Third Floor Burnes House, Victoria, British Columbia, V8W 1H9, Canada) to understand how the website is used. Fathom sets no cookies and stores nothing on your device. Fathom does not recognise you the next day or on other websites.

On every page view Fathom records the page requested, the page you came from, campaign parameters from the address, browser and device type, the approximate origin such as the country, the time and the time spent. As with every request, your browser transmits your IP address and its identifier. From these and a random value that changes daily, Fathom forms a hash. Fathom uses it to count how many different visitors the website has in a day. The hash stays stored with the statistics; the IP address is not stored there. Fathom calls this data anonymous. To be safe, we treat it as personal data.

To protect against attacks, Fathom temporarily stores the IP address and browser identifier, for at most 24 hours according to the contract. Requests Fathom recognises as automated (bots) are stored separately from the statistics, together with the IP address. The statistics stay stored as long as we use Fathom for this website.

According to Fathom, the IP address of visitors from the EU is processed only on servers in the EU (operator: BunnyWay d.o.o., Slovenia) and removed there. Fathom stores the statistics with the hash in the USA. We see only aggregated numbers and cannot recognise you in them.

We also count how often a newsletter sign-up succeeded or failed. The email address does not go to Fathom.

Fathom processes the data on our behalf under a data processing agreement (Art. 28 GDPR, usefathom.com/legal/dpa).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the website. You can object at any time, most easily with the switch below. More: usefathom.com/data and usefathom.com/legal/privacy.

Cookies and browser storage

The website sets no cookies and stores nothing in your browser of its own accord. There are two exceptions.

If you turn off visitor statistics, your browser remembers that so the website can honour it. You have then expressly requested it (Section 25(2) no. 2 of the German TDDDG).

The second exception can be triggered by Vercel’s attack protection. If it rates a request as suspicious, it shows a short security check. If your browser passes it, Vercel remembers that in your browser for one hour. This is strictly necessary for the security of the website (Section 25(2) no. 2 TDDDG).

Fonts

All fonts come from this website itself. There is no connection to third-party font services.

Newsletter

If you sign up for the newsletter, we process your email address. We use it to send you news about the app a few times a year. Those who took part in the beta also receive the code for the annual subscription through it and, if they wish, notices about new test versions.

Your browser sends the address to a small function of this website at Vercel in Frankfurt am Main. It passes the address straight on to EmailOctopus. It does not store it and does not write it to logs.

Confirmation by email (double opt-in)

After signing up you get an email with a confirmation link. Only when you click it are you on the list. Until then you get no further emails from us. That way nobody can put someone else’s address on the list. Anyone who tries only triggers that one confirmation email. So that we can prove your consent, we store when you signed up, which version of the consent text you agreed to, and that you confirmed.

Sending via EmailOctopus

EmailOctopus runs the list and sends the emails. The provider is Three Hearts Digital Ltd, 86–90 Paul Street, London EC2A 4NE, United Kingdom. EmailOctopus processes the data on our behalf. We have a data processing agreement for this (Art. 28 GDPR).

Processed are your email address, the time of sign-up, the version of the consent text and technical data about delivery. That includes whether an email was delivered or bounced. If you click the confirmation link or the unsubscribe link, EmailOctopus also sees your IP address and the approximate location derived from it.

The data is stored at Amazon Web Services in the EU, mainly in Ireland. EmailOctopus uses further service providers, some of them in the USA, for example for a small part of the sending. The current list is at emailoctopus.com/legal/subprocessors. More on privacy at EmailOctopus: emailoctopus.com/legal/privacy.

We do not measure whether you open an email or click a link in it. Our emails contain no tracking pixel, and links lead straight to their destination.

Legal basis, withdrawal and retention

The legal basis for the newsletter is your consent (Art. 6(1)(a) GDPR). We store the proof of consent because we have to be able to provide it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can withdraw your consent at any time. Use the unsubscribe link in our emails or write to us. If you unsubscribe, you get no more emails from us. Notices from TestFlight about new test versions come from Apple and are not tied to this list. How to leave the test is explained below. Your address then stays stored only as “unsubscribed” so that we do not write to you again by mistake. The legal basis for that is Art. 6(1)(f) GDPR. Our legitimate interest is honouring your withdrawal permanently.

If you do not confirm your address within 30 days, we delete it. Otherwise we store it until you unsubscribe or we discontinue the newsletter. If we discontinue it, we delete the list within three months. It may remain in EmailOctopus backups for up to 90 more days after that.

Test versions with TestFlight

We distribute new test versions via TestFlight, a service by Apple. You can find the public TestFlight link on this website or in our emails. Your email address does not go to Apple, and we do not enter it anywhere at Apple. When you open the link, you sign in to TestFlight with your Apple Account. To us you appear there without a name and without an email address, as “Anonymous” according to Apple.

To take part you need the TestFlight app and your Apple Account. This is governed by Apple’s terms of use and the notice TestFlight & Privacy. According to Apple’s general privacy policy, the controller for people in the European Economic Area is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

While you use a test version, Apple automatically collects usage and crash data and passes it on to us: the type of invitation, your participation status, installs, the app version, the device model with a device identifier, the operating system version, the device language, the number of sessions and crashes, and crash logs. According to Apple, this collection cannot be turned off. We see this data without your name and without your email address and cannot link it to you.

Feedback is voluntary. If you send us feedback via TestFlight, for example with a screenshot, we receive your comment, the screenshot and further device details such as carrier, time zone, connection type, battery level, free storage and screen resolution. Apple also receives your feedback and, by its own account, keeps it for one year. If you email us from TestFlight, we see your sender address.

We use this data only to improve Plitsch and do not pass it on to third parties.

For the usage, crash and feedback data it is Art. 6(1)(f) GDPR. Our legitimate interest is finding bugs in test versions and improving the app.

Crash reports are available to us at Apple for 120 days. We delete feedback in App Store Connect no later than three months after the end of the respective test. You can stop at any time. To do so, stop testing Plitsch in TestFlight or delete the app. Data already transmitted remains. We cannot delete it individually because we cannot recognise you there. What Apple itself stores about you is shown at privacy.apple.com.

Contact by email

If you email us, we process your address, your name if you give it, and your message in order to reply. Our email runs on Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google processes the emails on our behalf under a data processing agreement (Art. 28 GDPR). We delete your email once we no longer need it and no retention obligation applies.

Legal basis: if it concerns your rights, such as a withdrawal or deletion, Art. 6(1)(c) GDPR in conjunction with Art. 12 to 21 GDPR. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is replying to you.

The Plitsch app

Plitsch is a rain app for iPhone, with widgets for the Home Screen and the Lock Screen. You need no account. The app has no ads, no tracking and no built-in third-party analytics or crash tools. It sends no data to a server of ours, except to the relay for Foreca (see below). What TestFlight collects for test versions is described above.

Your location

Plitsch only asks for your location when you tap “Use location” or “Use current location” in the place search. Access applies only while you use the app. There is no background location. You can also share only your approximate location or search for a place instead. If the app follows your location, it checks it when opened and every 15 minutes while it is open.

The app reads your location only with your permission in iOS (Section 25(1) TDDDG). You can withdraw permission at any time in iOS Settings under Privacy & Security > Location Services > Plitsch.

Place search and place names: Apple

If you search for a place, your search term goes to Apple’s maps service. For a route, the start and destination go to Apple’s maps service to work out the way, and when you search for them, the surrounding area, rounded to about one kilometre. To name your location, for example “Altona”, the app sends its coordinates to Apple, as precisely as your iPhone provides them. If the app follows your location, this happens when opened and every 15 minutes. If you have shared only your approximate location, only that goes to Apple. Apple sees your IP address in the process. This is covered by Apple’s privacy policy.

Weather data: Deutscher Wetterdienst (DWD)

For Germany and its border regions, as far as the DWD radar reaches, the weather data comes from the German Weather Service, Deutscher Wetterdienst (DWD), Frankfurter Straße 135, 63067 Offenbach, Germany. Beyond that, Foreca steps in (see below).

• The app loads radar and precipitation type as one file for all of Germany. Your place is not sent. The app only looks it up on your iPhone.
• For the 24-hour outlook and the temperature, only the identifier of the nearest weather station is sent.
• For official warnings and the lightning forecast, coordinates are sent, rounded to two decimal places. That is a grid of about 1.1 kilometres north to south and 0.7 kilometres west to east.
• The widgets query the radar for your place directly. The centres of the 1 km grid cell containing your place and of the eight cells around it are sent. The widgets also refresh while the app is closed. They use the place you last used in the app and do not locate you themselves.

With every request the DWD inevitably sees your IP address. According to the DWD, its open data server keeps it for at most seven days. It deletes the log files of its map server after 183 days. They contain the address requested, so for warnings, the lightning forecast and widgets probably also the rounded coordinates. More in the DWD privacy information (German).

Weather data outside Germany: Foreca

Where the radar of the German Weather Service doesn’t reach, the weather data comes from Foreca (Foreca Oy, Keilaranta 1, 02150 Espoo, Finland). For this, the app sends its requests through a relay of our own that we run at Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare is certified under the EU-US Data Privacy Framework. The request carries the coordinates of your place, rounded to two decimal places, which is about one kilometre. If you check a route outside the DWD radar, the app sends the same kind of request for up to twelve points along the route, also rounded to about one kilometre. The relay passes only these rounded coordinates on to Foreca. Foreca does not see your IP address.

For technical reasons, Cloudflare sees your IP address on every request. We use it only to reject too many requests in a short time, and we do not store it. The relay keeps responses for up to 30 minutes, the short-range forecast for five, with no link to you. What Cloudflare itself processes is set out in the privacy policy of Cloudflare.

Cloudflare processes the requests on our behalf, based on a data processing agreement (Art. 28 GDPR). Foreca is the recipient of the request: from the relay service, Foreca receives only the rounded coordinates, not your IP address.

Outside the DWD radar, the widgets too ask Foreca through the relay, with the same rounded coordinates, even when the app is closed. If a widget is set up, the app may also refresh it in the background, at most every 15 minutes; iOS decides exactly when. The app’s background refresh never asks Foreca, only the DWD radar.

“Plitsch” subscription: purchase through Apple

From version 1.0, the app offers the “Plitsch” subscription, yearly or monthly, as an in-app purchase through Apple. Apple handles purchase, payment, renewal, cancellation and refunds, as well as billing and receipts. Apple is itself responsible for this. Apple’s privacy policy applies. You manage and cancel your subscription in your iPhone’s Settings under your Apple Account.

We receive no payment details and no name from Apple. On your iPhone, the app only asks Apple’s StoreKit whether a subscription is active. It stores the result on your iPhone: until when the subscription is valid, whether it renews, and when it last checked. The app and widgets share this status. No server of ours is involved.

From Apple we only get aggregated sales and subscription figures, without names.

The legal basis for checking the subscription is the subscription contract (Art. 6(1)(b) GDPR). Storing the result on your iPhone is strictly necessary for this function (Section 25(2) no. 2 TDDDG).

What stays on your iPhone

The app stores on your iPhone the place last used with name and coordinates, up to five places you chose last in the place search, your settings, a saved window for time outside, your own activities, the last forecast and the forecast accuracy. App and widgets share this storage. The app itself does not upload this data. If you back up your iPhone to iCloud or a computer, it can end up in the backup like other app data. You can reset the forecast accuracy in Settings.

The legal basis for the requests to the DWD, Foreca, Cloudflare and Apple is Art. 6(1)(f) GDPR. Our legitimate interest is showing you the forecast and the name for the place you chose. Storing on your iPhone is strictly necessary for this function (Section 25(2) no. 2 TDDDG).

Transfers to countries outside the EU

Vercel is based in the USA and certified under the EU-US Data Privacy Framework. The transfer therefore relies on the European Commission’s adequacy decision (Art. 45 GDPR). In addition, Vercel’s data processing agreement includes the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Cloudflare is based in the USA and certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Only the rounded coordinates and, for technical reasons, your IP address go there.

EmailOctopus is based in the United Kingdom. The European Commission has found that the United Kingdom provides an adequate level of data protection (Art. 45 GDPR). The decision currently runs until 27 December 2031. For transfers to service providers in the USA, EmailOctopus says it uses the UK-US data bridge or standard contractual clauses.

Fathom is based in Canada. The European Commission has found that companies in Canada provide an adequate level of data protection (Art. 45 GDPR). According to Fathom, IP addresses of visitors from the EU are processed only on servers in the EU. Fathom stores the statistics with the hash in the USA at its service provider ClickHouse, Inc. Fathom calls this data anonymous.

Google may also process emails in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). According to its privacy policy, Apple generally stores data at Apple Inc. in the USA and bases the transfer on standard contractual clauses.

Do you have to provide data?

You can read this website without providing data, apart from what your browser sends automatically. Signing up for the newsletter is voluntary. Without an email address, however, we cannot send you any news. You can use the app without location access by searching for a place. We make no automated decisions and do no profiling within the meaning of Art. 22 GDPR.

Your rights

Right to object: where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future. To do so, write to rain@plitsch.app. We cannot link your TestFlight data to you because testers who join via the public link are anonymous to us.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU or EEA country where you live or work or where the alleged infringement took place. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, Germany, datenschutz-hamburg.de.

Changes

We update this policy when the website, the app or the services used change. The current version is always on this page.