Skip to content

Commit de6515a

Browse files
author
Lalit Sharma
committed
feat: add privacy policy, store privacy declarations, and iOS privacy manifest
1 parent 588e9ed commit de6515a

4 files changed

Lines changed: 241 additions & 7 deletions

File tree

‎PRIVACY_POLICY.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Privacy Policy
2+
3+
**Eclipse Timer**
4+
**Effective Date:** February 16, 2026
5+
**Last Updated:** February 16, 2026
6+
7+
Eclipse Timer ("the App") is developed by lallimaven. This Privacy Policy explains what data the App accesses, how it is used, and your choices.
8+
9+
---
10+
11+
## 1. Information We Collect
12+
13+
### 1.1 Location Data
14+
15+
The App requests access to your device's location **only when you choose** to use the "Use GPS" feature. Your geographic coordinates (latitude and longitude) are used **entirely on-device** to compute eclipse contact times for your location.
16+
17+
- **Your location is never transmitted to any server.**
18+
- **Your location is never stored persistently.** It is held in memory only while the App is running.
19+
- You can use the App without granting location permission by manually placing a pin on the map.
20+
21+
### 1.2 Crash and Diagnostic Data
22+
23+
The App uses [Sentry](https://sentry.io) to collect crash reports and error diagnostics **in production builds only** (not during development). This data may include:
24+
25+
- Device model, operating system version, and app version
26+
- Stack traces and error messages
27+
- General device state at the time of a crash (e.g., available memory)
28+
29+
Crash data **does not include** your location, personal information, or any content you create in the App. Sentry's privacy practices are described at [https://sentry.io/privacy/](https://sentry.io/privacy/).
30+
31+
### 1.3 Network Requests
32+
33+
The App loads eclipse preview images (animated GIFs) directly from NASA's public Eclipse website (`https://eclipse.gsfc.nasa.gov`). These are standard HTTP image requests. The App does not send any personal data, location data, or device identifiers in these requests.
34+
35+
### 1.4 Notifications
36+
37+
The App can schedule **local notifications** to remind you of upcoming eclipse events. These notifications are created and delivered entirely on your device. No notification data is sent to any server.
38+
39+
### 1.5 User Preferences
40+
41+
Your settings (notification preferences, favorite locations) are stored **on-device only** using AsyncStorage. This data is never transmitted off your device.
42+
43+
---
44+
45+
## 2. Information We Do NOT Collect
46+
47+
- **No personal information:** The App does not collect your name, email address, phone number, or any account credentials.
48+
- **No analytics or tracking:** The App does not use analytics SDKs, advertising identifiers, or tracking pixels.
49+
- **No advertising:** The App contains no ads and does not share data with advertising networks.
50+
- **No user accounts:** The App does not require or support user registration or login.
51+
- **No third-party data sharing:** Beyond Sentry crash diagnostics (see section 1.2), no data leaves your device.
52+
53+
---
54+
55+
## 3. Data Retention
56+
57+
- **Location data** is not stored. It exists in memory only during active use.
58+
- **User preferences** remain on your device until you clear the App's data or uninstall it.
59+
- **Crash reports** are retained by Sentry according to their data retention policy (typically 90 days).
60+
61+
---
62+
63+
## 4. Children's Privacy
64+
65+
The App does not knowingly collect any personal information from children under 13 (or the applicable age in your jurisdiction). The App does not require any personal information to function.
66+
67+
---
68+
69+
## 5. Your Choices
70+
71+
- **Location:** You can deny or revoke location permission at any time in your device's Settings. The App functions fully without location access.
72+
- **Notifications:** You can disable notifications in your device's Settings or within the App's Notification Settings screen.
73+
- **Crash reporting:** Crash reports are only sent in production builds. There is no opt-out toggle at this time, but crash data contains no personally identifiable information.
74+
75+
---
76+
77+
## 6. Changes to This Policy
78+
79+
If we update this Privacy Policy, we will revise the "Last Updated" date at the top. Continued use of the App after changes constitutes acceptance of the updated policy.
80+
81+
---
82+
83+
## 7. Contact
84+
85+
If you have questions about this Privacy Policy, you can reach us at:
86+
87+
- **GitHub:** [https://github.com/lallimaven/eclipse-timer](https://github.com/lallimaven/eclipse-timer)
88+
89+
---
90+
91+
## 8. Summary Table
92+
93+
| Data Type | Collected? | Transmitted Off-Device? | Purpose |
94+
|-----------|-----------|------------------------|---------|
95+
| Location (lat/lon) | At runtime, in memory only | ❌ No | Compute eclipse times for your position |
96+
| Crash diagnostics | Yes (production only) | ✅ Yes (to Sentry) | Fix bugs and improve stability |
97+
| NASA preview images | Fetched from NASA servers | N/A (read-only fetch) | Display eclipse preview animations |
98+
| Notification schedule | Created locally | ❌ No | Remind you of eclipse events |
99+
| User preferences | Stored on-device | ❌ No | Remember your settings between sessions |
100+
| Personal information | ❌ No | ❌ No | — |
101+
| Advertising/tracking IDs | ❌ No | ❌ No | — |

‎apps/mobile/app.json‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,32 @@
1212
],
1313
"ios": {
1414
"bundleIdentifier": "com.lallimaven.eclipse-timer",
15-
"buildNumber": "1"
15+
"buildNumber": "1",
16+
"infoPlist": {
17+
"NSLocationWhenInUseUsageDescription": "Eclipse Timer uses your location to compute precise eclipse contact times for where you are. Your location stays on-device and is never sent to a server."
18+
},
19+
"privacyManifests": {
20+
"NSPrivacyAccessedAPITypes": [
21+
{
22+
"NSPrivacyAccessedAPIType": "NSPrivacyAccessedAPICategoryUserDefaults",
23+
"NSPrivacyAccessedAPITypeReasons": ["CA92.1"]
24+
}
25+
],
26+
"NSPrivacyCollectedDataTypes": [
27+
{
28+
"NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypePreciseLocation",
29+
"NSPrivacyCollectedDataTypeLinked": false,
30+
"NSPrivacyCollectedDataTypeTracking": false,
31+
"NSPrivacyCollectedDataTypePurposes": ["NSPrivacyCollectedDataTypePurposeAppFunctionality"]
32+
},
33+
{
34+
"NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeCrashData",
35+
"NSPrivacyCollectedDataTypeLinked": false,
36+
"NSPrivacyCollectedDataTypeTracking": false,
37+
"NSPrivacyCollectedDataTypePurposes": ["NSPrivacyCollectedDataTypePurposeAppFunctionality"]
38+
}
39+
]
40+
}
1641
},
1742
"splash": {
1843
"image": "./assets/splash-icon.png",

‎documents/store-privacy-declarations.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# App Store & Play Store — Privacy Declarations
2+
3+
> Reference document for filling out the Apple App Privacy labels and Google Play Data Safety forms.
4+
> Keep in sync with `PRIVACY_POLICY.md`.
5+
6+
---
7+
8+
## Apple App Store — App Privacy Labels
9+
10+
When submitting to App Store Connect, select the following in the **App Privacy** section:
11+
12+
### Data Types Collected
13+
14+
| Data Type | Category | Collected | Linked to Identity | Used for Tracking |
15+
|-----------|----------|-----------|-------------------|-------------------|
16+
| Precise Location | Location | ✅ Yes | ❌ No | ❌ No |
17+
| Crash Data | Diagnostics | ✅ Yes | ❌ No | ❌ No |
18+
19+
### For each data type:
20+
21+
#### Precise Location
22+
- **Usage purpose:** App Functionality
23+
- **Linked to user identity:** No
24+
- **Used for tracking:** No
25+
- **Notes:** Location is used entirely on-device to compute eclipse contact times. It is never transmitted to any server or stored persistently.
26+
27+
#### Crash Data
28+
- **Usage purpose:** App Functionality (bug fixing)
29+
- **Linked to user identity:** No
30+
- **Used for tracking:** No
31+
- **Notes:** Crash reports are sent to Sentry and contain stack traces, device model, and OS version. No personally identifiable information is included.
32+
33+
### Data NOT Collected
34+
Check "No" for all of the following categories:
35+
- Contact Info (name, email, phone, address)
36+
- Health & Fitness
37+
- Financial Info
38+
- Sensitive Info
39+
- Contacts
40+
- User Content
41+
- Browsing History
42+
- Search History
43+
- Identifiers (user ID, device ID)
44+
- Purchases
45+
- Usage Data (only crash data, not usage analytics)
46+
- Other Data
47+
48+
### iOS Privacy Manifest (`NSPrivacyAccessedAPITypes`)
49+
50+
The following API usage reasons are declared in `app.json` → `expo.ios.privacyManifests`:
51+
52+
| API Category | Reason Code | Justification |
53+
|-------------|-------------|---------------|
54+
| `NSPrivacyAccessedAPICategoryUserDefaults` | `CA92.1` | AsyncStorage uses UserDefaults to persist user preferences (notification settings, favorite locations). |
55+
56+
---
57+
58+
## Google Play Store — Data Safety Section
59+
60+
When filling out the **Data Safety** form in Google Play Console:
61+
62+
### Overview Answers
63+
- **Does your app collect or share any of the required user data types?** Yes
64+
- **Is all of the user data collected by your app encrypted in transit?** Yes (HTTPS for NASA GIF fetches and Sentry)
65+
- **Do you provide a way for users to request that their data is deleted?** Not applicable — no personal data is stored on servers. On-device data is cleared by uninstalling the app.
66+
67+
### Data Types
68+
69+
#### Location → Approximate location
70+
- **Collected:** No (precise location is used, see below)
71+
72+
#### Location → Precise location
73+
- **Collected:** Yes
74+
- **Shared with third parties:** No
75+
- **Is this data processed ephemerally?** Yes — location is used in memory only, never stored
76+
- **Is this data required for your app, or can users choose whether it's collected?** Optional — users can place a pin manually
77+
- **Purpose:** App functionality
78+
79+
#### App info and performance → Crash logs
80+
- **Collected:** Yes
81+
- **Shared with third parties:** Yes — Sentry (crash reporting service provider)
82+
- **Is this data processed ephemerally?** No — retained by Sentry per their retention policy (~90 days)
83+
- **Is this data required for your app, or can users choose whether it's collected?** Required (automatic in production builds)
84+
- **Purpose:** App functionality (bug fixing), Analytics (crash analysis)
85+
86+
#### Device or other IDs
87+
- **Collected:** No
88+
89+
### Data NOT Collected or Shared
90+
Select "No" for all of the following:
91+
- Personal info (name, email, address, phone, etc.)
92+
- Financial info
93+
- Health info
94+
- Messages
95+
- Photos & videos
96+
- Audio files
97+
- Files & docs
98+
- Calendar
99+
- Contacts
100+
- App activity (app interactions, search history, installed apps)
101+
- Web browsing
102+
- Device or other IDs
103+
104+
### Additional Disclosures
105+
- The app does **not** use advertising libraries or advertising IDs.
106+
- The app does **not** contain any ads.
107+
- The app is **not** designed for children.
108+
- The app does **not** share data with third parties except Sentry for crash reporting.

‎documents/tech-debt.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@
200200
| ID | Item | Severity | Details |
201201
|----|------|----------|---------|
202202
| SP-01 | **Location permission requested without prior explanation** | 🟡 Medium | ✅ Resolved 2026-02-16: added a custom `Alert.alert` rationale dialog explaining on-device-only location use before the OS permission prompt. |
203-
| SP-02 | **No privacy policy or data usage disclosure** | � High | App requests location and loads remote GIFs (NASA). Both App Store and Play Store **require** a privacy policy URL during submission. Blocks store listing. |
203+
| SP-02 | **No privacy policy or data usage disclosure** | 🟠 High | ✅ Resolved 2026-02-16: wrote `PRIVACY_POLICY.md`, created `documents/store-privacy-declarations.md` with Apple App Privacy and Google Play Data Safety declarations, added iOS privacy manifest to `app.json`. Remaining: host the policy at a public URL and link in store listings. |
204204
| SP-03 | **External URL (NASA GIF) loaded without HTTPS validation** | 🟢 Low | The URL is constructed dynamically. A malformed date could produce a broken URL — no sanitization. |
205205

206206
---
@@ -272,7 +272,7 @@
272272
| CI-02 | Automate EAS Build jobs in CI for Android/iOS artifacts |
273273
| CI-03 | Configure app signing / keystore (blocks store submission) |
274274
| CI-05 | ✅ Resolved 2026-02-16: integrated @sentry/react-native with Sentry.wrap + ErrorBoundary |
275-
| SP-02 | Write & host privacy policy (required by both stores) |
275+
| SP-02 | ✅ Resolved 2026-02-16: privacy policy written, store privacy declarations documented, iOS privacy manifest added |
276276

277277
### 🟡 Medium — Plan Next
278278
| ID | Summary |
@@ -367,10 +367,10 @@
367367

368368
| # | Step | Relates To | Status |
369369
|---|------|-----------|--------|
370-
| 3.1 | **Write a privacy policy** covering: location data (used locally, not transmitted), network requests (NASA GIF URLs), notification permissions, no analytics/tracking. Host on a public URL (GitHub Pages works). | SP-02 | ⬜ Not started |
371-
| 3.2 | **Add the privacy policy URL** to `app.json` → `expo.ios.privacyManifests` (if targeting iOS 17+) and to both store listings. | SP-02 | ⬜ Not started |
372-
| 3.3 | **Prepare Apple App Privacy labels** (App Store Connect) — declare Location (used for functionality), no data collected for tracking. | SP-02 | ⬜ Not started |
373-
| 3.4 | **Prepare Google Play Data Safety section** — declare location access, notification permissions, no data shared with third parties. | SP-02 | ⬜ Not started |
370+
| 3.1 | **Write a privacy policy** covering: location data (used locally, not transmitted), network requests (NASA GIF URLs), notification permissions, Sentry crash reporting, no analytics/tracking. Hosted at `PRIVACY_POLICY.md` — deploy to a public URL (e.g., GitHub Pages) before store submission. | SP-02 | ✅ Done 2026-02-16 |
371+
| 3.2 | **Add the privacy policy URL** to `app.json` → `expo.ios.privacyManifests` (iOS 17+ privacy manifest with `NSPrivacyAccessedAPITypes` and `NSPrivacyCollectedDataTypes`). Also added `infoPlist.NSLocationWhenInUseUsageDescription`. Deploy public URL and link in store listings. | SP-02 | ✅ Done 2026-02-16 |
372+
| 3.3 | **Prepare Apple App Privacy labels** — documented in `documents/store-privacy-declarations.md`. Declares Precise Location (app functionality, not linked, not tracking) and Crash Data (app functionality, not linked, not tracking). | SP-02 | ✅ Done 2026-02-16 |
373+
| 3.4 | **Prepare Google Play Data Safety section** — documented in `documents/store-privacy-declarations.md`. Declares precise location (ephemeral, optional), crash logs (shared with Sentry), no personal info / ads / tracking. | SP-02 | ✅ Done 2026-02-16 |
374374

375375
### Phase 4 — Store Metadata & Assets (required for listing)
376376

0 commit comments

Comments
 (0)