This privacy policy governs your use of the mobile application SunMate (the “Application”, Android package identifier com.flx_apps.sunmate), a UV-index and sun-safety app created and published by FLX Apps (Felix Heller), flx.es. It explains what the Application does and does not do with information, which device permissions and network services it uses and why, and how the optional in-app purchase is handled. Please read it in full before installing or using the Application.
SunMate shows you the UV index for your location and for places you save, estimates how long unprotected skin can stay out before burning, reminds you when to reapply sunscreen, offers optional vitamin-D guidance, and provides home-screen widgets. It is a personal, single-device tool: there is no companion account, no cloud sync operated by us, and no way for anyone — including us — to see your usage. Everything you configure is stored on your own device; the only information that leaves it is what is technically required to retrieve a forecast, to name the place you are in, or to search for a place, as described below.
The Application obtains the forecast numbers it shows from the third-party services below. Every request is made directly from your device, over an encrypted connection, and carries only the geographic coordinates (latitude and longitude) of the location being shown — never your name, an account, or a device identifier assigned by the Application. Requests to WeatherAPI.com additionally carry the Application’s own API key, which identifies the app to that service and says nothing about you.
As with any request over the internet, these services necessarily receive the request itself, including your device’s IP address; that is inherent to the connection and is not something the Application adds. Neither requires an account, and the Application sends no identifier that would let your requests be tied to you. Their handling of requests is governed by their own terms and privacy notices (currentuvindex.com, WeatherAPI.com). Background refreshes (see below) make the same forecast requests on a periodic schedule so your widgets and reminders stay current.
When you search for a city to save, the text you type is sent to a city-search service we operate ourselves at flx-apps.com (the same operator as this Application, FLX Apps), which returns matching place names and their coordinates. It is a stateless lookup over a fixed public list of world cities (GeoNames data): nothing is fetched from anyone else at request time, it requires no account or API key, and it holds no per-user data. As with any web request the server necessarily receives the request and your IP address; it uses these only transiently to return the result and to enforce a basic per-IP rate limit against abuse, and it does not log your searches, tie them to any identity, or build any profile of you. The Application sends only your query string.
If you allow it, the Application uses your device’s location to fetch the UV forecast for where you are. The coordinates are used to make the forecast request described above and to label your current position; they are not sent to us and are not stored on any server we operate. You can decline the location permission and instead add places manually via search; the Application then works from your saved places. Saved places are kept only in the Application’s local storage on your device.
So that your position appears as a place name rather than bare coordinates, the Application asks the geocoder built into your device to turn the coordinates into a city name. That geocoder is part of the operating system, not something we run or bundle: on Android it is provided by the system (in practice by Google Play services), so depending on your device and its settings the lookup may be resolved by the vendor’s servers under that vendor’s own privacy terms. The Application passes it nothing but the coordinates, receives nothing but a place name, and works without it — if the lookup fails, the place simply keeps a generic name.
The Application can show local notifications — sunscreen-reapply reminders and UV alerts — that are scheduled and fired entirely on your device. There is no push server; we do not send you messages and cannot see whether a reminder fired. Reminders you set for household profiles are likewise scheduled locally. On Android 13 and later the system asks for your permission to post notifications; reapply reminders may use an exact-alarm permission so they fire on time, and fall back to an inexact schedule otherwise.
The Application’s home-screen widgets are drawn on your device from locally stored forecast data. To keep widgets and reminders current, the Application periodically refreshes the forecast in the background; each refresh makes the same forecast requests described under Weather and UV data and involves no other network activity. All widget content and preferences are stored locally.
The Application does not collect or transmit to us any of the following: your name, e-mail address, phone number, or contacts; your device’s advertising identifier or any persistent hardware identifier; the list of apps installed on your device; your search or navigation within the Application; crash logs or diagnostic telemetry; or any behavioural or analytics event. The location coordinates and place-search text described above are sent only to the weather services, to our own city-search lookup, and (for the coordinates, when you use your current position) to your device’s own geocoder, solely to retrieve a forecast, to name your position, or to find matching places; none of the personal data listed here is collected by us, and our city-search service keeps no record of your searches.
Your configuration — skin type, saved places, sunscreen log, household profiles, reminder settings, and widget preferences — is stored locally in the Application’s own private storage on your device. You remain in full control: you can change or reset any setting at any time, remove individual saved places, profiles, or log entries in the Application, and remove all of the Application’s local data by clearing its data in Android’s system settings or by uninstalling it. Uninstalling the Application removes its local data from your device. If you have enabled Android’s own device backup, your device may include the Application’s settings in that backup; this is a system feature operated by Google (or your device vendor) under its own terms, and you can exclude the Application or disable backup in your device settings.
The Application requests only the permissions required for its features. Several are optional — if you do not use the corresponding feature, you never need to grant them.
ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION). Used to fetch the UV forecast for your current position, as described under Location. Optional: decline it and use saved places instead. Location is used to make the forecast request and is never sent to us.
INTERNET). Required to fetch UV forecasts from currentuvindex.com and cloud cover from WeatherAPI.com, to fetch place-search results from our own city-search service, and for the optional Google Play Billing purchase. The Application makes no other network use.
POST_NOTIFICATIONS) and exact alarms (SCHEDULE_EXACT_ALARM). Used to show sunscreen-reapply reminders and UV alerts on time. Notification permission is requested by the system on Android 13+; if exact alarms are unavailable, reminders fall back to an inexact schedule.
RECEIVE_BOOT_COMPLETED). Used only to re-establish scheduled reminders and background forecast refreshes after the device restarts, so they are not lost on reboot.
com.android.vending.BILLING). Present solely because of the Google Play Billing library used for the optional Pro purchase (see below).
Alongside these, the libraries the Application is built on declare a few standard Android permissions that are granted automatically and are not privacy-sensitive: network state (ACCESS_NETWORK_STATE), wake lock and foreground service (WAKE_LOCK, FOREGROUND_SERVICE) for the scheduled background forecast refresh, and vibration (VIBRATE) for reminder notifications. None of them gives access to personal data.
The Application offers an optional one-time in-app purchase (“Pro”) that unlocks additional features such as household profiles and extra widgets. This purchase is processed entirely by Google Play Billing. Google handles the transaction and your payment details; we never see, receive, or store your payment-card information or billing address. From Google, the Application receives only your purchase / entitlement status (that is, whether Pro has been bought), which it uses locally to enable the Pro features. Google’s processing is subject to the Google Privacy Policy. If you never purchase Pro, no data-relevant interaction with Google’s billing service takes place through the Application.
We do not share information with third parties for their own purposes. A few third parties are involved strictly in operating the Application’s features: currentuvindex.com and WeatherAPI.com, which serve the UV and cloud-cover forecasts the Application requests (each receiving the coordinates needed to answer the request, as described above), and Google, in its role as the operator of Google Play Billing for the optional Pro purchase and as the provider of the system geocoder your device may use to turn your coordinates into a city name (see Location). City search is handled by a service we operate ourselves (flx-apps.com) and so is not a third party. The Application contains no advertising SDK, no analytics SDK, and no crash-reporting SDK.
We would disclose information only where legally compelled to do so — for example to comply with a subpoena or comparable legal process. In practice, because the Application stores no personal data on any server we operate, we hold no such user data to disclose.
The Application is a general-audience sun-safety tool. It is not directed at children, does not knowingly collect any information from anyone (including children under 13/16), and offers no social or content-sharing features. The household-profiles feature simply lets an adult keep sunscreen reminders for family members on their own device; the profile data (a name and skin type you enter) stays on that device.
Because your settings stay on your device and are not stored by us, there is no server-side repository of your information for us to secure or to be breached. On-device data remains protected by Android’s standard application sandboxing and by whatever device security (screen lock, encryption) you have configured. Requests to the weather services, to our city-search lookup, and to Google Play are made over encrypted (HTTPS/TLS) connections.
For users in the European Economic Area and the United Kingdom: the Application stores no personal data on our infrastructure. The one piece of our own infrastructure it contacts is the stateless city-search lookup described above; there we transiently receive the request (including its IP address) solely to return matching places and to rate-limit abuse, on the basis of our and your legitimate interest in a working, non-abused service (Art. 6(1)(f) GDPR), and we retain no per-user record. Sending your coordinates to currentuvindex.com or WeatherAPI.com, or a search query to our city-search service, happens at your direction, so that the Application can provide the forecast or place you asked for (Art. 6(1)(b) GDPR, performance of the service you requested; and Art. 6(1)(f), our and your legitimate interest in the Application functioning). Any processing performed by those weather services or by Google in connection with those requests or the optional purchase is carried out by them as independent controllers under their own terms.
We may update this privacy policy from time to time, for example to reflect changes in the Application or in legal requirements. The current version is always the one published at this URL, and the “Last updated” date above indicates when it last changed. Continued use of the Application after an update constitutes acceptance of the revised policy.
The section above concerns the mobile Application. The website on which this policy is hosted (operated by FLX Apps on the operator’s own first-party server, flx.es) may use a self-hosted, cookieless system to compile anonymous, aggregate visit statistics (such as page views, referring sites, browser/device type and approximate country). No cookies are set, no data is shared with any third party, and your IP address and browser user-agent are never stored — they are used only transiently, with a secret key that changes every day, to derive an anonymous identifier and an approximate two-letter country code. Visits cannot be linked to a person or across days. You can opt out at any time by enabling the “Do Not Track” or “Global Privacy Control” setting in your browser. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, aggregate statistics).
By using the Application you consent to the terms of this privacy policy as it may be amended from time to time.
If you have any questions about this privacy policy or the Application’s privacy practices, please contact FLX Apps (Felix Heller) at felixheller@mailbox.org.