Privacy policy
1. Who processes your data
The data controller is the Oro pavojus project (oropavojus.lt). Send questions about data processing and requests to exercise your rights to info@oropavojus.lt.
2. What we collect and why
| Data | What we use it for | Legal basis | How long we keep it |
|---|---|---|---|
| Account: first name, last name, email, sign-in method (email and password, or Google), the version of the terms you accepted and, if you ticked it, your consent to receive important notices by email | Your account, abuse prevention, contacting you about your reports | Contract (terms of use); for emails, consent | Until you delete the account; up to 30 more days in backups |
| Settings, including the municipality you chose | Providing the service | Contract | As long as the account exists |
| Technical record of a deleted or blocked account: account number, creation and last-visit dates, report count, trust level and ban reason (no name or email) | Keeping bans and abuse prevention working after an account is deleted | Legitimate interest | As long as the service runs |
| Drone reports: exact location and its accuracy, what you saw and when, your note | Crowd sightings, assessing how reliable reports are, abuse prevention | Legitimate interest (public safety information) and consent when submitting | Exact location, note and link to your account: 30 days. After that the link and the note are deleted and the location is snapped to a 1 km grid |
| Sightings calculated from reports: location, path and time | The map and the event history | Legitimate interest | As long as the service runs. After 30 days they are no longer linked to the people who reported |
Hashes of the IP address and device, including a random device id from the oro_did cookie |
Abuse prevention | Legitimate interest | 7 days |
| Hashes of the IP addresses you sign in, renew your session and submit reports from | Abuse prevention and enforcing bans | Legitimate interest | 30 days after the address was last used; deleted at once when you delete your account |
| Ban list: hashes of a blocked account’s email address and IP addresses | Stopping a blocked person from signing in or registering again | Legitimate interest | Until the ban is lifted, then 30 more days |
| Shelter reports and comments; if you allow location, the distance to the shelter (the location itself is not stored) | Letting others know a shelter’s condition; the distance helps assess the report | Legitimate interest, contract | The link to your account and the distance: 1 year, or until you delete the account. The report and comment text stays, without a link to you |
| Your location on the map and for finding the nearest shelter | Providing the service | Consent (browser permission) | Calculated on your device and not stored. If the shelter list is not on your device yet, a location rounded to ~100 m is sent to the server: it is not stored in the database, but it may remain in the server logs |
| Browsing statistics (Google Analytics), only if you agree: the page address without query parameters, the title, browser and device data, an approximate location derived from the IP address, a random browser id, and what you do on the site (which button was pressed, which map layer was switched on, how far a report got) — never a location, nor a report, shelter or account identifier — plus coarse flags: whether you are signed in, whether a municipality is chosen (not which), light or dark theme, whether the site is open as an installed app, and whether the map layers have been changed | Counting visits and improving the site | Consent (you can withdraw it at any time) | Google Analytics: up to 14 months; cookies: 365 days after the last visit |
| Confirmation that this site is not an official source: a random number, the notice version, the language and the time (not linked to an account or an IP address) | Showing that the notice was shown and accepted | Legitimate interest | As long as the service runs |
| Server logs: IP address, requested page address, browser, time, and the browser’s technical reports when a page gets no data | Security and operations | Legitimate interest | 30 days |
| Activity log: administrator actions and views of exact report locations, account deletions (account number, time, IP address hash, browser name) | Accountability and abuse prevention | Legitimate interest | 2 years |
We use no advertising cookies. We use analytics cookies (Google Analytics) only if you agree; see Cookies. We never sell data or share it for advertising.
Your name is shown publicly next to shelter reports only if you turn this on in the settings. Otherwise we show “User”. We never show your email or last name publicly.
When you sign up you can tick that you want to receive important notices by email. We do not send such emails at the moment. You can withdraw this consent at any time by writing to us.
3. How we protect location data
- Exact drone report locations are visible only to the person who reported and to the site administrator. The administrator also sees the reporter’s name and email. Every administrator view of exact locations is logged.
- The public only sees aggregated sightings once the reporter threshold is reached, with the position rounded to at least 250 m.
- A sighting’s location is calculated from the reporters’ locations, so when there are few reports it can be close to where a reporter was. Such sightings are not shown publicly until they reach the threshold.
- Until a report is sent (for example, with no connection), it is kept with its exact location only in your browser.
- The location you find with “Show my location” is only used to move the map. It is not sent anywhere and never enters a link.
- Database backups are encrypted.
4. Automated assessment of reports
So that false or automated reports do not distort the map, every report is automatically given a weight based on the account’s age, location accuracy, earlier reports and the anti-bot score. Reports from accounts that broke the terms of use may not be shown to others, and some shelter comments may be held for review before they appear.
This assessment only decides what we show to others. It has no legal or similarly significant effects on you. If you think your reports are assessed wrongly, write to us.
5. Who else processes data
We use Google Cloud and Firebase (Google) to run the service. The database and servers run in the European Union (region europe-west1, Belgium). Google may process Firebase Authentication account data outside the EU under the standard contractual clauses approved by the European Commission. Account verification and password reset emails are sent by Firebase Authentication.
Sign-in, sign-up, password reset and drone and shelter reports are protected from bots by Google reCAPTCHA Enterprise and Firebase App Check. When you use them, your browser sends Google technical data about your device and browser and about how you interact with the page, including your IP address. The legal basis is our legitimate interest in protecting the service from abuse. Google’s Privacy Policy and Terms of Service apply to reCAPTCHA.
Your browser loads the base map (tiles and label fonts) directly from OpenFreeMap (tiles.openfreemap.org). That service sees your IP address and which part of the map you are viewing.
If you open a road camera in a municipality card, the image is loaded from eismoinfo.lt, and a video from YouTube (youtube-nocookie.com) only after you press play. These sites see your IP address and apply their own privacy rules.
If you agree to analytics, browsing statistics are processed by Google Analytics (Google Ireland Limited). Google may also process this data in the United States; Google LLC takes part in the EU-U.S. Data Privacy Framework.
6. Your rights
You have the right to:
- get a copy of your data (export it in the settings);
- correct inaccurate data: your name in the profile settings, anything else by writing to us;
- withdraw your own drone report within 30 minutes and delete your own shelter report within 24 hours of submitting it; after that, by writing to us;
- delete your account (in the settings). Your name, email, settings and IP address hashes are deleted and your reports are unlinked from you. Only the technical record without a name or email described in the table remains;
- object to processing based on legitimate interest and withdraw your consent: for analytics cookies on the Cookies page, for emails by writing to us.
We answer requests within 30 days. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).
7. Children
You must be at least 14 years old to create an account.
8. Changes
We will announce material changes to this policy in the app. The “Updated” date at the top of the page shows the latest version.