Privacy Policy

Short version: the LuftDings app collects nothing — no account, no backend, no tracking; everything happens on your device. We only receive personal data if you email us or join the TestFlight beta. This website is hosted on GitHub Pages, which (like any web server) processes visitors’ IP addresses in its logs.

Last updated: 28 September 2026. A German version is available: Datenschutzerklärung.

Controller

The controller responsible for data processing under the GDPR is the operator named in the Impressum / Legal Notice. Contact: support@poschenrieder.io.

Scope

This policy covers (1) the LuftDings iOS app, (2) this website at luftdings.poschenrieder.io, (3) the TestFlight beta of the app, and (4) contacting us by email. The app and the website do not share data.

1. The LuftDings app

What the app collects

Nothing. The app has no backend server, no analytics, no advertising, no tracking, and no third-party SDKs that collect data. We do not create an account for you, and through the app we never receive, see, or store any of your information. On the App Store the app declares “Data Not Collected.” (The only cases in which we do receive data are the TestFlight beta and emails you send us, both described below.)

Your Airthings credentials

To show live data you provide your own Airthings API credentials (a client ID and secret you generate in your own Airthings account — “Bring Your Own API Key”). These credentials:

are stored only in the iOS Keychain on your device;
are shared with the LuftDings widget through a private, on-device App Group container so the widget can refresh;
are never transmitted to us or to any server we control — we operate no servers for the app.

Your air-quality data

When you use live data, the app sends your Airthings credentials directly from your device to the Airthings Cloud API and receives your latest sensor readings in return. Those readings are cached locally on your device (in the App Group container) so the widgets can display them and show a “last updated” time. This data is not sent to us or anywhere else. Airthings is an independent controller for the data processed through your Airthings account; its handling is governed by Airthings’ own terms and privacy policy, over which we have no control.

Demo mode

Without credentials, the app runs in a demo mode using built-in, fictional sample data. No network requests are made and no data leaves your device.

No processing by us; on-device storage

Credentials and readings are processed only on your device, for your own personal use. We have no access to them and do not process them, so there is no processing by us that would require a legal basis under Art. 6 GDPR. Your own use on your own device is a purely personal activity outside the scope of the GDPR (Art. 2(2)(c) GDPR). Storing credentials and cached readings on your device is strictly necessary to deliver the service you explicitly requested, so it falls under § 25(2) no. 2 TDDDG and requires no separate consent.

Apple App Store

The app is distributed via the Apple App Store. Apple processes download and usage data as an independent controller under Apple’s privacy policy. If you have chosen in iOS to share analytics with app developers, Apple gives us only aggregated, non-personal statistics in App Store Connect (for example, numbers of installs or crashes).

2. This website

This website is static and hosted on GitHub Pages, delivered via GitHub’s content-delivery network. The provider is GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, the Netherlands, or GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

Server logs. When you visit, GitHub automatically processes technical access data — including your IP address, date and time, the page requested, referrer, and browser/user-agent string. According to GitHub, it logs and stores the IP addresses of visitors to GitHub Pages sites for security purposes; it does so under its own responsibility. We have no access to these logs. Legal basis for delivering the website via GitHub: Art. 6(1)(f) GDPR (legitimate interest in delivering the site securely, reliably, and at low cost).
No cookies, no analytics, no tracking, no external fonts or CDNs. The site sets no cookies and loads no third-party scripts or fonts, so no consent banner is required (§ 25 TDDDG).
International transfer. GitHub is part of the Microsoft group, headquartered in the USA. Processing in the USA takes place on the basis of the EU–US Data Privacy Framework, under which GitHub is certified (Art. 45 GDPR). See GitHub’s privacy statement.

3. TestFlight beta

Before release you can test the app through Apple’s TestFlight service. Unlike the released app, this means we receive data about you via Apple (App Store Connect):

No name or email address: if you join via the public TestFlight link, we only see you as an anonymous tester (we do not receive your name or email address). Only Apple knows your Apple ID. Only if we invite you by email as an exception do we see the name and email address we entered for that;
Technical data: device model, iOS version, app version, number of sessions, and crash reports;
Feedback you choose to send through TestFlight, including comments and screenshots.

Purpose and legal basis: managing your participation in the beta (Art. 6(1)(b) GDPR), and fixing bugs and improving the app using crash reports and feedback (Art. 6(1)(f) GDPR; legitimate interest in a stable, bug-free app).

Apple also processes your TestFlight data as an independent controller; see Apple’s privacy policy and the privacy information in the TestFlight app. Participation is voluntary and you can leave the beta at any time in TestFlight.

4. Contacting us by email

If you email us, we process your email address, your name (if given), and the content of your message to answer your request. Legal basis: Art. 6(1)(b) GDPR where your request concerns using the app, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Our mailbox is hosted by Apple (iCloud Mail); for users in the EU the provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Processing by Apple Inc. in the USA is possible; Apple Inc. is certified under the EU–US Data Privacy Framework (Art. 45 GDPR).

Recipients

Airthings (only via your own account, when you use live data), GitHub (website hosting), and Apple (app distribution, TestFlight, email hosting). We do not sell or share data with anyone else.

Retention

App: Cached readings stay on your device and are removed when you uninstall the app. Credentials are stored in the iOS Keychain, which iOS keeps even after the app is uninstalled; on the first launch after a reinstall the app detects this and removes them automatically. You can also remove them at any time by signing out in the app.
Emails: We delete your request once it has been fully dealt with, unless statutory retention obligations apply.
TestFlight: Tester data is stored in App Store Connect. We remove you as a tester when you leave the beta or the beta ends, and delete crash reports and feedback once they are no longer needed for fixing bugs. Apple’s retention periods apply otherwise.
Website: Server logs are retained and controlled by GitHub per its own policy; we hold no copies.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20), and to withdraw consent with effect for the future (Art. 7(3)) where processing is based on it. We hold no data about you from the app itself; we only hold data if you have emailed us or joined the TestFlight beta. For your Airthings data, please contact Airthings; for website server logs, please refer to GitHub.

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time, on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims. A simple email is enough.

Right to complain

You may lodge a complaint with a data-protection supervisory authority, in particular the one for our location, the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live or work.

Obligation to provide data

You are under no statutory or contractual obligation to provide us with data. Without your email address we cannot answer your request; without the TestFlight data you cannot take part in the beta.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Children

LuftDings is not directed at children and does not knowingly collect information from anyone, including children.

Changes

If this policy changes, the updated version will be posted here with a new “last updated” date.

Contact

Questions about privacy? Email support@poschenrieder.io or see the Impressum.