YourRegion Privacy Policy

Effective date: May 1, 2026 · Version: 1.0

This Privacy Policy explains what personal data we collect when you use the YourRegion mobile application and related services (the “Service”), how we use it, with whom we share it, and what rights you have.

1. Who we are

The YourRegion Service is currently developed and maintained as a personal project by an independent developer (Ukraine). In the future, the rights and obligations may be transferred to a legal entity — in that case, this Policy will be updated and users will be notified inside the application.

Privacy contact: info@yourregion.tech

2. What data we collect

2.1. Data you provide directly

Email address — for account creation, sign-in, and password recovery.
Password — stored only as a cryptographic hash; we do not have access to your password in plain text.
Name — how you would like to be addressed in the app.
Phone number — optional, only if you choose to add it.
Profile photo (avatar) — optional.
Selected region and interface language — for personalising your feed.
Content of your appeals, survey responses and messages — anything you voluntarily submit through the app.
Files and photos attached to your appeals.

2.2. Data collected automatically

Push token (FCM for Android, APNs for iOS) — for delivering notifications.
Device identifier — for binding the push token to your account.
Technical logs: IP address, device type, app version, OS type, request timestamps. Stored on the server side for diagnostics and security for a limited time (typically up to 30 days).

2.3. Data collected only with your explicit consent

Geolocation — only if you enable the relevant feature (e.g. to find nearby points on a map). Not stored on the server without a direct action by you.
Camera and photo library access — only at the moment you attach a photo to an appeal or set an avatar. We do not have background access to your photos.
Push notifications — enabled only after you confirm the system prompt.

2.4. What we do NOT collect

We do not collect banking details, card numbers, or government ID numbers.
We do not read your contacts, SMS, call history, or other applications.
We do not use advertising identifiers and we do not share your data with advertising networks.

3. How we use your data

Creating and maintaining your account, authentication.
Sending push notifications you are subscribed to (alerts, regional news, replies to your appeals, etc.).
Showing information relevant to your selected region (alerts, weather, events, transport).
Routing your appeals to the appropriate municipal services through the relevant modules.
Technical diagnostics, abuse prevention, and security.
Improving functionality based on de-identified usage statistics.

4. Legal bases for processing (GDPR)

Performance of a contract (Art. 6(1)(b) GDPR) — to provide you with the Service features you signed up for.
Consent (Art. 6(1)(a)) — for geolocation, push notifications, camera access, and acceptance of this Policy at registration.
Legitimate interest (Art. 6(1)(f)) — for security, abuse prevention, and technical diagnostics.
Compliance with legal obligations (Art. 6(1)(c)) — in case of lawful requests from competent authorities.

5. Sharing data with third parties

We do not sell your data. To deliver the Service, we use the following technical service providers (data processors), which may receive a limited set of data:

Amazon Web Services (AWS) — server and database hosting. Region: eu-central-1 (Frankfurt, Germany).
Google Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) — push notification delivery.
Cloudflare R2 — storage for files and images you upload.
Third-party SMTP providers — delivery of transactional emails (registration confirmation, password reset).
WeatherAPI.com — weather data (no personal data shared).
Ukraine Alarm — air-raid alert data (no personal data shared).

These services act as data processors under our instructions and their own privacy policies. Data may be stored and processed outside Ukraine, including in the EU and the United States (for Google and Apple — under appropriate safeguards, including EU Standard Contractual Clauses where applicable).

6. Data retention

Account data — for as long as your account is active, or until you request deletion.
Push tokens — until you disable notifications or uninstall the app.
Technical logs — typically up to 30 days.
Appeals and public content — retained according to the purpose of the relevant module (e.g. appeals may be retained longer for record-keeping and audit, even after your account is deleted — in de-identified form, see Section 7).

7. Account deletion

You may delete your account at any time via the “Settings” → “Delete account” screen in the app, or by sending a request to info@yourregion.tech.

After deletion is confirmed:

Your personal identifiers (email, name, phone, avatar, push tokens, device IDs) are irreversibly deleted or anonymised.
Appeals, survey responses and other public/administrative content you created may be retained in de-identified form (with no link to your identity) — to preserve the integrity of administrative processes and statistics. Your name will be replaced with “Deleted user” or a similar anonymous marker.
Backups containing your data are purged or overwritten according to the backup rotation cycle (typically up to 30 days).

8. Your rights

Under GDPR and the Ukrainian Law on the Protection of Personal Data, you have the right to:

access your data;
correct inaccurate data;
erase your data (“right to be forgotten”) — see Section 7;
restrict processing;
receive your data in a machine-readable format (data portability);
object to processing based on legitimate interest;
withdraw consent at any time (turn off permissions in the device system settings or in the app);
lodge a complaint with the national data protection authority (in Ukraine — the Ukrainian Parliament Commissioner for Human Rights).

To exercise any of these rights, contact us at info@yourregion.tech. We respond no later than within 30 days.

9. Security

We apply technical and organisational measures to protect your data: HTTPS encryption for all network traffic, password hashing, tokens stored in platform-specific secure storage (iOS Keychain / Android EncryptedSharedPreferences), restricted administrator access to the database. No system is absolutely secure — in the event of an incident affecting your data, we will notify you and the competent authority within the timeframes required by law.

10. Children

The Service is not intended for persons under 14 years of age. We do not knowingly collect data of children under 14. If you become aware that a child has provided us with their data without parental consent, contact us and we will delete such data.

11. Changes to this Policy

We may update this Policy. We will notify you of material changes inside the app and ask for renewed consent before you continue to use the Service. The effective date of the current version is shown at the top of the document.

12. Contact

Questions, requests, complaints, withdrawal of consent: info@yourregion.tech