Privacy Policy

Effective date: September 6, 2026

This policy describes Inverza v1.7. Earlier versions do not have the separate AI-sharing and Gemini age-confirmation steps described below. Update to v1.7 when available to use those controls. On an earlier version, avoid sending AI requests if you do not want the corresponding data transfers.

Inverza is a landscape photography weather app developed by Marcel Strelow. This privacy policy explains how the app handles your information in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

Data Controller

The data controller responsible for processing within the meaning of the GDPR is:

Marcel Strelow
Email: contact@inverza.app

Information the App Uses

Inverza processes the following data to provide its core functionality:

• Location data: Your device coordinates are used to fetch weather forecasts and find nearby photography spots. Location data is sent directly to Open-Meteo (weather) and the Overpass API (map data). It is never stored on any server I operate.
• Compass heading: When you use the "Use Device Compass" feature, the app reads your device heading locally to set a viewing direction. This data never leaves your device.
• Camera: AR Sky uses camera images locally to display your surroundings and track augmented-reality overlays. Inverza does not upload the AR camera feed. Camera access is used while the AR view is active.
• Built-in AI model: Google Gemini 3.8 Flash is available without a personal API key. Before the first AI request, Inverza explains which provider will receive your data and asks for permission. Requests go directly from your device to the Google Gemini API using an application-level key. I do not operate a chat proxy server.
• Built-in Flickr key: The app includes a built-in Flickr API key for spot photos and hotspot discovery. Your coordinates are sent to the Flickr API using this application-level key. If you add a Flickr Pro API key, it replaces the built-in key.
• API keys you provide: If you switch to "Bring Your Own Key" for AI providers (Anthropic Claude, Google Gemini, or OpenAI ChatGPT) or add a Flickr Pro key, these keys are stored locally on your device using the iOS Keychain. They are sent only to the respective provider. I never receive or store your API keys.
• AI chat messages: With your permission, Inverza sends your question, recent conversation, saved chat memories and relevant location and planning context to the selected AI provider. This includes the selected location's name and coordinates, weather and photographic subject information when available. The same permission applies to questions generated by tapping a condition or notification. Permission is recorded separately for each provider configuration, including built-in Gemini and your own key. You can withdraw all AI-sharing permissions in Settings. Withdrawal prevents new requests until you agree again; it does not recall information already transmitted. Weather, maps and planning remain available without AI chat.

Legal Basis for Processing

Under Article 6 of the GDPR, the legal bases for processing your data are:

• Consent (Art. 6(1)(a)): Optional AI sharing requires your explicit permission in the app. You can withdraw it in Inverza's Settings. You control location and camera access through iOS permissions and can revoke them in your device settings.
• Contractual necessity (Art. 6(1)(b)): Processing of data you actively provide (such as saved spots, viewing directions, and API keys) is necessary to deliver the app's core functionality that you have chosen to use.

Data Storage and Retention

Saved spots, viewing directions, chat history, chat memories, condition verdicts and preferences are stored on your device. Provider keys are stored in the iOS Keychain. Inverza has no user accounts or app-operated cloud sync. You can clear chat history and remove provider keys in Settings. Deleting the app removes its local app container; Keychain storage and device backups are managed by iOS. Remove provider keys in Settings before uninstalling if you want to delete those credentials.

Data transmitted to third-party services (weather queries, map requests, AI chat messages) is not stored by me. Retention by those third parties is governed by their own privacy policies.

The built-in Gemini service uses a Google project with paid billing enabled. Under Google's paid-service terms, prompts and responses are not used to improve Google's products, but may be logged for a limited period for safety, abuse prevention and legal requirements. This is not a zero-retention service. If you provide your own API key, the selected provider's terms, billing tier and account settings govern its data use and retention. Requests made with your own key can be associated with your provider account. Free-form questions and location context are not anonymised before transmission.

Third-Party Services and International Data Transfers

The app communicates directly with the following third-party services. Each has its own privacy policy. Some of these services are operated outside the European Economic Area (EEA), which means your data may be transferred to countries that do not offer the same level of data protection as the EU.

• Open-Meteo (open-meteo.com) - Weather forecasts. Receives your coordinates. Based in Switzerland (EU adequacy decision).
• Overpass API (overpass-api.de) - OpenStreetMap data. Receives the map region you are viewing. Based in the EU.
• Flickr API (flickr.com) - Geotagged photos and hotspot discovery. Receives your coordinates. Uses a built-in key by default, or your Pro key if configured. Operated by SmugMug (USA).
• Wikimedia Commons (commons.wikimedia.org) - Spot photos. Receives your coordinates. Operated by the Wikimedia Foundation (USA).
• NOAA Aviation Weather Center (aviationweather.gov) - Live airport weather observations (METAR) used to cross-check forecasts. Receives a map region around your selected location to find the nearest station. Operated by the U.S. National Oceanic and Atmospheric Administration (USA).
• Google Gemini (generativelanguage.googleapis.com) - Built-in AI chat (Gemini 3.8 Flash). Available by default, with permission required before use. Receives your question, relevant conversation and saved chat memories, weather and planning context, and location information including coordinates. Based in the USA.
• AI providers (Anthropic, Google, OpenAI) - If you choose "Bring Your Own Key", AI chat responses are handled by the provider you selected. Receives your question, weather context, location-derived information, and your API key. Only one provider is contacted at a time. These providers are based in the USA.

These providers may process data outside the EEA, including in countries where they or their service providers maintain facilities. Their applicable terms describe international-transfer safeguards. Inverza's permission prompt does not itself guarantee a particular processing country. Flickr is used by default with a built-in key and can be disabled in Settings. Declining AI-sharing permission prevents AI chat transfers to both built-in Gemini and other AI providers. Choosing the built-in model does not keep AI requests within the EEA. Other enabled features may still contact the services listed above.

Subscription and Payments

Inverza is available as an annual subscription ($4.99/year). All payment processing is handled entirely by Apple through the App Store. The developer does not receive, process, or store any payment information, credit card numbers, or billing details. Apple's privacy policy governs how your payment data is handled.

Analytics and Tracking

Inverza has no in-app ads or cross-app tracking SDK. It uses Apple's SKAdNetwork attribution APIs to report coarse conversion milestones for app-install advertising. Apple manages the attribution mechanism; Inverza does not request the advertising identifier (IDFA). Apple may also provide aggregated App Store, subscription and diagnostic reports under your Apple settings. Local condition verdicts and chat history are not uploaded to a developer-operated analytics service.

Your Rights Under the GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request confirmation of whether your personal data is being processed and, if so, access to that data. Saved app records can be viewed on your device. Contact me about data handled through Inverza; provider-held records are also subject to the provider's request process.
• Right to rectification (Art. 16): You may correct inaccurate data. You can edit your saved spots, viewing directions, and API keys directly within the app.
• Right to erasure (Art. 17): You may request deletion of your personal data. Delete saved entries and API keys in Settings where available. Removing the app clears its app container, but does not delete provider-held records, Keychain entries or device backups.
• Right to restriction of processing (Art. 18): You may request that processing be restricted. You can revoke location permissions or stop using specific features at any time.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format. You can use the Export / Import feature in Settings to export all your curated spots as a portable text string.
• Right to object (Art. 21): You may object to the processing of your data. You can stop using any feature or revoke permissions at any time.
• Right to withdraw consent (Art. 7(3)): You may withdraw consent at any time by withdrawing AI-sharing permissions in Inverza's Settings or revoking location and camera permissions in iOS Settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact me at contact@inverza.app.

Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Children's Privacy

Gemini chat is available only to people aged 18 or older. Before sharing data with either built-in Gemini or Gemini with a personal key, the app requires an explicit confirmation that the user is at least 18. No birth date or identity document is requested or sent. Declining keeps non-AI weather, maps and planning available within the normal subscription entitlement.

Changes to This Policy

If I update this privacy policy, the revised version will be posted at this URL with an updated effective date. If a change materially affects the way your data is processed, I will make reasonable efforts to notify users through the app or this website.

Contact

If you have questions about this privacy policy or wish to exercise your data protection rights, you can reach me at contact@inverza.app.