# Privacy design

This is the engineering note. The user-facing privacy policy is drafted before release
and must stay consistent with what is written here.

## Principle

The backend holds no user data of any kind. There is no account, no device registry,
no user table. This is not a policy promise — it is a property of the architecture,
and it is what makes the Data safety declaration simple and honest.

With advertising out of scope, there is currently **no third party that receives anything
about the user at all**. The only outbound requests are for map tiles and radar frames,
neither of which carries a user identity.

## Location

The device may ask for location permission to centre the map. When it does:

- **Prominent disclosure** is shown before the system permission dialog, stating what
  the location is used for, as Google Play requires.
- The permission is optional. Declining leaves the app fully usable: the map opens on
  the region centre from the region config.
- The coordinates stay on the device. They are used to position the map and nothing
  else, and are never sent to our backend.

There is no forecast provider, so no coordinates leave the device for one.

## Rain notifications without a server-side location

The worker computes rain per geographic cell and publishes per-cell state. The device
decides which cells it cares about and subscribes to the matching FCM topics **itself**.

The consequence is that the server never learns which cell any user is in — it
publishes to topics, not to devices. There is nothing to correlate, nothing to
subpoena, and nothing to breach. Cell size is coarse enough that a cell identifies an
area, not a household.

**Never** replace this with device tokens registered against coordinates. It would be
simpler and it would destroy the property.

## Caching on the device

Radar frames are cached in memory while the app runs. The cache holds published weather
imagery only — no personal data — and does not outlive the process.

## What each third party receives

| Party | What it receives | Why |
|---|---|---|
| OpenFreeMap | tile requests for the area being viewed | to draw the base map |
| Our CDN | frame and manifest requests | radar imagery |
| Firebase Cloud Messaging | topic subscriptions, no coordinates | rain notifications |

Map tile requests inevitably reveal roughly where the map is looking, to whoever serves
the tiles. That is inherent to any hosted base map; the alternative is self-hosting, which
is noted in [stack-decisions.md](stack-decisions.md) as the escape hatch if it ever
matters enough.

Our own backend receives nothing that identifies a user, by construction.

## Out of scope, and therefore absent

No advertising, no consent management platform, no IAB TCF, no ad identifiers, no
forecast provider. If advertising returns, this document and the privacy policy must be
revised **before** the SDK is added, not after.