Privacy policy

1. About this policy

Status387 is an independent information platform that collects publicly published power and water outage notices and shows them in a single view. This policy covers the Status387 public website and mobile app.

Status387 is operated by Zlatan Vanovac, an individual developer based in Sarajevo, Bosnia and Herzegovina. We are the controller responsible for the processing described in this policy.

Status387 is not an electricity operator, a water utility, a government body or an emergency service.

2. No conventional user account

You do not need to create an account to use the core service, and we do not ask for your name, email address or phone number. Instead, the app uses an anonymous installation identifier so that your settings are linked to a device rather than to your identity.

3. Data we process

The current release of the app processes the categories of data below. Where a category is optional, the app remains usable without it.

• Anonymous installation identifier (user ID). A randomly generated identifier, together with a secret used to authenticate requests from that installation. It links followed locations and notification state to one installation of the app. It is stored, is required for the app to work, and is not shared for third parties' own purposes.
• Followed locations and subscriptions. The street, area or location you chose to follow, together with its source (power or water) and notification state.
• Push notification token (device or other ID). A technical identifier, such as a Firebase Cloud Messaging (FCM) registration token, that allows notifications to be delivered to your device. It is required for notifications and is not shared for third parties' own purposes.
• Device location (optional). Location that you choose to provide while using the app, for example to determine your relevant area or to submit a community report. How it is handled is described in section 4.
• Crash logs and diagnostics. Technical information about errors, crashes and the health of the app, collected through Sentry. In the current release this collection is not optional. It is stored and used to diagnose and fix problems, and is not shared for third parties' own purposes.
• Request metadata and logs. Basic records of requests to the backend (for example the time of a request and technical identifiers) that may be produced during normal operation of the service.

4. Location: what we know and what we do not claim

Status387 is built around following specific streets and areas that you choose yourself. Location access is optional and is used only in the foreground, at the moment you use a feature that needs it, for example to determine the area relevant to you or to submit a community report. The app does not track your location in the background.

We do not store your precise device location long term. If you submit a community report, its coordinates are generalised to a coarse grid (roughly 100–110 metres) before they are stored, and the location shown for an incident is a generalised centre derived from reports, not the exact position of any device.

You can change or revoke location permission in your device settings, and decide each time whether to use a feature that needs location.

5. Why we process data

• To show outages for the locations you follow.
• To deliver the notifications you have enabled.
• To keep the service reliable, stable and secure.
• To prevent abuse and excessive load on the system.

We rely on the following legal bases: providing the service you requested (the anonymous installation, followed locations and notification delivery); your consent for location and notifications, which you can withdraw at any time; and our legitimate interest in the reliability, security and stability of the service and in preventing abuse. We do not use your data for advertising or profiling.

6. Public outage information

Outage content is publicly published information that we take from public sources and present in a consistent format. It is not your personal data.

7. Sharing and third parties

We do not sell personal data and we do not share it for third parties' own purposes. To run the service we use trusted service providers that process data on our behalf and under our instructions:

• Firebase / Google (for example notifications and app infrastructure),
• Sentry (crash and error diagnostics and stability),
• Cloudflare (network, security and abuse protection),
• Hetzner (hosting of the backend).

All production data is transmitted over HTTPS/TLS. Our providers are configured to use servers in the European Union and the backend runs on a server in the European Union, so we do not transfer your personal data outside the EU/EEA.

We may also disclose data where required by law or by a competent authority.

8. Data retention

We keep installation records, followed locations and notification registrations for as long as the installation remains active, or until they are removed. Crash logs and diagnostics are kept only as long as they are needed for reliability and troubleshooting. Community reports are stored in generalised form and may be kept as part of the outage history. We do not keep data longer than we need it for the purposes described in this policy.

9. Security

We apply reasonable technical and organisational measures to protect data, including encryption in transit (HTTPS/TLS) and hosting within the European Union. No system is perfectly secure, so we cannot guarantee absolute security, but we work to keep the risk as low as possible.

10. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive your data in a portable form. Where processing is based on your consent, you can withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority; in Bosnia and Herzegovina this is the Agency for Personal Data Protection of Bosnia and Herzegovina. To exercise any of these rights, use the contact details in section 14.

11. Your control and choices

• You can remove followed locations in the app, where this is supported.
• You can turn off or unregister notifications in the app or device settings, which clears the notification registration.
• You can revoke location access in your device settings.
• Uninstalling the app ends the use of the anonymous installation identifier.

In the current release there is no complete self-service option to delete the whole anonymous installation and everything linked to it. In the app you can delete individual followed locations and clear your notification registration. If you want the anonymous installation and the data linked to it to be deleted, use the contact details in section 14.

12. Children

The service is not intended for children and we do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time to reflect changes in the service or in applicable rules. We publish changes on this page and update the date above.

14. Contact

For privacy questions and data-deletion requests, contact Zlatan Vanovac, Sarajevo, Bosnia and Herzegovina, at vanovac.zlatan@gmail.com.