Privacy policy

Controller

Hyvän Mielen Media (business ID 2929549-8), Finland.
Privacy matters: tietosuoja@hyvanmielenmedia.fi

In short

• Your position is encrypted on your phone with the group key before it is sent to the server. The server stores the encrypted content but cannot open it.
• We do not sell data, and we use no advertising, analytics or tracking cookies.
• You can delete your account and the groups you own at any time in the app or on the website.

What data we process

Account

Name, email address, a hash of your password (the password itself is never stored), account creation and change times, email confirmation status and the sign-in tokens of your devices. An account is needed to create and manage groups. You can join a group without one.

Groups

Group name and code, participants' display names and roles, join and connection times, and a hash of the phone's installation identifier. The hash lets the group recognise the same phone again, and the identifier cannot be derived from it.

Position, recordings and plans

While recording, the app uses your phone's precise location and air pressure. Live positions and recordings synced to the server are encrypted on the phone with the group key. The server only sees their timestamps and the phase of the jump (for example climb or canopy). The group's shared plan, exercises and safety acknowledgements are encrypted the same way. Group members who hold the group key see your position. Recordings stay on your phone until you delete them.

Nearby sharing (Bluetooth)

For safety, the app shares your position and altitude over Bluetooth with nearby DropVector devices, so jumpers on the same load see each other without a network connection and across groups. These messages do not pass through our server, and a nearby device can receive them.

Voice

Group voice is encrypted (WebRTC) and travels directly between devices or, when needed, through our relay server in Finland. Audio is not recorded.

Weather and map requests

The coordinates of a plan are sent to our server to fetch winds and weather. The server fetches them from Open-Meteo without your identity. METAR observations are also fetched through our server from the US weather service (aviationweather.gov), which only sees our server's address. Map imagery is loaded from Esri, which sees your device's IP address and the requested area. In Finland, orthophotos come from the National Land Survey through our server. The base map of the website's Live and Playback views is loaded by the browser from the OpenStreetMap Foundation, which sees the IP address.

Technical data and cookies

Server logs record the IP address and request details for security and abuse prevention. Rate limits store the IP address as a hash. The website uses only necessary cookies (sign-in, group view and language). A key derived from the group key stays in the browser tab until you close it. The app's error reports stay on the phone unless you share them.

Purposes and legal bases

• Providing the service (contract): account, groups, Live, recordings, plans and voice.
• Security and abuse prevention (legitimate interest): logs, rate limits and limits on sign-in attempts.
• Account messages (contract): email confirmation and password reset. We send no marketing without your consent.
• Invoicing and bookkeeping (legal obligation): licences and invoices of organisation customers.

Recipients and service providers

The following process data on our behalf:

• servers and database: UpCloud Oy, servers in Helsinki
• email delivery: our company email service (confirmation and reset messages)
• map imagery: Esri Inc. (United States), the National Land Survey of Finland and, on the website, the OpenStreetMap Foundation (United Kingdom)
• weather: Open-Meteo and aviationweather.gov through our server (they receive coordinates only, not your identity)
• voice connection setup: our own relay server in Finland.

We do not sell or disclose data for marketing.

Transfers outside the EU/EEA

Our servers and database are in Finland. The only transfers outside the EU/EEA are map requests. Esri Inc. (United States) sees the device's IP address and the requested map tile. Esri is certified under the EU–U.S. Data Privacy Framework, on which the transfer relies. The website's base map comes from the United Kingdom (OpenStreetMap Foundation), which has an EU adequacy decision.

Retention

• Your account is kept until you delete it.
• Groups, their loads, encrypted positions, plans and exercises are kept until the group owner deletes them or their account.
• Email confirmation links are valid for 7 days and password reset links for one hour.
• Sign-in tokens expire and are removed. A new password or account deletion invalidates them immediately.
• Server logs are kept for at most 30 days.
• Invoicing records are kept as long as Finnish bookkeeping law requires.

Your rights

You have the right to access, correct and erase your data, to restrict or object to its processing, and to data portability.

• You can change your name in the app or on the website (My account).
• You can delete your account in the app (Settings › Account › Delete account) or on the website (My account › Delete account). This also deletes the groups you own and their data from the server.
• For other requests, contact tietosuoja@hyvanmielenmedia.fi. We reply within one month.

You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Security

Connections are encrypted (TLS), positions and group content are encrypted on the phone with the group key, passwords are stored only as hashes, and access to the servers is restricted. Report vulnerabilities and security incidents to support@hyvanmielenmedia.fi.

Children

DropVector is meant for skydivers, instructors and organisations. The service is not directed at children.

Changes

We update this policy when the service changes. We tell you about material changes in the app or by email.