Privacy notice

DRAFT. This text has not been reviewed by lawyers yet and may change.

Who is responsible

The data controller is a company run by Lukas Arlauskas [legal name, company number and address to be added]. During the pilot, reports are shared with the police under a written data-sharing agreement. Contact: [email address to be added].

What we collect

• Your report: where you watched from, the direction and angle the phone pointed, the time, any details you chose and your note.
• Videos and photos you add, with the file’s metadata (such as when it was created).
• A random device key, so you can see the status of your reports and so we can protect the service from abuse. There is no account: no name, email address or phone number is needed.
• Network information: we keep only your internet provider’s network number (ASN) and the country. We do not store your IP address.
• If a police officer sent you a link, your phone number is stored encrypted only while the link is valid, and then deleted.

Why

So that the responsible services (during the pilot, the police) can understand faster what is happening and find objects that have fallen. The legal basis will be confirmed in the data protection impact assessment; it is likely to be legitimate interests.

Who sees your data

Only moderators and officers of the responsible services, through a protected system. There is no public video gallery, and we never tell a reporter whether their report was confirmed.

The app's public map shows only how many incidents moderators confirmed as drones or balloons, at least a day later, in areas about 5 km across. An area appears only once at least 3 different people reported confirmed sightings there, so no single report or reporter can be picked out. Places where debris was found are never published.

How long we keep it

• Videos are deleted after 30 days unless the report belongs to a confirmed incident. Videos of confirmed incidents are kept for up to 2 years, or as agreed with the police.
• Reports (without videos) are kept for 2 years – this is needed to recognise abuse.
• Server logs are kept for at most 7 days, backups for 14 days.
• Data needed for a legal investigation may be kept longer.

Where

All data is stored and processed in the European Union, encrypted.

On your phone

Reports and copies of videos stay on your phone until they have been sent; a video’s copy is deleted once it has been uploaded. We use only strictly necessary storage: the device key (and a cookie holding it) and your language choice. No advertising or tracking cookies, and no analytics.

Your rights

You can delete your reports under “My reports”, unless they are being kept for an investigation. For other requests, such as access to your data, use the contact details above. You also have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).