Privacy Policy

1. Who we are and scope

The data controller for the Sunpop iOS app and this website is Przemysław Bocer, an independent developer based in Poland ("we"). You can contact us about privacy at support@bytechimera.com.

This policy explains how the Sunpop iOS app and this website handle information. Sunpop does not require an account and does not operate any server that receives your data.

Sunpop's burn-time estimates are educational indicators, not medical advice or diagnosis.

2. Your skin profile and session history (health-related data)

To calculate your personal sun exposure estimate, Sunpop stores on your device:

• Your skin type (Fitzpatrick scale) and SPF settings
• Your daily vitamin D goal and the estimated vitamin D produced during your sessions
• Sun-session history (start/stop times, calculated burn timeline, reapplication events)
• User preferences and onboarding choices

Because your skin type and sun-exposure history relate to your physiology, we treat them as health-related data and apply Apple's health data rules to them. This data:

• is processed and stored only on your device (including a local shared container used by the Sunpop widget and Live Activity) and is never uploaded to us or anyone else;
• is never used for advertising, marketing, or data mining, and is never disclosed to third parties;
• is not synced to iCloud by Sunpop.

You provide this information yourself during setup, and you can change or reset it at any time in the app's settings.

3. Location and UV data (Apple WeatherKit)

Sunpop fetches the UV index and forecast from Apple WeatherKit, Apple's own weather service. When you allow location access, your device sends its coordinates directly to Apple's WeatherKit service to retrieve conditions for your area. That request goes to Apple, not to us — we never receive, log, or store your location. Apple processes WeatherKit requests under Apple's privacy policy.

Your location is used only to fetch current UV conditions. Sunpop does not build location histories or movement profiles, and does not share or sell location data.

4. Device permissions

Sunpop can request the following iOS permissions:

• Location (while using the app) — to fetch the UV index and forecast for your area (section 3). Sunpop only ever requests "while using the app" access. While a sun session is running, or when the Sunpop widget refreshes in the background, iOS may deliver location updates to the app even when it is not on screen; these are used for the same purpose only — fetching current UV conditions — and never leave your device except as the WeatherKit request described in section 3.
• Notifications — local reminders about your session state (for example, when it is time to reapply or seek shade). These are generated on your device; no notification data leaves it.

Both permissions are optional and can be limited or withdrawn at any time in iOS Settings. An active session may also appear as a Live Activity on your Lock Screen; this is rendered locally by iOS.

5. Legal bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Core app functionality (storing preferences, running the timer): performance of a contract, Art. 6(1)(b) GDPR.
• Location for UV data: your consent, Art. 6(1)(a) GDPR, given through the iOS location permission and revocable at any time in Settings.
• Skin profile and sun-session history: your explicit consent, Art. 9(2)(a) GDPR, given when you enter your skin type during setup. You can withdraw it by resetting or deleting the app, which erases this data.

6. Analytics, ads, purchases, and the website

Sunpop contains no advertising networks, no third-party analytics SDKs, and no tracking. Crash and performance diagnostics reach Apple only if you have enabled "Share With App Developers" in iOS Settings, under Apple's own privacy terms.

Sunpop currently offers no in-app purchases. If paid features are introduced, purchases will be processed by Apple, and this policy will be updated before launch to describe any related data handling.

This website is a static site hosted on Cloudflare Pages, operated by Cloudflare, Inc. (United States). When you visit, Cloudflare processes technical request data such as your IP address, user agent, and requested URL in order to deliver the pages and to secure them against attacks and abuse. Cloudflare acts as our processor for this hosting and content delivery, and may process the data outside the European Economic Area, including in the United States; those transfers are covered by the standard contractual clauses in Cloudflare's data processing addendum. See Cloudflare's privacy policy.

The Sunpop pages set no cookies of their own, load no analytics or advertising scripts, and use only the fonts already on your device; Cloudflare may set a strictly necessary security cookie if its bot protection is active. Other pages of the bytechimera.com studio site load web fonts from Google Fonts, which means your IP address and user agent reach Google when those pages are displayed, under Google's privacy policy.

7. Retention and deletion

We retain nothing on servers, because we operate none. All Sunpop data lives on your device:

• Skin profile, session history, preferences — kept on your device until you reset them in the app or delete the app.
• WeatherKit requests — transient; handled by Apple under its own retention rules.

Deleting Sunpop removes all locally stored profile and session data, including the widget's shared container.

8. Your rights and your choices

You can revoke location and notification permissions at any time in iOS Settings, and erase all app data by deleting the app. Because your data stays on your device and we hold no copy, access and deletion are fully in your hands; for any legal rights request or question, write to support@bytechimera.com.

If you are in the EU/EEA, you have the rights under the GDPR to access, rectify, erase, restrict, or port your personal data, to object to processing, to withdraw consent at any time, and to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).

If you are a California resident, the CCPA/CPRA gives you rights to know, access, correct, and delete personal information, and to opt out of its sale or sharing. We do not sell or share personal information as defined by that law, and we honor universal opt-out signals such as Global Privacy Control by design — there is simply nothing to opt out of.

9. Children

Sunpop is not directed to children under 13 (or the applicable age of digital consent in your country, up to 16 in the EU/EEA) and does not knowingly collect personal information from children. Sunpop has no accounts, no social features, and no advertising.

10. Changes

This policy may be updated when Sunpop's features, service providers, or legal obligations change. The effective date at the top identifies the current version.

11. Contact

Data controller: Przemysław Bocer, Poland. For privacy questions or requests, email support@bytechimera.com. You may also use the Sunpop Support page for general help, but do not include health details or other sensitive information in public channels.