Legal
Data privacy policy
Last updated
-
Introduction
AirTag History turns your AirTags' location pings into a timestamped history. This policy explains what data we collect to do that, why, and what rights you have over it. AirTag History is a small, early-stage product — this policy reflects exactly what the service does today, not aspirational claims about a future version.
-
Who is responsible for your data
The controller of your personal data is RAZVOJ PROGRAMSKE OPREME IN DIGITALNO SVETOVANJE, GREGA KEŠPRET S.P. (short name GREGA KEŠPRET S.P.), a sole proprietorship registered in the Slovenian Business Register (registration number 7575394000), Preloge 5, 1211 Ljubljana, Slovenia. Contact: [email protected].
-
Information we collect
- Account details. Your email address, a securely hashed version of your AirTag History password (never the password itself), and your time zone. If you sign in with Google instead, we receive your email address from Google.
- Apple ID authentication tokens. When you connect your Apple ID, we use your Apple ID credentials once to obtain session, CloudKit, and search-party tokens, which we store encrypted until they expire. Your Apple ID password itself is never stored — it is discarded immediately after sign-in, by design.
- Payment and billing records. If you buy a pass or subscribe, Stripe processes the payment. We do not see or store your full card number. We keep your Stripe customer reference and a record of what you bought, when, and until when it records.
- AirTag location data. Encrypted location reports for AirTags registered to your signed-in Apple ID, decrypted into timestamped coordinates so we can build your history, routes, and stop/dwell detection.
- Basic website request data. This page and the AirTag History homepage load fonts from Google Fonts' servers, which — like any font CDN — sees the requesting device's IP address. We don't run analytics or advertising trackers on this site today.
-
How we use your information
- To build and display your AirTag location timeline, routes, and stop/dwell detection
- To generate exports (e.g. timestamped reports) that you request
- To take payment for passes and subscriptions, and to issue receipts and refunds
- To send account emails, such as verifying your address and confirming your connection
- To maintain and secure the service, including detecting abuse
- To comply with legal obligations where applicable
-
Legal basis for processing (GDPR)
Where GDPR applies, we rely on:
- Performance of a contract — to provide the service you signed up and paid for: your account, connecting your Apple ID, recording and showing your items' location history, taking payment, and sending account emails
- Legitimate interest — keeping the service secure and preventing abuse, including stalking
- Legal obligation — keeping payment records as accounting and tax law requires, and responding to lawful requests from authorities
-
Information sharing and disclosure
We do not sell your data, and we do not share it for advertising purposes. We disclose data only to:
- Railway, which hosts the service and its database
- Stripe, which processes payments and stores payment details
- Resend, which delivers our account emails
- Google, if you choose to sign in with Google, and as a standard part of loading this website's fonts (see above) — no location data is sent to Google
- Apple: to record your items, we request their encrypted location reports from Apple's Find My service using your Apple ID tokens
- Authorities, if legally required to respond to a valid request
-
Cookies and tracking technologies
AirTag History does not use analytics or advertising cookies. It sets only cookies the service needs to work:
- a sign-in cookie that keeps you logged in;
- a short-lived cookie that protects the “Sign in with Google” step, removed after 10 minutes;
- a cookie that remembers you closed the free-tracking reminder, kept until that free window ends.
Stripe's checkout page, which you reach when you pay, sets its own cookies under Stripe's policy. Apart from Stripe checkout and Google sign-in when you use them, the only third-party request this site makes is loading typefaces from Google Fonts. If that changes, we'll update this section.
-
Your rights and choices
If you're in the EU/EEA or UK, you have the right to access, correct, or erase your data, restrict or object to processing, and request data portability. Contact us (below) and we'll respond within 30 days. You also have the right to lodge a complaint with a data protection authority — in Slovenia, the Information Commissioner (Informacijski pooblaščenec), or the authority in the country where you live.
If you're a US resident, you have the right to know what data we hold about you and to request its deletion. We do not sell personal information, so there is nothing to opt out of in that respect.
-
Data security
We never store your Apple ID password — only session tokens, encrypted at rest. Data is encrypted in transit and held with reputable infrastructure providers. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we design the system to minimize what's stored and for how long.
Your data is kept separate from other users'. Every AirTag, location record, and session is tied to exactly one account. We do not pool, cross-reference, or aggregate one user's location history with another's, and no user can access another user's data.
-
Data retention
We keep your account and your AirTag location history until you ask us to delete them, including after a pass or free window ends — recording stops then, but your history stays available to you. Email us to delete your account and data, and we will.
Apple ID tokens are kept only until they expire or you disconnect. Payment and billing records are kept for as long as Slovenian accounting and tax law requires (currently up to 10 years), even after your account is deleted; they do not include your location history.
-
International data transfers
Railway, Stripe, Resend and Google are based in the United States, so your data may be processed there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in the provider's data processing terms.
-
Children's privacy
AirTag History is not directed at, and should not be used by, children under 16.
-
Anti-stalking and acceptable use
AirTag History can only build history for AirTags registered to the Apple ID you sign in with — the underlying cryptography doesn't allow tracking anyone else's tag, and neither do we. We support Apple's and Google's unknown-tracker alerts, and AirTag History's acceptable-use policy prohibits using it to track people rather than belongings.
-
Changes to this policy
We may update this policy as the service changes. Material changes will be reflected by updating the date at the top of this page.
-
Contact us
Questions about this policy or your data: [email protected]. The controller's details are under Who is responsible for your data.