Last updated: March 3, 2026
Heimdallr is a real-time natural disaster monitoring application that displays publicly available data about earthquakes, volcanic activity, tsunamis, wildfires, cyclones, severe weather alerts, ISS tracking, and tectonic plate boundaries on an interactive map. This privacy policy explains how the app handles your data.
In short: Heimdallr does not collect personal data itself. Your settings and cached data stay on your device. Some third-party services used by the app (Cloudflare, MapTiler) may process limited metadata as described below.
Heimdallr stores the following data exclusively on your device using your browser's local storage. This data never leaves your device and is not accessible to us or any third party:
All locally stored data is deleted when you uninstall the app or clear the app's data through your device settings.
Heimdallr fetches publicly available data from the following government and scientific sources. These requests are read-only (the app only downloads data, it does not upload any information):
| Source | Data | Provider |
|---|---|---|
| USGS Earthquake Hazards | Earthquake data | U.S. Geological Survey |
| USGS Volcano Hazards | Volcano alert data | U.S. Geological Survey |
| INGV | Italian seismic data | Istituto Nazionale di Geofisica e Vulcanologia |
| EMSC | European seismic data | Euro-Mediterranean Seismological Centre |
| NWS | Tsunami alerts (US) | National Weather Service (NOAA) |
| NOAA NWS | Severe weather alerts (US) | National Oceanic and Atmospheric Administration |
| GDACS | Volcanic eruptions, tsunami alerts | Global Disaster Alerting Coordination System (UN/EC) |
| NASA FIRMS | Satellite fire hotspots | NASA |
| NIFC | US fire perimeters | National Interagency Fire Center |
| Smithsonian GVP | Global volcano catalog | Smithsonian Institution |
| WMO SWIC | Severe weather alerts | World Meteorological Organization |
| EUMETNET MeteoAlarm | European severe weather warnings | EUMETNET (Network of European Meteorological Services) |
| EUMETNET E-SOH | European surface observations (temperature, wind, humidity, pressure) | EUMETNET MeteoGate |
| Esri Active Hurricanes | Tropical cyclone tracking | NHC/JTWC via Esri ArcGIS |
| Where the ISS at? | ISS position | Open community API |
Heimdallr uses MapTiler for map rendering, weather overlays, location search (forward geocoding), and reverse geocoding of map coordinates (for wildfire hotspots and the "What's here?" context menu feature). When the app loads map tiles, performs a location search, or resolves coordinates to a place name, your device sends requests to MapTiler's servers that include the geographic coordinates or search query. MapTiler's handling of this data is governed by their privacy policy.
Heimdallr itself does not set any cookies. However, MapTiler's servers set two third-party cookies on
the api.maptiler.com domain:
_hjSessionUser — Used by Hotjar, MapTiler's analytics provider_cfuvid — Used by Cloudflare, MapTiler's CDN providerThese cookies are set by MapTiler's infrastructure, not by Heimdallr, and we have no control over them. Third-party cookies may be blocked by your browser depending on your privacy settings.
The web version of Heimdallr uses Cloudflare Web Analytics to collect anonymous, aggregate page view metrics (e.g. page loads, referrers, country). This service does not use cookies, does not collect personal data, and does not track individual users across sites. Cloudflare's handling of this data is governed by their privacy policy. The Android app does not include any analytics.
On the web version only, some API requests are routed through a self-hosted Cloudflare Worker that acts as a CORS proxy to work around browser security restrictions. This worker forwards requests to public data sources and returns the responses — the worker code itself does not store or inspect any request data, but Cloudflare's infrastructure may collect standard request metadata (such as IP addresses, URLs, and response status codes) as part of its Workers Observability service, which we use to monitor errors and performance. This data is retained by Cloudflare according to their privacy policy. The worker's source code is part of this project. On the Android app, all requests go directly to the data sources via the native HTTP layer and no proxy is used.
Heimdallr does not collect personal data itself. However, third-party services used by the app (Cloudflare, MapTiler) may process limited technical data such as IP addresses as part of delivering their services. Under the EU General Data Protection Regulation (GDPR), the UK GDPR, Switzerland's Federal Act on Data Protection (nFADP), and Brazil's Lei Geral de Proteção de Dados (LGPD), we rely on legitimate interest as the legal basis for this processing:
Heimdallr stores data on your device using the browser's localStorage API. Under the EU ePrivacy Directive (2002/58/EC, Article 5(3)) and its national implementations, storing information on a user's device requires either consent or a "strictly necessary" exemption. All data Heimdallr stores locally (user preferences, event caches, notification tracking, geocode cache, UI state) is strictly necessary for the service you have requested — the app cannot function without remembering your settings and caching data to reduce network requests. No consent is required for this storage. This data never leaves your device and is not accessible to us or any third party.
Cloudflare and MapTiler process data globally through their infrastructure networks. When your browser makes requests to these services, technical data (such as your IP address) may be processed outside the European Economic Area (EEA), the United Kingdom, Switzerland, or Brazil. Both providers maintain appropriate safeguards for international data transfers:
Public data source APIs (USGS, EMSC, WMO, etc.) are operated by government and scientific institutions. On the web version, most requests to these sources are routed through the Cloudflare CORS proxy, so only the proxy's IP address reaches the upstream server. On Android, requests go directly to each source.
Heimdallr does not retain any data on its own servers. For third-party services:
Heimdallr can send local notifications to alert you about new natural disaster events. These notifications are generated entirely on your device based on data already fetched from public sources. No notification data is sent to any server. You can disable notifications at any time in the app's settings or through your device's notification settings.
On Android, Heimdallr can optionally run a background monitoring service to continue checking for new events while the app is not in the foreground. This service runs entirely on your device and does not transmit any data to us. You can enable or disable this feature in the app's settings.
Heimdallr does not knowingly collect any personal information from anyone, including children under 13 (or the applicable age of digital consent in your jurisdiction, such as 16 under the EU GDPR). The app displays publicly available scientific data and does not contain advertising, in-app purchases, or social features. If a parent or guardian believes their child has provided any information through the app, they may contact us at worldviewheimdall@gmail.com and we will promptly delete any such information.
All network communication uses HTTPS encryption. The app enforces a strict Content Security Policy and does not allow cleartext (unencrypted) traffic.
Because Heimdallr does not collect or store personal data on its servers, most data subject rights apply to the third-party processors (Cloudflare, MapTiler) rather than to us directly. Nonetheless, we respect and facilitate the rights granted to you by your applicable data protection law, including the EU GDPR, UK GDPR, Switzerland's nFADP, Brazil's LGPD, India's DPDPA, Japan's APPI, South Korea's PIPA, and other regulations described below.
Under the EU General Data Protection Regulation and the UK GDPR, you have the following rights:
static.cloudflareinsights.com domain using a browser content blocker.To exercise these rights, contact us at worldviewheimdall@gmail.com. We will respond within 30 days.
Under Brazil's Lei Geral de Proteção de Dados (LGPD), you have rights that include:
To exercise these rights, contact us at worldviewheimdall@gmail.com. This email also serves as our LGPD communication channel. We will respond within 15 days as required by LGPD.
Heimdallr is a free, non-commercial project that does not meet the applicability thresholds of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) — it has no revenue, does not sell or share personal information, and does not process data of 100,000 or more California consumers. No "Do Not Sell or Share" mechanism is required. California residents may contact us at worldviewheimdall@gmail.com with any privacy questions.
Under Switzerland's revised Federal Act on Data Protection (nFADP, effective September 1, 2023), you have rights including access, rectification, erasure, data portability, and the right to object to processing. This is particularly relevant as MapTiler AG, one of the third-party services used by this app, is headquartered in Switzerland. MapTiler processes map tile requests and geocoding queries in accordance with Swiss data protection law and their privacy policy. To exercise your rights under the nFADP, contact us at worldviewheimdall@gmail.com. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).
Under India's Digital Personal Data Protection Act (DPDPA, 2023), you have rights as a data principal including:
Since Heimdallr does not collect personal data itself, these rights primarily concern the limited technical metadata processed by third-party services. To exercise these rights or raise a grievance, contact us at worldviewheimdall@gmail.com.
Under Japan's Act on the Protection of Personal Information (APPI), you have the right to request disclosure, correction, cessation of use, and deletion of your personal information held by a business operator. Heimdallr does not hold personal information itself. Third-party API requests made by the app transmit only your IP address as an inherent part of HTTP communication. Japan and the EU maintain a mutual adequacy arrangement for cross-border data transfers. To exercise your rights, contact us at worldviewheimdall@gmail.com.
Under South Korea's Personal Information Protection Act (PIPA, as amended September 2023), you have rights including access, correction, deletion, and suspension of processing of your personal information. South Korea holds an EU adequacy decision (December 2023), facilitating cross-border data transfers under appropriate safeguards. Since Heimdallr does not collect personal information, these rights primarily concern the limited technical metadata processed by third-party services. To exercise your rights, contact us at worldviewheimdall@gmail.com. The supervisory authority is the Personal Information Protection Commission (PIPC).
If you are located in a jurisdiction with applicable data protection laws, you may have similar rights regarding your personal data. Since Heimdallr does not collect personal data itself, your rights primarily concern the limited technical metadata processed by third-party services (Cloudflare, MapTiler) as described above. Applicable laws include but are not limited to:
Under these and any other applicable data protection laws, you generally have the right to access, correct, and delete your personal data, as well as to object to or restrict certain types of processing. All data stored locally on your device can be cleared by clearing the app's data in your device settings or uninstalling the app. Contact us at worldviewheimdall@gmail.com to exercise any applicable rights.
You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data protection rights have been violated. Key authorities include:
The data controller for Heimdallr is Luca Brunelli Lovera, based in the European Union. You can contact the data controller at worldviewheimdall@gmail.com.
We may update this privacy policy from time to time. Any changes will be reflected in the "Last updated" date at the top of this page.
If you have questions about this privacy policy, you can reach us at worldviewheimdall@gmail.com.