vreme.to · LabForty

Vreme.to Privacy Policy

Effective date: Monday, 14 September 2026

This policy covers Vreme.to for iOS and any Android version when released. The practices described here reflect the current iOS release. Before the Android release, this notice will be reviewed and updated to explain any differences in data handling. Subscriptions are also planned, and any resulting changes will be addressed before they take effect.

1. Who is responsible for your data

Lab40 Ltd, registered in Bulgaria as „Лаб40“ ЕООД, is the controller responsible for the personal data described in this policy.

Company registration number (EIK/UIC): 205622271
VAT identification number: BG205622271

Address: 56 Kapitan Raicho str, Plovdiv, Bulgaria
Privacy and support contact: support@labforty.com

Vreme.to is a weather app offered primarily in Bulgaria. The current app is free, has no user accounts, and has no advertising, payment or subscription integration. It does not use an advertising or commercial analytics SDK. It does process location and technical information as explained below.

2. Information used by the app

Location and places you choose. If you permit location access, the app obtains your device's latitude and longitude to show local weather. These coordinates may be precise, depending on your device settings and the available location signal. You can instead search for a place. Searches, selected places and map areas can also reveal locations that interest you, even when they are not your actual location.

The app sends coordinates and relevant place searches to our weather services to obtain forecasts, place names, local times and related information. Our services forward the queries needed to answer your request to weather providers. A map request can reveal the area being viewed.

The app saves your current and saved locations, recent searches, preferences and cached weather on your device so they remain available when you reopen it. It also saves the last device location and its update time. Device location is refreshed when the app starts or returns to the foreground where permission allows. The current app does not continuously track your GPS location in the background.

Notifications. If you enable weather notifications, the app may check weather for previously stored locations when iOS allows it to run in the background. Notifications are scheduled on your device. The current app does not register a remote notification token with our server. You can turn notifications off in the app or in iOS Settings.

Photos and Sky identification. When you use Sky identification, you can take a photo or select one from your library. The identification model runs on your device. This feature does not upload your photos to a cloud AI service or send them for AI training. If Sky history is enabled, the app keeps a local photo reference, the result, the capture time and the selected location. Corrections you make to a classification are also stored locally. History saving is enabled by default and can be switched off in Settings.

AI-assisted place images. Our backend may send a public destination image, the destination name, country or region, and descriptive search information to Anthropic to assess whether the image is suitable to illustrate that place. This can disclose a place you are viewing or searching for. It does not send your device GPS coordinates or your own Sky photos as part of that image assessment, and it is not advertising personalization. Where a public-weather summary is available, Anthropic may also receive public weather-discussion text and a storm name to summarize that information.

Technical and diagnostic information. Network services receive your IP address and information needed to deliver a request, such as its time and the resource requested. Our backend records weather-provider requests for reliability and troubleshooting. Those records can include queried coordinates, request paths, response status, timing and network request identifiers. They are not account profiles.

The app also keeps a rolling diagnostic log of connection failures, cache activity and map behavior. Entries can include map centers, zoom levels, recent map actions and portions of failed-request addresses, which may contain coordinates. The app automatically attempts to send this log to our diagnostic endpoint at startup when enough events have accumulated. These uploaded diagnostic reports are not retained by our backend. Network and request metadata associated with delivering the request is separate and may be processed by our hosting provider as described below.

Messages you send us. If you email support or make a privacy request, we receive your email address, any name you provide, your message and attachments. Send only the information needed for your request. The current release does not expose an in-app feedback form.

Calendar and sharing. Adding an astronomy event opens the system's event-creation or sharing interface. The app does not read your calendar entries. If you choose to share an image, forecast or diagnostic log, your selected recipient or service receives the content you share.

3. Why we process information and our legal bases

Under the General Data Protection Regulation (GDPR), we use the following bases for the stated purposes:

Purpose Information involved Legal basis
Provide the weather, map and place features you request, select suitable public place illustrations, summarize public weather text where available, and remember your choices Selected places, required coordinates, searches, public place images and descriptive information, public weather text, preferences, request information and caches Performance of our agreement to provide the app's requested services — Article 6(1)(b)
Obtain your device location and access photos or the camera for optional features Device coordinates and the photos you choose Your consent — Article 6(1)(a)
Diagnose faults and keep the service available and secure Provider-request records, network information and app diagnostics Our legitimate interests in operating a reliable, secure weather service — Article 6(1)(f), subject to your rights and interests
Respond to support messages Contact details, correspondence and attachments Our legitimate interest in answering your inquiry — Article 6(1)(f)
Handle privacy rights requests and comply with applicable legal requirements Request details and information reasonably necessary to handle them Compliance with a legal obligation — Article 6(1)(c)

Reading or using this policy is not consent to every processing activity. Device permissions control access to device features; they do not authorize unrelated uses of your information. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Providing device location or photos is optional. Refusing location access still lets you select a place manually; refusing camera or photo access prevents the corresponding Sky function. Providing a location query and ordinary network request information is necessary to retrieve online weather for that location. We cannot answer a support inquiry without receiving its contents and a way to reply.

4. Who receives information

We use external services to deliver the app:

  • Cloudflare hosts and delivers our backend services. It processes requests, including network information and the coordinates or searches sent to those services. See Cloudflare's privacy policy.
  • Weather and place providers, including Foreca, Open-Meteo and The Weather Company, receive the query information needed for the requested weather or location feature. These app requests generally pass through our backend, so the provider receives the backend connection rather than a direct connection from your device. Different weather layers may use other specialist data sources.
  • Anthropic receives public destination images and the associated place names, country or region and descriptive information from our backend to assess image suitability. Where available, it also receives public weather-discussion text and storm names for summarization. See Anthropic's commercial-data privacy information and commercial retention information.
  • OpenFreeMap supplies map tiles, fonts and symbols directly to the app. Its network receives your IP address and requests that can reveal the map area being viewed. See OpenFreeMap's privacy policy.
  • Unsplash's image service may deliver a place image directly to your device when that image is used, receiving your IP address and the image request. Other place images are delivered through our backend. These are illustrations of places, not your Sky photos. See Unsplash's privacy policy.
  • Apple provides iOS device services, including permissions, native location/place lookup, system sharing and the App Store. Apple's handling of those services is described in Apple's privacy policy.
  • Microsoft email services process correspondence sent to our support address, including your email address, any name you provide, messages and attachments. See Microsoft’s privacy statement.

Information may also be disclosed where necessary to comply with an applicable legal requirement or to establish, exercise or defend legal claims. We do not sell your personal data or use it to deliver targeted advertising. External services' notices describe their own processing; they do not replace our responsibility for the processing described here.

5. International processing

Our backend uses Cloudflare's global network. Information may be processed outside Bulgaria and the European Economic Area (EEA), and processing is not limited to an EU-only hosting location. Other providers may also process information internationally.

For transfers subject to GDPR restrictions, the applicable safeguards include adequacy decisions and contractual protections such as the European Commission's standard contractual clauses (SCCs). The providers' published standard arrangements include:

You can contact support@labforty.com for information about relevant transfers and a copy of the applicable safeguards. Information that would compromise another person's rights or confidential security arrangements may be redacted.

6. How long information is kept

Information Retention or deletion criteria
Locations, preferences and locally cached information Kept on your device until replaced, cleared through the available controls, or removed with the app's local data. Recent searches are limited to 10. There is no universal automatic expiry for every saved preference or location.
Sky history Up to 50 recent entries are kept locally; the oldest entries are replaced as new ones are saved. Disabling history saving does not erase existing entries. Classification corrections and local image files may remain until the app's local data is removed.
Local diagnostic log A rolling maximum of 200 events, with older events replaced. You can clear the log in the diagnostics screen.
Our weather-provider request logs Normally about 14 days under the current configuration; periodic cleanup or storage limits determine the actual removal time.
Our geographic lookup cache Approximately 30 days per cached entry. The lookup key uses rounded coordinates; this is a shared geographic cache, not a named location-history account. A later request can create a new entry. Other weather caches use refresh periods suited to the data.
Routine support emails and attachments Kept for 12 months after the support case is closed, then deleted. If a legal requirement or legal claim requires longer retention, we keep only the records needed for that purpose and delete them when the need ends.
Privacy-rights request records Kept only as long as necessary to demonstrate how we handled the request, meet applicable legal obligations or establish, exercise or defend legal claims. We review the continuing need and delete records when it ends.
Uploaded diagnostic reports Not retained by our backend. This does not cover the separate network and request metadata described below.
Cloudflare network and security records Kept according to the purposes of delivering and securing its services and applicable legal obligations. Cloudflare considers the purpose, nature and sensitivity of the data, risks, and legal or contractual needs when deciding retention; its privacy policy does not give a single period for all such records.
Cloudflare Workers runtime logs, if enabled The published standard retention is 3 days on Workers Free and 7 days on Workers Paid. These periods concern the Workers Logs product, separately from our own provider-request logs and other Cloudflare security records. See Workers Logs documentation.
Inputs and outputs held by Anthropic for the cloud-AI features above Under its standard API policy, Anthropic deletes inputs and outputs within 30 days of receipt or generation. Different periods can apply because of the feature used, an agreement, safety and usage-policy enforcement, or legal requirements. See Anthropic’s commercial retention information.

After we delete email, Microsoft may temporarily retain recoverable copies under the applicable service settings. A legally required hold may delay their removal. This recovery or legal preservation is separate from our routine support-retention period. Other providers apply the retention rules for their own services, as described in their notices linked above.

Clearing a local log or deleting the app does not automatically delete information already received by a server, a person you contacted or a service you chose for sharing. Device and cloud backups are managed separately through your platform and backup settings.

7. Your controls and rights

You can revoke location, camera or photo permissions in iOS Settings. You can disable weather notifications and future Sky-history saving in the app. Search includes a control to clear recent searches. The diagnostics screen can clear its local log, and Settings provides a control to clear offline caches. Clearing offline caches preserves saved user settings and locations. The current app has no account to delete and no single in-app control that erases all local information; use the device's app-data removal controls for the remaining local data.

Subject to the GDPR's conditions, you can request access to your personal data, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests because of your particular situation. You can also withdraw consent where consent is the basis for processing.

Contact support@labforty.com to exercise these rights. We may request proportionate information to verify your identity or locate the relevant records. We do not maintain accounts that connect all requests to a named person, and we cannot remotely access information held only on your device. If we cannot identify relevant records, we will explain that and consider any additional information you choose to provide; we will not collect extra information solely to create an identity record.

We normally respond within one month. Where the GDPR permits an extension because of complexity or the number of requests, we will explain it within that month; the extension can be up to two further months. Requests are normally free. Rights have legal limits, for example where records must be retained under law or for legal claims; we will explain any refusal and your complaint options.

You may complain to the Bulgarian Commission for Personal Data Protection (CPDP) at cpdp.bg, or to the competent supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first.

The app does not make solely automated decisions about you that produce legal or similarly significant effects. Sky identification predicts a cloud type; it does not make a decision about your rights or eligibility.

8. Children

Vreme.to is intended for a general audience and is not specifically directed at children. In Bulgaria, where processing requires a child's consent, a child under 14 needs consent from a parent or legal guardian. The age of 14 is a rule about valid consent, not a blanket minimum age for using every part of the app. A device permission prompt alone does not verify parental consent. Parents or guardians can contact us about a child's information at the address above.

9. Security and changes

Our weather and map requests use HTTPS, and access to our administrative provider logs is restricted. Device-local information is held within the app's storage. No internet service or device can guarantee absolute security.

We will update this notice when our processing changes, and identify the effective date of the revised notice. Material changes, including new payment or Android functionality that changes data handling, will be explained before they take effect. Where a new use needs consent, we will obtain it separately.