Privacy Policy

1. Who Is Responsible for Your Data

The data controller is Oleksandr Andriushko (sole proprietor), Ukraine. For data inquiries, contact o.andriushko@gmail.com; inquiries are answered within 30 days. Stalex complies with the Law of Ukraine “On Personal Data Protection” and the GDPR.

2. Summary

The alert map, your sector, notifications, widgets, Apple Watch, and power outage schedules work WITHOUT signing up. Sign in with Apple is required only for Chats and On Air. We don’t sell data, don’t use ad networks, advertising identifiers (IDFA), or analytics or other third-party SDKs, and don’t track you across apps.

Ads in On Air are user posts reviewed by a moderator, with no tracking whatsoever.

3. Location

If you allow it, the app determines your community (hromada), district and region from your location RIGHT ON YOUR DEVICE (about 1 km accuracy, without contacting the server). For alerts and notifications, only the NAMES of places are sent to the Stalex server, never coordinates.

For the weather forecast, a point (your location or the center of the chosen sector) is sent to Apple WeatherKit — not to the Stalex server. Your exact location is sent to the Stalex server only when you turn on SOS yourself (Section 9). You can turn off location access and choose your sector manually.

4. Data on Your Device

Your selected sector, “Watching” places, power addresses, vibration mode, language, voice and sounds, the state used by widgets, complications and Live Activity, and the cache of voice phrases and media are stored on your device and are deleted together with the app. The minute of silence at 9:00 is a local notification; no server is used for it.

5. Server Technical Data

To show alerts, the app contacts our server for Trembita Pro data. Like any web server, it processes technical request data (IP address, time) in security logs, which are kept for a limited time and used only for protection and stable operation.

6. Notifications

To deliver push notifications and Live Activities, the server stores an anonymous installation record that isn’t linked to any account: a random installation identifier, notification and Live Activity tokens, the platform, the NAMES of your sector and your “Watching” places (not coordinates), the voice, the language, the latest alert status, and your power notification subscription (Section 7).

The text of voice notifications (the place name and the threat type) is spoken by the Trembita Pro voice server. Records that have been inactive for 60 days are deleted automatically.

7. Power

To send notifications about power outages and restorations, the server stores the region, the operator, the group (queue) and the place name you entered — in the anonymous installation record, without an account or coordinates.

The server downloads schedules from YASNO and the open projects outage-data-ua, OE_OUTAGE_DATA and gpv-voe-vinnytsia (copies of the DTEK and regional power company websites) without any of your data. If you look up your group by address, the address text passes through our server to the YASNO directory.

7a. Transit, Shelters, and “My Location”

The Transport section works without sign-up. Your location (for the city, nearby stops and trips) and the “From / To” addresses are used only on your iPhone: the app itself calculates trip options. The Stalex server receives only the city name and the number of the stop whose arrivals you are viewing — without coordinates and without being linked to you.

The server sends “when it’s near” notifications based on the stop number and route; the app uses your location only while it is on screen. Address search and walking routes are provided by Apple Maps.

Shelters: the list is downloaded directly from the official maps of city councils (Kyiv — Kyiv City State Administration, Kharkiv, Dnipro, Zaporizhzhia; Odesa — via our server) without your data, and the nearest ones are calculated on the iPhone. A manually set “My place” (if electronic warfare shifts GPS) is stored only on the device.

Transport data is the cities’ open data: Lviv City Council (Lvivavtodor), Kyiv City State Administration (Kyivpastrans, Kyiv Metro, minibus operators) under the CC BY 4.0 license.

8. Sign in with Apple

Signing in is required only for Chats and On Air. The app requests only your name from Apple. The server stores your Apple identifier (without your email address), your first and last name, and an Apple token used to revoke access when you delete your account. Session: access — 1 hour, refresh — 60 days.

9. Chats

Conversations in Chats are end-to-end encrypted: your iPhone encrypts text, edits, deletions, reactions, pins, replies, polls, and attachments for each recipient (X25519, HKDF-SHA256, ChaCha20-Poly1305); each file is encrypted with its own random key. The server sees only ciphertext and deletes it as soon as all recipients have received it, or after 7 days.

Note: a conversation partner with Stalex Plus can save, on THEIR iPhone, previous versions of messages you edited and messages you deleted “for everyone,” marked “Author deleted for everyone”; these copies are never sent to the server.

History is stored ONLY on participants’ devices, with no copy on the server or in iCloud; it can’t be restored after the app is reinstalled. The private key is stored in Keychain; only the public key is sent to the server.

The server stores: your profile (first name, last name, @username, photo, color, and bio, which others can see), the date you accepted the terms, your last activity time, your visibility, search, and notification settings, your SOS audience, chat memberships, and blocks.

NOT end-to-end encrypted (TLS only): the “In shelter” / “Safe” statuses, SOS and its location, group and topic names and photos, group system events, “typing…,” read receipts, images in your own sticker packs, and metadata (who contacts whom and when).

SOS: a “pin” is a single point; a “live beacon” updates for up to 6 hours, including in the background (with “Always” permission); your location is visible to members of your chats or to people you choose. Statuses, SOS, and reports are stored until the chat or account is deleted.

A phone number is OPTIONAL: if you add one, it’s verified through the Telegram bot @stalex_ua_bot; the server stores the number, your Telegram ID, and a hash of the number, and you decide whether your number is shown and whether others can find you by it.

Finding people you know: your iPhone sends only SHA-256 hashes of the numbers in your contacts (up to 3,000), and the server doesn’t store them. For acquaintances who are already in Stalex, your iPhone remembers how they are named in your contacts (on the device only, never sent to the server) — so they appear that way in chats, calls and notifications.

So you can see who’s calling on the incoming call screen, your iPhone adds Stalex photos only to your contacts that don’t have a photo yet (existing photos are not changed); you can turn this off in Settings → Calls → Stalex photos in Contacts.

So that your family can see alerts in your region (megaphone), the server knows only the NAME of your sector; you can turn this off in Profile. A report sends the moderator the text of the reported message.

The spam filter (drug offers, “job” offers, and anti-Ukrainian propaganda) checks messages ONLY on your iPhone, using rules and the Apple on-device language model; the text isn’t sent anywhere, and you can turn off the filter in Profile.

9a. Calls

Calls in Chats (voice and video, 1:1 only) are end-to-end encrypted: your iPhone encrypts audio and video itself (WebRTC, DTLS-SRTP), and the two iPhones agree on the call keys in envelopes encrypted with Chats keys.

Audio and video go directly between the devices or — if a direct connection isn’t possible or you turned on “Always relay through Stalex” — through our relay, which only sees ciphertext. The server does not record or store calls and keeps no call log: who called whom, when and for how long is not stored anywhere.

To wake the other person’s iPhone, the server stores your device’s VoIP notification token; call checks (whether you share a chat, blocks, spam and overload protection) happen in memory without being written down.

The “Who can call me” setting is stored in your profile; if you choose “Only my contacts”, your iPhone sends the server a list of Stalex users whose numbers are in your contacts (only their ids, no names or numbers) so the server doesn’t wake your iPhone for calls from others; choose another option and the list is deleted.

When the line is busy, the server keeps an anonymous temporary record of an occupied line or a place in the queue — only the priority level (whether either of you has Stalex Plus) and the time, not who is calling whom; it disappears when the call ends or by itself within 90 seconds and is never written to disk.

Your call history exists only on your iPhone; if “Show in Phone app” is on, iOS adds calls to Recents (with iCloud on, they sync with Apple). With a direct connection the other person can technically see your IP address — to avoid this, turn on “Always relay through Stalex”.

9b. Meetings

Stalex Meeting Time meetings (up to 3 participants, up to 10 with Stalex Plus) are end-to-end encrypted: video, audio, chat, files, the whiteboard and polls are encrypted by participants' devices with the meeting key.

The key exists only in the invitation (inside an end-to-end encrypted Chats message) or in the part of the link after “#”, which the browser never sends to the server. The meeting relay on our server forwards only ciphertext and records nothing.

For up to 24 hours the server stores: the organizer, the participant limit, the number of link seats, SHA-256 fingerprints of the invitation and link secrets, the encrypted title and description, and the time of first entry (for the 3-hour limit); for link guests — a random browser identifier (to count seats) and, if join approval is on, the guest's encrypted name and request state.

The server does not know participants' names: in the room everyone is a random identifier; the server only knows whether a person has Stalex Plus (for the badge). Captions are recognized on the speaker's device and translated on the reader's device; in 1:1 calls caption text goes to the other person over the call's encrypted channel.

Background blur and Audience mode are processed only on your device. If there is an alert in your region during a meeting or call, your iPhone tells the participants the region name and threat type — also encrypted.

9c. Stalex on your computer

The web version trembita.app/stalex/app works only after you connect it from your iPhone: the browser shows a one-time QR code, you confirm the sign-in in the app and enter the computer sign-in password you created on your iPhone.

Your iPhone hands the Chats encryption key to the browser encrypted (the browser's one-time X25519 key plus a key derived from the password, PBKDF2-SHA256); the server cannot see it.

The password is stored nowhere: the server keeps only a salt and a SHA-256 fingerprint of the authentication key, and the iPhone keeps only the encryption key derived from it, in the Keychain. In the browser the key is stored as a non-exportable key (IndexedDB), and messages stay only in that browser.

The server knows about the browser: its name (“Chrome · macOS”), connection time and last activity; while a browser is connected, encrypted messages wait on the server until all your devices receive them (no longer than 7 days).

For browser notifications (if you turn them on) the server stores that browser's Web Push subscription address; notification content is encrypted (RFC 8291). “Profile → Active sessions” lists every iPhone and browser where you are signed in; you can end any of them and it loses access immediately.

The map and transport in the browser load map tiles from OpenFreeMap (no cookies or identifiers).

10. On Air

On Air is the public part of Stalex: 27 public region chats (text, stickers, voice messages, and video notes only) and user channels (up to 5 per person; only the owner and the administrators they appoint can post, and channels also allow photos and videos).

On Air is NOT end-to-end encrypted: posts, media, and reactions are stored on the server (protected by TLS), and your name, @username, and avatar shown next to your posts are visible to all On Air users — do not publish your exact address or whereabouts.

The server also stores memberships and subscriptions, channel administrators, reports, restrictions, and blocks. The author can edit a post for 48 hours and delete it at any time; a post can also be deleted by the channel owner or administrators and by the moderator.

Reports are sent to the Stalex moderator (the developer) with the reason and a copy of the post text; the moderator can delete posts, restrict a user from posting (for 7 days or permanently), and block channels.

The green “Founder” badge marks the verified account of the Stalex founder; names and @usernames containing the words owner, admin, administrator, власник, засновник, or модератор are unavailable to others. On Air media is cached on iPhone for 14 days.

11. Stalex Flamingo, Stalex Plus, Ads, and Gifts

Paid features are optional Stalex Flamingo 🦩 packs (the in-app currency) and the monthly Stalex Plus subscription via Apple In-App Purchase.

For Stalex Plus, the server stores the subscription identifier, product and expiration date, as well as: your chosen name color and the Plus mark (others see them next to your name), the “read without receipts” setting, and records of the monthly Flamingo bonus; scheduled messages in Chats — only as ciphertext until the minute of delivery (the server cannot read them); scheduled channel posts — until publication; daily transport watches — city, route, stop, days and time, and a notification token, linked to your account.

Copies of edits and deleted messages, voice transcriptions and translations are made and stored only by the iPhone (Apple speech recognition and translation run on the device). For a channel, the payment dates and method (Flamingo or gifts) and the channel’s gifts are stored.

We never see your card details: the server receives an Apple-signed transaction (identifier, product, date, environment) linked to your account and credits Flamingo to your balance. A history of Flamingo movements is kept (top-ups, reservations and charges for ads, refunds, gifts).

For an ad, the image or banner, link, text, region (or “all users” for the gold banner), display time and duration, price, status and the moderator’s decision are stored. Ads are not targeted at individuals and do not use your data.

Statistics for advertisers are anonymous: the app reports an impression (once per device per placement) and a link tap to the server with a random device fingerprint — a SHA-256 of the installation identifier and the ad number, different for each ad, so a person cannot be tracked across ads.

A gift is stored on the server (what, from whom, to whom, when, edition number, message); others can see the collection of gifts you received in your profile — each gift can be hidden. An “incognito” gift does not reveal the sender to anyone, not even the recipient (the server keeps it only for Flamingo accounting and abuse prevention).

When Apple issues a refund, Flamingo is deducted from your balance (up to the remaining amount). Purchase records are kept for accounting.

12. Where Data Is Stored

The Stalex server (api.trembita.app) is hosted in the European Union (Contabo GmbH, Germany); connections use HTTPS/TLS only. Data is also processed by: Apple (sign-in, notifications, WeatherKit, MapKit, purchases), Telegram (phone number verification only), YASNO (address lookup only), Trembita Pro (alerts and voice).

13. Deletion

Profile → Account → “Delete account” erases from the server the text and media of your messages in Chats, reactions, personal chats, your profile (including your phone number), sessions, memberships, blocks and avatar; groups are handed over to the oldest member; your On Air channels are deleted together with their posts, while your posts in regional chats and other people’s channels remain without your name, @username and avatar (delete them beforehand if you don’t want them to stay); any unused ad balance is deleted (purchase records are kept for accounting); devices are unlinked, the Apple token is revoked, and Chats data and the encryption key are erased on the iPhone.

The server cannot delete messages already on your contacts’ devices. Alert signals keep working without signing in.

14. Your Rights

Under the Law of Ukraine “On Personal Data Protection” and the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent, as well as the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or an EU supervisory authority.

Contact o.andriushko@gmail.com.

15. Age Requirements

Social features (Chats, On Air) are intended for people aged 18 and over. The alert map and signals are available to everyone.