Privacy Policy – Umbrella

Weather app for Android (package com.tennumbers.weatherumbrella)
Last updated: October 16, 2026

This policy explains what personal data the Umbrella app processes, why, on what legal basis, who receives it and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Who is responsible for your data

The data controller is TOP APPS SRL, a company registered in Cluj County, Romania, Trade Register number J12/4935/2018, EUID ROONRC.J12/4935/2018, fiscal code (CUI) 40091369.
Contact for all privacy questions and requests: bvlaps@gmail.com.
We have not appointed a Data Protection Officer, as this is not required for our processing.

2. Summary

• We do not ask you to create an account and we do not collect your name, email or phone number.
• We do not run our own servers that receive data from the app. The app sends only what is needed directly to the weather, place-search and advertising services listed below.
• Your device location is used only to show the weather where you are. It is not sold and the app does not pass it to advertising partners. Advertising partners do, however, estimate your approximate location (city or region level) from your IP address.
• Personalized ads are shown only if you agree to them. You can change your choice at any time in the app, or remove ads with a one-time purchase.
• We use TikTok to measure installs and app opens from our campaigns. Consent is required in the EEA, United Kingdom and Switzerland; see section 3.9 for other regions.

3. What data is processed, why and on what legal basis

3.1 Location

If you allow location access, the app reads your device's approximate or precise location (depending on the permission you grant) to show the forecast for where you are, in the app, in widgets and in the optional daily weather notification.

• Sent to: Open-Meteo and Foreca receive geographic coordinates and, where used by the service, the app language. Android's geocoding service receives coordinates to find the place name. Services contacted over the internet also receive your IP address and technical request information as part of the connection. This applies to ordinary forecast requests as well as widget and notification updates.
• Stored on your device: the last known location and the forecast for it, so the app and widgets can open quickly. The main forecast cache expires after 3 days. Expired entries are removed when accessed or during cache cleanup while the app runs; they may remain in local storage longer if the app is not used.
• Legal basis: your consent (Art. 6(1)(a) GDPR), given through the Android location permission. You can withdraw it at any time in the Android settings; you can still use the app by searching for a place.
• Approximate location for ads: independently of the location permission, the advertising partners in section 3.4 estimate your approximate location from your IP address and use it to choose relevant ads, to comply with local laws and to prevent fraud. The app never gives them your GPS coordinates.

3.2 Places you search for

When you search for a city, the text you type and the app language are sent to the GeoNames service to return matching places. GeoNames also receives your connection IP address. Your list of saved places is stored locally. When you request weather for a manually selected place, its coordinates are sent to Open-Meteo or Foreca, together with the app language where used by the service and your connection IP address. This happens even without Android location permission: these coordinates describe the selected place, not a location read from your device. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR), including finding the place and obtaining its forecast.

3.3 Settings

Your preferences (units, icons, notifications, widget settings, whether the in-app review was already requested) and your ad consent choices are stored locally and are not sent to us. Android may also back up your display settings (units and icons), the app-usage counters used to decide when to ask for a rating, and the purchase status to your Google account, depending on your Android version and backup settings, and restore them when you reinstall the app or set up another device. The display settings and usage counters may also be transferred directly between devices. Your location, saved places, notification and widget settings, ad consent choices and cached forecasts are not included in these backups. You can manage cloud backups through Android and your Google account settings.

3.4 Advertising

The free version of the app is funded by ads served by Google AdMob, which may use the mediation partners Meta Audience Network and Unity Ads. To show, measure and (with your consent) personalize ads, these partners may collect:

• the advertising ID of your device and other device identifiers;
• IP address, and the approximate location (city or region level) estimated from it;
• device model, operating system, language and app version;
• interactions with ads (views, clicks) and diagnostic data.

Consent: users in the European Economic Area, the United Kingdom and Switzerland are asked for consent with Google's consent tool (IAB Transparency & Consent Framework) before any personalized ads are shown and before information is stored on or read from the device for advertising. If you refuse, you may still see non-personalized or limited ads. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules); for non-personalized ads, the ad partners may rely on legitimate interest for fraud prevention and ad measurement, as described in the consent form.

Your choices: you can change or withdraw your consent at any time from the privacy/ads options in the app menu, reset or delete the advertising ID in your Android settings (Settings › Privacy › Ads), or remove all ads with the in-app purchase.

Profiling: if you consent to personalized ads, our advertising partners may build a profile of your interests from your activity across apps and websites in order to choose which ads to show you. This does not produce legal effects concerning you or similarly significantly affect you. We do not carry out any other profiling or automated decision-making.

3.5 Purchases

The "remove ads" purchase is handled entirely by Google Play. We never see your payment details. The app receives purchase information from Google Play, including the product identifier, purchase status and a purchase token used to acknowledge the purchase with Google Play. Purchase status is stored locally to remember whether ads are removed. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.6 Ratings

The app may once ask you to rate it using Google Play's in-app review. The rating and review are sent to Google Play under your Google account; we receive only the published review, as with any review on Google Play.

3.7 Notifications

The optional weather notifications are created on your device; no push notification service is used. They use a cached forecast when available, but may request an updated forecast in the background when it is missing or expired. These requests send the selected or detected location's coordinates and app language to the weather providers described in section 3.1, and the providers also receive your IP address as part of the connection.

3.8 Contacting us

If you email us, we use your email address and message only to answer you, and delete them when the matter is closed, at the latest after 2 years. Legal basis: our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

3.9 Measuring our advertising campaigns (TikTok)

The app includes the TikTok Business SDK to measure which campaigns lead to installations and app opens. When enabled, it sends the advertising ID and an SDK identifier, install and app-open events, next-day return events, Google Play install referrer and installation source, device model, operating system, language, screen size, network type, user agent and IP address to TikTok. The app does not send device coordinates, searches or settings to TikTok. We receive aggregated campaign reports rather than information identifying individual users.

In the EEA, United Kingdom and Switzerland, this measurement requires consent through the consent form (Art. 6(1)(a) GDPR and applicable ePrivacy rules). You can change or withdraw your choice from the privacy/ads options in the app menu. Outside these regions, the SDK may run without a separate campaign-measurement opt-in when the consent tool reports that GDPR does not apply. There is no separate worldwide TikTok opt-out switch. Resetting or deleting your advertising ID in Android settings does not by itself stop all SDK data collection.

3.10 Is providing data required?

No. You are not required by law or contract to provide any personal data. If you do not grant location access, you can still use the app by searching for a place. If you refuse personalized ads or decline campaign measurement where that choice is offered, the app still works. Depending on your choices and region, non-personalized or limited ads may still be shown.

4. Recipients

All data is sent over encrypted connections (HTTPS). We do not sell personal data.

5. Transfers outside the EEA

Some recipients (Google, Meta, Unity, TikTok) may process data in the United States or other countries outside the European Economic Area. The mechanism depends on the recipient, destination and service: an adequacy decision may apply (including the EU–U.S. Data Privacy Framework for transfers within a certified recipient's certification scope), or contractual safeguards such as the European Commission's Standard Contractual Clauses may be used. A recipient's use of one mechanism does not mean it covers every transfer.

The providers publish information about international processing and safeguards here:

• Google: data transfer frameworks.
• Meta: privacy policy and international transfers.
• Unity: app-user privacy policy and data processing addendum.
• TikTok: partner-data privacy policy and jurisdiction-specific data terms.

The weather and place-search providers' privacy information is linked in section 4. To request details or a copy of the safeguards relevant to data sent through this app, contact bvlaps@gmail.com. You may also contact the provider using the contact details in its policy.

6. How long data is kept

• Local settings and other stored app data remain until removed by the app or until you uninstall it or clear its data. The main forecast cache expires after 3 days; expiry makes it unavailable through the normal cache lookup but does not guarantee immediate physical deletion. Expired entries are removed on access or during cleanup while the app runs.
• Android backups of selected settings and purchase-status data are managed separately by Android and your backup provider. Uninstalling the app or clearing its local data does not necessarily remove these backups; manage them through your device and Google account settings. Backed-up settings may be restored on a later installation.
• Data received by the weather, place-search, advertising and campaign-measurement partners is kept according to their own policies linked above. Open-Meteo states that individual API logs, which may include IP addresses and requested coordinates, are deleted after 90 days; aggregated API usage statistics may be retained. This is separate from the app's local forecast cache.
• Emails to us: until the matter is closed, at most 2 years.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have it corrected or deleted;
• restrict or object to its processing, including processing based on legitimate interest;
• data portability;
• withdraw your consent at any time, without affecting processing done before;
• lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP); you can also contact the authority in your own country.

Because the app does not send your data to us, most data can be removed directly by you: uninstall the app or clear its data in the Android settings, revoke the location permission, and change your ad choices as described in section 3.4. For anything else, write to bvlaps@gmail.com; we answer within one month. For data held by our partners, you can also contact them directly using the links above.

8. Children

The app is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

9. Security

All communication with the services above uses HTTPS. Data kept on the device is stored in the app's private storage, which other apps cannot read.

10. Changes to this policy

We will update this page when the app's data practices change and change the date at the top. If a change requires your consent, we will ask for it in the app.