Privacy Policy

Controller and contact

Complycated is made and operated by Luke Vink, an independent developer based in Latvia. For privacy questions or requests, email luke@lukevink.com.

Data processed on your devices

Calendar events, reminders, selected photos, music state, Home data, motion state, precise location and complication preferences are processed on your Apple devices for the features you choose to use. Apple permission prompts control access. Most of this information remains on your devices and is shared between your iPhone and Apple Watch using Apple's frameworks.

Transit requests are sent directly from the iPhone to the selected map provider, currently Google Maps Platform or HERE. Those requests can contain search text, stop coordinates, route details and language needed to return a route. Those providers process the requests under their own privacy policies. Complycated's server does not receive live transit requests.

Data processed by Complycated's service

• A random installation identifier supports trials and server-backed features. The server stores salted hashes of that identifier and its access token, plus the current plan and trial dates.
• Purchase and restore requests include App Store transaction details needed to verify an entitlement with Apple. Complycated never receives payment-card details.
• Weather requests contain latitude and longitude rounded to two decimal places, country code, time zone and language. The rounded location is used as a short-lived cache key and is not written to the analytics database.
• Widget refresh registrations can contain an Apple push token, Widget bundle and environment, selected flight identifiers, and an optional rounded weather location. Registrations expire after 30 days unless renewed.
• Flight searches contain the flight, route, airport, date or map details needed to answer the request.

Weather data may be obtained from Open-Meteo, where enabled, and is normalised or otherwise modified by Complycated under the CC BY 4.0 licence. Severe-weather information may come from Apple Weather through WeatherKit. Flight lookups can use AeroDataBox through RapidAPI, AirLabs, the OpenSky Network or ADS-B data sources, depending on the requested result and enabled release configuration. Apple Push Notification service asks WidgetKit to refresh.

Cloudflare hosts the app service and Vercel hosts this website. Google Maps Platform or HERE can process transit requests sent directly by the iPhone. Each provider receives only the information needed for the requested feature. Service providers acting for Complycated are required to protect personal data consistently with this policy and may not use it for their own advertising.

Operational usage data

Complycated records aggregate counts such as provider, request totals, cache results, status class, errors, latency, estimated provider units and active Widget registrations. Daily per-installation counts let the service enforce trials, fair-use limits and plan allowances. The installation key is a salted one-way hash, not an Apple ID, account, device name or advertising identifier.

These records do not contain coordinates, routes, callsigns, flight selections, raw push tokens, payment-card details or advertising identifiers. Hourly operational aggregates are kept for up to 90 days. Daily usage and cost aggregates are kept for up to 24 months.

Storage and security

Complycated uses Apple app-group storage and Keychain where appropriate. Server credentials live in protected Cloudflare and Vercel secret stores. Cloud providers can temporarily process standard network information, such as an IP address, to deliver and protect a request; Complycated does not copy that information into its application analytics database.

Expired or revoked installation sessions are removed by scheduled cleanup. Installation and hashed purchase records are kept while they are needed to deliver or restore an entitlement, prevent repeated trials, handle refunds and meet legal accounting obligations. Support correspondence is normally kept for up to 12 months after the last reply, unless a longer period is needed to resolve a dispute or meet a legal requirement.

Messages and launch updates

If you use Report a Bug or Request a Feature, Complycated stores the message, an optional reply email, app and build version, iOS version, device model, language, current plan, submission time and a shortened pseudonymous reporter reference. Reports do not include raw logs, location, calendar, photo, flight or Home data. This information is visible only in the private operator dashboard and is used to investigate the report, improve the app and reply when requested. You can ask for the correspondence to be deleted at any time.

Legal bases and international transfers

Data needed to provide a feature or purchase is processed to perform the service you requested. Optional device permissions rely on your choice and can be withdrawn in Apple Settings. Security, fraud prevention, service reliability and aggregate cost monitoring rely on Complycated's legitimate interests in operating a safe, sustainable service. Purchase records can also be processed to meet legal obligations.

Some providers can process data outside the European Economic Area. Where required, Complycated relies on an adequacy decision, standard contractual clauses or another lawful transfer safeguard and limits the data sent to what the feature needs.

Your choices and deletion

You can revoke an Apple permission in Settings, disable a smart complication, remove a Widget, clear configured flights or locations, or uninstall the app. Widget registrations expire when they are no longer renewed.

For a privacy or deletion request, email luke@lukevink.com. Because Complycated does not create a consumer account or store a direct identity beside operational records, it may not be possible to associate a pseudonymous installation with a particular person.

Depending on where you live, you may have rights to access, correct, erase, restrict, receive or object to the processing of your personal data. You can withdraw consent without affecting earlier lawful processing. You may also complain to your local supervisory authority; in Latvia this is the Data State Inspectorate.

Changes

This policy may be updated when Complycated's features or providers change. A revised policy will show a new effective date.