Prepped privacy policy

Last updated: 27 September 2026

Prepped helps you prepare for weather that affects what you grow: frost, strong wind, heavy rain and snow, plus warnings from SMHI (the Swedish Meteorological and Hydrological Institute). We only collect what the app needs to work. We never sell your data or use it for advertising or tracking.

Controller

Moralit AB, company reg. no. 559532-9599, Omsed 9265, 242 97 Hörby, Sweden.
Privacy contact: admin@moral.it.

What we process and why

Data	Why	Legal basis
Email address	To create your account and send one-time sign-in codes. We send no marketing.	Contract (GDPR Art. 6(1)(b))
Postal code and what we derive from it: place, municipality, county, an approximate position (the postal code area's centre point) and a suggested hardiness zone	To fetch forecasts and warnings for your area and suggest your hardiness zone. We never use your phone's location services.	Contract
Your choices: hardiness zone, language, which alerts you want, advance notice (days), sensitivity and daily summary time	To tailor alerts to you.	Contract
Device data: a random installation ID, push tokens (from Expo and from Apple/Google), platform, OS version, phone model, app version, language and when the device was last used	To send notifications to the right device, in the right language.	Contract
Notification history: which weather events and warnings we have already sent you	To avoid sending the same alert more than once.	Legitimate interest (Art. 6(1)(f))
Technical logs: your anonymous user ID (a random ID from the sign-in service), which function was called, response time and app version. Logs don't contain your email, postal code, position or push tokens.	To keep the service secure and working, and to troubleshoot.	Legitimate interest

We don't process sensitive data and make no automated decisions with legal effects for you.

How long we keep data

Account, postal code and settings: until you delete your account.
Device data: until you sign out or delete your account. If a notification can no longer be delivered to the device, e.g. because the app was uninstalled, we remove it. A device that hasn't been used for 180 days is removed automatically.
Notification history: 8 days.
Technical logs: 30 days.
Backups: deleted data may remain in database backups for up to 35 days. After that it is gone.

Deleting your account

You can delete your account at any time in the app: Settings → Delete account. This immediately deletes your email address, postal code, position, settings, devices and notification history. We keep only a fully anonymous row for statistics, with the hardiness zone, the month the account was created and the month it was deleted. It can't be linked to you.

Who processes data for us

Amazon Web Services (Amazon Web Services EMEA SARL): hosting. Sign-in, database, email and servers run in the AWS Stockholm region (eu-north-1).
Expo (650 Industries, Inc., USA): relays push notifications to your phone. Expo receives your push token and the notification content, e.g. "Get ready: Frost tomorrow". The transfer to the US is protected by Expo's self-certification under the EU–U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback mechanism.
Apple and Google: deliver notifications to your device via Apple Push Notification service and Firebase Cloud Messaging.

We fetch forecasts and warnings from SMHI. We only send SMHI the coordinates of a grid cell of about 5 × 5 km, never anything about you. Postal code data comes from GeoNames and is built into our service. No information about you is sent there.

Your rights

You have the right to:

get a copy of the data we hold about you
have incorrect data corrected (you can change most of it yourself in the app)
have your data erased (see above)
ask us to restrict processing
object to processing based on legitimate interest
receive data you have given us in a machine-readable format (data portability)

Contact admin@moral.it to exercise your rights. If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se.

Children

Prepped is not directed at children under 13.

Changes

We update this policy when the service changes. We announce significant changes in the app.