Privacy Policy

The English-language version of this document is the official, legally binding version. Any translation is provided for convenience only; in the event of a discrepancy between the English version and a translation, the English version prevails.

1. Introduction

Tryggo ("we", "our", "us") is a web application designed and operated from Norway. We are committed to protecting your privacy and handling your data transparently. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

We collect the following types of information when you use Tryggo:

• Account information: Email address, first name (optional), and authentication credentials.
• Profile information: Country of residence, household composition (number of adults, children, babies), pet information, special needs, living environment, and emergency preparedness preferences.
• Inventory data: Items you add to your essentials inventory, including names, quantities, expiration dates, categories, and images you upload.
• Device information: Push notification subscription data if you opt in to notifications.
• Location data: With your permission, we use your device's geolocation only to determine your country. Your coordinates are sent to BigDataCloud for reverse-geocoding and are not stored on our servers; only the resulting country code is cached locally on your device. A reading is treated as current for 48 hours, after which it is reused as your last-known country (for example when you are offline) until a newer fix replaces it. Your device location is not used to fetch weather or other hazard alerts — those are matched to your household's coarse grid cell on our servers (see Section 4). You can deny location access at any time; the app will fall back to your household's configured country.
• Household location (optional): If you save a postcode or coordinates against your household, we store an approximate grid cell (~111×111 km) used to match incoming earthquake, tsunami, severe-weather, and wildfire events. The full coordinates are stored encrypted-at-rest and used for distance estimates shown in the app (e.g. "87 km away"). They are never sent to upstream alert providers per request — see Section 4 for details on how earthquake / tsunami alerts work without per-user location calls. The one exception is the optional weather map: if you tap "Weather Map" on a severe-weather alert, coordinates rounded to ~1 km (not your exact location) are placed in the link that opens Windy.com, so the map centres on your area — see Section 4.

3. How We Use Your Information

We use your information to:

• Provide and personalize the Tryggo service, including tailored preparedness recommendations based on your household profile.
• Send you expiration reminders and preparedness notifications (if you opt in).
• Improve our service and fix technical issues.
• Communicate with you about your account and service updates.

4. Third-Party Services

We use the following third-party services to operate Tryggo:

• Supabase: Our backend platform — the PostgreSQL database that stores your account, profile, household, inventory, emergency-plan, and in-app support-chat data, plus authentication and the server-side functions that run the app. Hosted in the EU (Ireland). Your support-chat messages are read only by our support team and are not shared with any third-party chat provider. See Supabase's privacy policy for details.
• Cloudflare: Application hosting, content delivery, and image storage, all kept in the EU. Cloudflare serves the app and routes its traffic (hosted in Ireland), and stores and optimizes the photos you upload (profile and item images) on Cloudflare R2 under EU data jurisdiction. On devices without browser speech recognition, Cloudflare Workers AI (Whisper) also transcribes your short voice-dictation clips to text (see the voice entry below). It therefore processes technical connection data such as IP addresses and request metadata. See Cloudflare's privacy policy for details.
• Open Food Facts / Open Beauty Facts: Barcode product lookup. When you scan a product barcode, the barcode is sent to these open public databases to retrieve the product's name, brand, and quantity, which pre-fill the new item. No account data is sent. See their respective privacy policies for details.
• Anthropic (Claude): Automatic catalogue matching and Smart Update. When you add or scan an item, its name, brand, and quantity are sent to Anthropic's Claude API to suggest the closest catalogue entry, a category, and a unit. When you use Smart Update to record a stock change, the note you type or dictate is sent — together with the names, units, and quantities of your household's kit items — so Claude can interpret which items changed and by how much; you confirm every change before it is applied. No account identifiers are sent, and under Anthropic's commercial API terms these inputs are not used to train their models. See Anthropic's privacy policy for details.
• Voice dictation: Optional. When you tap the microphone to dictate a Smart Update note, your speech is converted to text in one of two ways, depending on your device. Where your browser provides speech recognition (e.g. desktop Chrome, Android), it is used directly — some browsers transcribe on-device, others (e.g. Chrome) send the audio to their vendor's speech service (e.g. Google), governed by your browser vendor's privacy policy; in this case we receive only the resulting text. Where that isn't available (e.g. the installed iOS app), we record a short clip (up to 10 seconds) and send it to Cloudflare Workers AI (Whisper, hosted in the EU) to transcribe; the audio is used only to produce the text and is not stored. Either way, the resulting text is then handled as the Smart Update note described above. You can always type instead.
• Resend: Transactional email — expiry reminders, check-in alerts, and account-related emails (e.g. sign-in and account deletion). We send your email address and the message content. See Resend's privacy policy for details.
• Brevo: Marketing emails. If you opt in to product-update emails, we share your email address with Brevo to manage that mailing list. See Brevo's privacy policy for details.
• Grafana (Faro): Performance monitoring and error reporting. Collects technical diagnostics — page views, performance metrics, error reports, and browser/device information. The only identifiers attached are system-generated, opaque account and household IDs we assign internally so we can group errors for debugging — never your name, email, or any of your content, and meaningless to anyone without access to our database. See Grafana's privacy policy for details.
• Google & Apple OAuth: Optional sign-in providers. When you sign in with Google or Apple, we receive your email address and basic profile information as authorized by those providers.
• BigDataCloud: Client-side reverse-geocoding to determine your country from device coordinates. Only your latitude and longitude are sent; no account or personal data is shared. See BigDataCloud's privacy policy for details.
• OpenStreetMap (Nominatim): Postcode geocoding. When you save a household location by postcode, the postcode and country are sent to the OpenStreetMap Nominatim service to resolve approximate coordinates, from which we derive your coarse grid cell. See the OpenStreetMap Foundation's privacy policy for details.
• National Weather Service (NWS): Severe-weather alerts for US grid cells. On a server-side schedule we query NWS using the coarse grid-cell centre (~111 km) of cells that have households — never your exact coordinates — and match the results to your cell locally. NWS is a US government service; data is public domain.
• OpenWeather: Severe-weather alerts for grid cells not covered by a national-authority feed (i.e. outside the US, Europe, Canada, and Japan). On a server-side schedule we query OpenWeather using the coarse grid-cell centre (~111 km) of cells that have households — never your exact coordinates. See OpenWeather's privacy policy for details.
• MeteoAlarm: Severe-weather warnings for European countries. We ingest MeteoAlarm's public per-country feeds on a server-side schedule and match warnings to your household's grid cell locally — no per-user coordinates are sent. See MeteoAlarm's privacy policy for details.
• Environment and Climate Change Canada (ECCC): Severe-weather alerts for Canada. We crawl ECCC's public CAP alert directory on a server-side schedule and match alerts to your grid cell locally — no per-user coordinates are sent. Government of Canada service; data is public.
• Japan Meteorological Agency (JMA): Severe-weather warnings for Japan. We ingest JMA's public XML feed on a server-side schedule and match warnings to your grid cell locally — no per-user coordinates are sent. Japanese government service; data is public.
• Windy.com: Optional weather map. When you tap "Weather Map" on a severe-weather alert, the app opens Windy.com in a new browser tab with your household coordinates rounded to ~1 km included in the link, so the map opens centred on your area. This happens entirely in your browser and only when you choose to open the map — nothing is sent to Windy unless you tap it, and we never include your exact location. See Windy's privacy policy for details.
• USGS (U.S. Geological Survey): Earthquake feed (M2.5+ globally, last 24 hours). We poll the public global feed on a server-side schedule and match events against your household's coarse grid cell — your coordinates are never sent to USGS. Public domain US government service.
• EMSC (European-Mediterranean Seismological Centre): Earthquake feed (M2.5+ globally, ~200 most recent events). Polled the same way as USGS — global server-side fetch, cell-match locally, no per-user coordinates leaving our servers. See EMSC's terms for details.
• NOAA NTWC (National Tsunami Warning Center): Tsunami bulletins (Warnings, Advisories, Watches, Threats) for the Pacific, Caribbean, and US/Canada coasts. Polled the same way — global server-side fetch, cell-match locally, no per-user coordinates leaving our servers. NOAA is a US government service; data is public domain.
• NASA FIRMS: Active-wildfire detections. On a server-side schedule we query the FIRMS area endpoint with a coarse bounding box around each grid cell that has households — never your exact coordinates — and match detections to your cell locally. NASA service; data is public.

These services process data in accordance with their own privacy policies. We share only the minimum data necessary for each service to function. No alert lookup ever uses your exact device location. Earthquake, tsunami, and feed-based weather alerts work without sending any per-user data to the upstream providers — we ingest public feeds on a schedule and match them to your household's grid cell entirely on our servers. The few point-based lookups (NWS, OpenWeather, and NASA FIRMS) send only the coarse grid-cell centre or bounding box (~111 km), shared by every household in that cell — never your precise coordinates.

5. Data Storage & Security

Your account and household data are stored securely on cloud infrastructure located in the European Union (Ireland). We use encryption in transit (HTTPS) and implement row-level security to ensure that your data is only accessible by you. Uploaded images are stored on Cloudflare R2 (EU jurisdiction).

6. Cookies & Local Storage

Tryggo uses browser local storage and session storage for authentication tokens and application state. We do not use third-party tracking cookies or advertising cookies. We also cache your detected country code in local storage to avoid repeated location prompts; a reading is treated as current for 48 hours and otherwise reused as a last-known fallback until a newer one replaces it.

7. Your Rights

Under the GDPR and applicable Norwegian data protection law, you have the right to:

• Access: View all personal data we hold about you within the application.
• Rectification: Update your personal information at any time through Settings.
• Deletion: Permanently delete your account and your personal data — including your profile photo — from Settings; we do not retain it afterwards. Content you added to a shared household (such as item photos) belongs to the household and is removed when the household itself is deleted. This action is irreversible.
• Data portability: Your data is accessible through the application interface.
• Withdraw consent: You can disable notifications and email communications at any time.

8. Children's Privacy

Tryggo is not directed at children under 16. We do not knowingly collect personal information from children. Household member data (kids, babies) is entered by the adult account holder for the purpose of calculating preparedness needs.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or in-app notification. Your continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or your data, please contact us through the app.