Privacy policy
The short version
- You can use sisma without an account.
- We never store your exact location. With location allowed, the open app may share an approximate position — blurred by up to 500 m, with no account, device or IP identifier — to build anonymous felt maps. You can turn this off in Me.
- Felt reports keep only an area of about 10 km and are not linked to you.
- If you create an account, we store your email address and the settings you choose, until you delete the account.
- No ads, no advertising or analytics trackers, and we don’t sell or share personal data for advertising.
1. Who we are
sisma — the website sisma.io, the web app at sisma.io/app and the sisma Android app — is operated by Crucible Insight LLC, an Arizona limited liability company (“we”, “us”). We are responsible for the personal data described here. Questions and requests: privacy@sisma.io, or by post to 15990 S. Rancho Sahuarita Blvd, Sahuarita, AZ 85629, USA.
2. What we collect and why
| Data | When | Why | How long |
|---|---|---|---|
| Email address | You create an account (with an emailed sign-in link, a password, or Google). Passwords are stored only as a secure hash by our sign-in provider; we can’t see them | To sign you in and contact you about your account | Until you delete your account |
| Google profile (name, email address, profile picture link) | You choose “Continue with Google” | To sign you in; your Google name becomes your display name, which you can change | Until you delete your account. Google never shares your password with us |
| Display name, language, appearance setting | You set them in Me | To show your account and keep your settings on every device | Until you change them or delete your account |
| Saved places (name, region, country, coordinates of the place) and your default place | You save a place while signed in | To show the earthquakes nearest to the places you care about | Until you remove them or delete your account |
| Alert settings (on/off, minimum magnitude, distance) | You change them (sisma+) | To send the alerts you asked for | Until you delete your account |
| Plan and subscription status, and the customer/subscription IDs from Stripe or Google Play | You start a trial or subscription | To provide sisma+ | Until you delete your account (Stripe and Google Play keep their own payment records as tax law requires) |
| Felt reports: the earthquake, how strong it felt, your optional answers and note (up to 500 characters), app language, and — only if you allowed location — your position rounded to about 10 km | You tap “I felt it” and send a report | To show, in aggregate, where and how strongly an earthquake was felt | Kept as an anonymous record. Reports are not linked to your account, name or email, so please don’t write personal details in the note |
| Approximate position for felt maps: a point up to 500 m from where you are (blurred on your device before it is sent) and the time — nothing else | While the app is open and you have allowed location, about once a minute, unless you turn it off in Me | To map, from the rush of app use after an earthquake, where it was probably felt. Only areas of about 10 km with at least 3 people are ever shown | Deleted after 7 days. Not linked to your account, device or IP address; never shared or used for anything else |
| Push notification token (Android app or browser), with the device’s language and distance units | You turn on notifications for a device in Me → Alerts | To deliver your alerts to that device, in its language | Until you sign out on that device, the token stops working, or you delete your account |
| Technical logs: IP address, browser/device type, the page or address requested, time | Whenever you use sisma | To run the service securely and fix problems | Kept by our hosting and database providers for a limited period (typically days to a few weeks) |
Your location
With your permission, sisma reads your device’s location to centre the map and find the nearest earthquakes. Your exact location is not stored in our database. For automatic felt maps, the open app may send an approximate position (see the table above); you can switch this off in Me → “Help map where quakes are felt”. To calculate distances, the app sends your coordinates to our server together with each earthquake-data request; the server uses them for that calculation only, but our hosting provider’s request logs may briefly contain them (see “Technical logs”). You can use sisma without location by saving a place instead, and you can withdraw permission at any time in your browser or phone settings.
Place search
When you search for a place, the text you type goes to our server, which asks the OpenStreetMap Foundation’s Nominatim service and returns the results. Your IP address is not passed on. Search results are cached for up to a week.
Payments
On the website, payments are handled by Stripe; in the Android app, by Google Play. They process your payment details under their own privacy policies. We never receive your full card details — only whether your subscription is active and the identifiers needed to keep it in sync.
Legal bases (EEA and UK)
We process account, saved-place, alert and subscription data to provide the service you asked for (contract); felt reports, location use, felt-map positions and push notifications on the basis of your consent, which you can withdraw at any time; and technical logs for our legitimate interest in running a secure, reliable service.
3. Stored on your device
sisma keeps a few items in your browser’s or phone’s local storage so it works without an account: your language, appearance, units and felt-map settings, whether you’ve seen the introduction (and the launch screen this session), places you saved as a guest, the location you chose, the felt reports you sent from this device (so the app can show them), your preparedness checklist, and — when signed in — your sign-in session. These stay on your device; we use no advertising or analytics cookies. Clearing the site’s data in your browser, or uninstalling the app, removes them.
4. Service providers
We use these companies to run sisma. They process data only on our instructions or, where stated, as independent controllers under their own policies.
- Vercel Inc. (USA) — hosts the website, the app and our server functions.
- Supabase Inc. (database and sign-in; servers in the eastern United States).
- Resend — sends sign-in and account emails.
- Stripe — website payments (independent controller for payment data).
- Google — sign-in with Google (if you choose it), Google Play billing and Firebase Cloud Messaging in the Android app; Google Fonts delivers the icon font, so your browser contacts Google’s servers, which receive your IP address.
- Your browser’s push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari) — delivers alerts to browsers where you turned notifications on; it receives the encrypted alert and the device’s push address.
- OpenStreetMap Foundation — place search (receives the search text from our server, not your IP address), and the detailed street map when you zoom in on the map: your browser loads it directly from OpenStreetMap’s tile servers, which receive your IP address and the map area being viewed.
Earthquake data comes from public feeds of USGS, EMSC, GeoNet and the Japan Meteorological Agency. Our server fetches them; no personal data is sent to them.
5. International transfers
Our providers are based in, or store data in, the United States. Where the law requires, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. Sharing
We don’t sell personal data and don’t share it for advertising. We share it only with the providers above, when the law requires it, or with a successor if sisma is sold or merged (and then under this policy).
7. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, to restrict or object to its use, and to withdraw consent. Most of this you can do yourself in Me (edit your name, places and settings, or delete the account). For anything else, email privacy@sisma.io; we answer within 30 days. You may also complain to your local data protection authority. Residents of California: we do not sell or share personal information as defined by the CCPA.
8. Deleting your account
- Open sisma.io/app/me (or Me in the app) and sign in.
- If you have an active sisma+ subscription, cancel it first: on Android in Google Play → Payments & subscriptions; for a website subscription, email privacy@sisma.io.
- Choose Account → Delete account → Delete permanently.
This immediately deletes your account, email address, display name, saved places, alert settings and notification tokens. Felt reports were never linked to your account and remain as anonymous records. Stripe and Google Play keep their own payment records as tax law requires. Can’t sign in? Email privacy@sisma.io from your account’s address and we’ll delete it within 30 days. Uninstalling the app does not delete your account.
9. Children
sisma is not directed at children under 13 (under 16 in the EEA and UK), and we don’t knowingly collect their personal data. If you believe a child has created an account, contact us and we’ll delete it.
10. Security
All traffic is encrypted (HTTPS). Database access is restricted so each account can read and change only its own rows, secret keys are kept on the server, and we collect as little as we can.
11. Not an official warning service
sisma shows data from public sources and is not an official earthquake or tsunami warning service. In an emergency, always follow your local civil protection authority.
12. Changes
We’ll update the date at the top when this policy changes, and tell signed-in users in the app or by email before material changes take effect.
13. Contact
Crucible Insight LLC15990 S. Rancho Sahuarita Blvd, Sahuarita, AZ 85629, USA
privacy@sisma.io