GeoHook · Privacy Policy

Privacy Policy

Last updated: October 2026

1. Data Controller

The data controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

creative-it Software Consulting e.U.
Am Gassl 25
3482 Gösing am Wagram, Austria
Email: geohook.support@creative-it.com

2. Principle: Privacy by Design

The GeoHook App was developed following the "Privacy by Design" principle. Your privacy is our top priority. The app processes your location data exclusively on your device. No location data is transmitted to servers or stored externally. The only exception is the optional diagnosis in the help assistant that you explicitly switch on (section 3.4); it contains the names of your locations and the times of triggers, but no coordinates.

3. What Data is Processed?

3.1 Location Data

The app processes your location data to monitor geofences and trigger actions when entering or leaving defined areas. This data is:

  • Processed exclusively on your iOS device
  • Not transmitted to our servers or third parties (exception: the optional diagnosis in the help assistant, section 3.4, without coordinates)
  • Stored only on your device
  • Automatically deleted when you uninstall the app

3.2 Webhook Data

When you configure webhooks, the app sends HTTP requests to the URLs you specify. The following data is transmitted:

  • Payload data defined by you (e.g., geofence names, status)
  • Timestamp of the event

Important: This data is transmitted directly from your device to the webhook recipient you specified. We have no access to this data and no control over how the recipient processes it.

3.3 App Usage Data

The app collects no usage statistics, analytics, or telemetry data. We do not track how you use the app. The only exception are the help assistant counters described in section 3.4, which serve solely to prevent abuse.

3.4 AI Chatbot Data

The app includes an AI-powered help assistant that answers your questions about the app. When using this feature:

  • Your inputs are not logged and not stored
  • The data is not used for training AI models
  • Processing takes place on servers hosted in the EU that are fully GDPR compliant
  • The data exists only for the duration of processing your request
  • No data is shared with the developer of the AI model (currently Anthropic) or other third parties. The model runs within Amazon Bedrock on AWS infrastructure in the EU; Amazon Web Services processes the data solely on our behalf as a processor (Art. 28 GDPR)

After processing is complete, your inputs are immediately discarded. No chat histories remain on our servers. The AI assistant is powered by Amazon Bedrock. In this setup, AWS does not store or log the inputs sent to the AI model or the responses it generates, and does not use them for its own purposes such as training models. Logging of model invocations is switched off in our AWS account. Beyond that, only Amazon Bedrock’s fully automated abuse detection runs, with no human access to inputs or responses.

Abuse protection: To prevent automated abuse of the assistant, the app sends the Apple-signed app transaction with every chat request and – if you have a subscription – the Apple-signed subscription transaction. The app transaction contains a pseudonymous identifier of your app download assigned by Apple, but not your Apple ID, name, or email address. We use it to check that the request comes from a genuine GeoHook installation and whether a subscription exists.

  • For this identifier we store only the number of chat requests per day and month and the amount of text processed (tokens) per month in order to enforce fair usage limits. With a subscription, requests and tokens are additionally counted per month for the subscription’s transaction ID. Chat contents are not stored.
  • Requests without a valid app transaction (e.g. from older app versions) are counted per day and IP address instead. We do not store the IP address in plain text, only in pseudonymised form (a daily changing hash value).
  • Storage location: AWS EU (region eu-central-1, Frankfurt).
  • These counters are deleted automatically, usually within two weeks after the respective day or month has ended.
  • Server logs contain only a shortened, pseudonymised checksum of this identifier and the number of tokens processed; they are deleted after 90 days at the latest.

Optional diagnosis: With an active subscription you can allow the assistant to analyse problems with your setup. This feature is off by default and only becomes active when you switch it on in the app (in the chat or under Settings → Support & Diagnostics). You can switch it off again at any time; “View Shared Data” shows exactly what is transmitted. While diagnosis is switched on, the app sends a summary with every chat request containing:

  • permissions and system status (e.g. location, notification, Bluetooth and motion permissions, background app refresh, Low Power Mode, network type)
  • a summary of your configuration: the names you gave your locations, actions, iBeacons and vehicles, radii and distances, configured conditions and options, and detected configuration problems
  • recent triggers from the past days with time, result, HTTP status code, error code, response time and the host name of the webhook server
  • app and iOS version, time zone and your subscription level

It does not contain coordinates, full webhook URLs (paths and parameters), user names, passwords or other credentials, headers, request or response contents, custom field values, vehicle identification numbers, or device identifiers of iBeacons and Bluetooth devices. Like your chat input, the diagnostic data is processed only to answer the respective request; it is not stored and not logged. Server logs contain only the size of the summary.

3.5 Subscription & Purchase Data

GeoHook offers optional paid subscriptions — GeoHook Premium (also available as a Family plan) and GeoHook Tesla & iBeacon — via Apple’s App Store In-App Purchase system. Regarding purchase data:

  • All payment processing is handled exclusively by Apple. We never receive, store, or process your payment information (credit card, Apple Pay details, etc.).
  • We receive from Apple only the information necessary to verify and manage your subscription: product identifier, transaction ID, purchase date, and subscription status (active, expired, or cancelled).
  • We do not receive your Apple ID, name, email address, or any other personal account information from Apple.
  • Subscription status is stored locally on your device and verified via Apple’s StoreKit framework.

For details on how Apple handles your purchase data, please refer to Apple’s Privacy Policy.

3.6 Optional Debug Support Mode

GeoHook offers an optional debug support mode that allows the voluntary, time-limited transmission of anonymized diagnostic data for troubleshooting purposes. This mode is never activated automatically — it is only started at your explicit request.

Data collected:

  • Anonymized diagnostic events (geofence triggers, API response times, background task execution)
  • Email address for notifications about the support status

Data NOT collected:

  • No precise GPS coordinates (location is rounded to approximately 111 m)
  • No authentication tokens
  • No webhook response bodies
  • No passwords

Storage location: AWS EU (region eu-central-1, Frankfurt), encrypted with AES-256.

Retention: Automatically deleted when the session ends or the selected duration expires (1–7 days). Your email address is anonymized after the session ends.

Right to withdraw: You can deactivate the debug support mode at any time in the app. Upon deactivation, all debug logs are immediately deleted.

4. Legal Basis for Processing

The processing of your location data is based on your explicit consent (Art. 6(1)(a) GDPR), which you provide when first using the app through the iOS system prompt. The processing of subscription-related data is based on the necessity for the performance of a contract (Art. 6(1)(b) GDPR). The processing of debug support data is based on your explicit consent (Art. 6(1)(a) GDPR), which you provide by activating the debug mode in the app. The optional diagnosis in the help assistant (section 3.4) is based on your consent (Art. 6(1)(a) GDPR), which you give by switching diagnosis on and can withdraw at any time by switching it off. Checking the app and subscription transactions and the help assistant usage counters (section 3.4) are based on our legitimate interest in protecting the service against abuse and disproportionate costs (Art. 6(1)(f) GDPR).

5. Storage Duration

Unless stated otherwise in section 3 (subscription, debug support, and assistant usage data), all data is stored exclusively on your device and remains there until you:

  • Manually delete the corresponding geofences or webhooks
  • Uninstall the app

6. Data Sharing

No personal data is shared with us or third parties, except for the webhook recipients you configure yourself, the anonymized debug diagnostic data when the debug support mode is activated (see section 3.6), and your requests to the help assistant (chat inputs and, if switched on, the optional diagnostic data), which Amazon Web Services processes on our behalf via Amazon Bedrock to answer them (see section 3.4).

Important Note: If you send webhooks to third-party services (e.g., Home Assistant, IFTTT, Zapier), these transmissions are subject to the privacy policies of the respective providers. Please review their privacy policies.

7. Your Rights

You have the following rights regarding your personal data:

  • Right of Access (Art. 15 GDPR)
  • Right to Rectification (Art. 16 GDPR)
  • Right to Erasure (Art. 17 GDPR)
  • Right to Restriction of Processing (Art. 18 GDPR)
  • Right to Data Portability (Art. 20 GDPR)
  • Right to Object (Art. 21 GDPR)
  • Right to Withdraw Consent (Art. 7(3) GDPR)

Since all data is stored exclusively on your device, you can exercise these rights directly through your device:

  • Delete individual geofences/webhooks in the app
  • Uninstall the app to remove all data
  • Revoke location permission in iOS Settings

8. Right to Withdraw Consent

You can withdraw your consent to location processing at any time by:

  • Disabling location permission in iOS Settings under "Settings → Privacy → Location Services → GeoHook"
  • Uninstalling the app

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. In Austria, this is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

10. Location Permissions (iOS)

The app requires "Always" location permission to monitor geofences in the background. You can adjust this permission at any time in iOS Settings. The app only functions with the appropriate permission.

11. No Cookies or Tracking

The app does not use cookies, tracking technologies, or advertising IDs.

12. Data Security

Since all data is stored locally on your device, you benefit from Apple iOS security measures:

  • Encryption in the iOS Secure Enclave
  • Device lock with Face ID/Touch ID/Passcode
  • Sandboxing of app data

13. Changes to This Privacy Policy

We reserve the right to modify this privacy policy to adapt it to changes in legal requirements or changes to the app. The current version is always available at https://geohook.creative-it.com/privacy-en.html.

14. Contact

For questions about data protection or to exercise your rights, please contact us at:

Email: geohook.support@creative-it.com

← Back to homepage