Privacy Policy — Sunset Beach Addendum
Summary: Sunset Beach has no accounts, no sign-in, no advertising, no analytics, no tracking and no third-party SDKs. The one identifier that ever leaves your phone is an Apple push notification token, and only if you opt into a pushed alert or a rocket-launch Live Activity is running. That token is not linked to you and is not used for tracking. The app's App Store privacy label is "Data Not Linked to You — Identifiers (Device ID)".
Contents
What Sunset Beach is
Sunset Beach gathers what public agencies and open data services already publish about one stretch of coast (the National Weather Service, NOAA/NDBC, NC DEQ, Launch Library, iNaturalist, eBird and others) and shows it on one screen, with home-screen widgets, on-device notifications, optional pushed alerts, a rocket-launch Live Activity and Siri shortcuts.
Data we collect
One thing: an Apple push notification token, and only in two situations.
- What it is. A device token is an opaque string that Apple issues to one installation of one app on one device so that Apple's push service (APNs) can deliver a notification to it. It is not your name, email, phone number, Apple ID or location, and it is not a hardware serial number. Apple can rotate it at any time.
- When we receive it. The app sends the token to our push service only when you turn on one of the "When conditions change" alerts in the app (when the water gets worse, sunset, sunrise), or while a rocket-launch Live Activity is running on your Lock Screen. A Live Activity starts on its own when a launch the app expects to be visible from the beach is within about an hour; you can switch Live Activities off for this app in iOS Settings. Outside those two situations the app never asks iOS for a token and nothing is sent.
- Why. So that our server can send your device the alert you asked for. Everything else in the app either runs on your device or is fetched with no identifier at all.
- What travels with it. The token, whether it is a sandbox or production token, and the list of alert categories you turned on (a subset of
safety,sunsetandsunrise). For a Live Activity: the activity's own push token, marked as a Live Activity token, and an identifier for that one activity instead of categories. - What does not. No account, no name, no email, no location, no advertising identifier, no analytics events, no usage history. The token is not combined with anything that could identify you, and it is not used for tracking across apps or websites.
This is what the app's App Store privacy label declares: Data Not Linked to You — Identifiers (Device ID). The privacy manifests bundled with the app and its widget declare no tracking.
The servers the app talks to
sunsetbeach.neuralconfig.com is the conditions API the app and widget download from. It runs on Cloudflare Workers. Requests carry no user or device identifier; the app never sends one. The service stores only aggregated public conditions data (for example, hourly snapshots of the forecast), nothing about individual users or devices.
push.neuralconfig.com is a push notification service NeuralConfig operates, also on Cloudflare Workers, and shared by several NeuralConfig apps. It is the only place the push token goes. For each registered token it stores: which app it belongs to, the token, the APNs environment, the token kind (device or Live Activity), the alert categories you opted into, the Live Activity identifier where relevant, and the time the registration was created and last refreshed. It does not store your IP address alongside the token. To protect the registration endpoint from abuse it keeps a per-IP request counter that covers a one-hour window and is not associated with any token.
Both are ordinary HTTPS services and, like any web request, a request to either carries your device's IP address and the path being requested. We do not store personal data from those requests and we do not build profiles. Cloudflare, as our hosting provider, may retain standard request logs (IP address, path, timestamp) for a short period for operations and security, under Cloudflare's privacy policy.
Push notifications and Live Activities
- Turning an alert on registers your token with push.neuralconfig.com along with the categories you chose. The app re-sends the same registration on every launch so the server's copy stays current; re-registering an unchanged token updates the existing record rather than creating a new one.
- Changing your choices re-sends the token with the new category list.
- Turning the last pushed alert off sends a delete request for your token, and the server removes it.
- A rocket-launch Live Activity registers a separate token that addresses only that one running activity, so our server can update the countdown when a launch slips, holds or scrubs. It carries no alert categories and is never used to send an ordinary notification.
- What a push contains. The alert text you see (for example, "Rip current risk is now High"), an interruption level, and a link back into the app. Pushes are addressed to a category, not to a person; the server does not know who is behind a token.
- Pruning. When Apple reports a token as invalid or no longer registered (for example, after you delete the app or turn notifications off in iOS Settings), the server deletes it the next time it tries to send to it. There is no separate scheduled retention period: a token stays registered until the app deletes it or Apple reports it invalid.
Deleting the app removes the token from your device. If you delete the app while a pushed alert is on, the registration remains on the server until Apple reports the token dead on the next send, and it is removed then. To remove it immediately, turn the alerts off before deleting the app.
Local alerts (tides, full moon, visible launches) remain local notifications scheduled on your device from data the app already fetched. They involve no token and no server.
Data that stays on your device
- Preferences and alert settings you choose in the app.
- Cached conditions the app and widget last downloaded, so the app opens to something useful when offline.
- Local notifications scheduled from that data.
- Widgets read the same cached data on your device.
Deleting the app removes this on-device data (data included in a device backup follows your backup's own retention). Apart from the push token described above, there is no server-side copy for us to delete, because we never had one.
Sharing
If you use the app's share feature, the sentence or link you share goes only where you send it, through the standard iOS share sheet. NeuralConfig does not receive it.
Third-party content
The wildlife sightings and bird reports shown in the app come from iNaturalist and eBird under their published terms and licences, and are attributed in the app. Tapping through to a source opens that provider's site in your browser, under that provider's privacy policy.
Children's privacy
Sunset Beach is a general-audience conditions app and is not directed to children. It collects no personal information and does not knowingly collect information from anyone, including children.
Safety disclaimer
Sunset Beach has no lifeguards. The app presents agency forecasts and periodic samples, not observations of the water in front of you, and makes no safety guarantees. This addendum does not modify that disclaimer.
Contact
For Sunset Beach privacy questions: [email protected]. For app support: [email protected] or support.neuralconfig.com. The user guide is at docs.neuralconfig.com/sunset-beach.
← Back to the Master Privacy Policy