App Privacy Policy

Last updated: September 25, 2026

This policy applies to the World Natural Disasters app for Android (package com.worldnaturaldisasters.wnd_app, on Google Play) and for iPhone (bundle ID com.worldnaturaldisasters.wndapp, on the App Store), published by Shahzeb Speaks. Both versions handle data the same way, except where On iPhone below says otherwise.

The app is operated by Shahzeb Speaks LLC, 1500 N Grant St, Denver, CO 80203-1859, United States. The company also operates the website worldnaturaldisasters.com, which has its own website privacy policy. This page covers the app only.

The short version

We collect no personal data about you ourselves unless you use Family Circle. There is no account, no sign-in, and no user profile. The places you choose to watch are saved on your phone and are never uploaded to us. We cannot see who you are, where you are, or which places you follow.

Family Circle is the exception on our side, and only if you use it. Creating or joining a circle uploads the places you deliberately share with that circle, the name you choose to show your circle, and whether you have marked yourself safe. Nothing is uploaded until you create or join a circle, and your own personal watchlist is never uploaded even then. This is described in full under Family Circle below.

Sending a report is the other exception, and only if you send one. Nothing about reports leaves your phone until you choose to send one. A report carries the observations you picked from a fixed list, optionally one photograph, and optionally an approximate location — described in full under Location. There is no message box anywhere in it.

Two Google services do receive data from every install, and we are telling you plainly rather than burying it. Google AdMob serves the adverts and reads your advertising identifier and IP address (see Advertising), and Firebase Cloud Messaging delivers alerts to your phone (see Push notifications). Neither is told which places you watch.

What stays on your phone

The following is stored in the app's own private storage on your device and is never transmitted to us or to anyone else — this remains true even if you use Family Circle:

The places you add to your watchlist, including the labels and notes you write for them
The alert radius and minimum severity you set for each place
Your alert history — which alerts you were shown, and when
Your settings: notifications on or off, quiet hours, units, and theme

Deleting a place removes it immediately. Uninstalling the app deletes all of it.

Network requests the app makes

The app contacts only the following services. As with any internet request, the service receiving it can see your IP address, because that is how a reply gets back to you. None of these requests carry an account or a username, and none of them say which places you watch.

worldnaturaldisasters.com — to read the public disaster feed. The request does not say which places you watch; the app downloads recent events and does the matching on your phone. Family Circle requests also go here and do carry a device identifier — they are described above and only happen if you use that feature.
worldnaturaldisasters.com, when you tap “Search online” — while adding a place, if a town is not in the list built into the app, tapping “Search online” sends the name you typed to us, and we look it up with OpenStreetMap’s Nominatim service. The name is sent only on that tap, never while you type. Like any web address it appears in our server’s ordinary request log, which is not linked to an account or to your watchlist, and the place you then add is still stored only on your phone. Searching the built-in list sends nothing.
worldnaturaldisasters.com, when you open a website tool — the buttons on a place that open the website’s earthquake history or nearby-disasters pages put that place’s point in the address, rounded to about a kilometre. Nothing is sent unless you tap one.
open-meteo.com — for weather forecasts and air quality, requested using only the latitude and longitude of the place being displayed.
tiles.openfreemap.org (OpenFreeMap) — for the map, when you open it; or basemaps.cartocdn.com (CARTO) if OpenFreeMap’s map cannot be loaded.
Google Firebase Cloud Messaging — so alerts can reach your phone quickly rather than waiting for the next background check. See Push notifications.
Google AdMob — to fetch the adverts. This request carries your advertising identifier and, like any request, your IP address. See Advertising.

The app contacts no other server on its own.

Family Circle

Family Circle is optional and off until you use it. A circle is a small group — usually a family — that shares a set of watched places and can tell each other “I am safe”.

Nothing about a circle is uploaded until you create or join one. Simply opening the Family Circle screen does not register anything with us or create any record.

What is uploaded when you use it

A device identifier we issue. When you first create or join a circle, our server generates a random identifier and a secret key for your installation. It is not derived from your phone, your SIM, your Google account or the advertising identifier used for ads (see Advertising), and it tells us nothing about you or your device beyond “this is the same installation as last time”.
The name you choose for yourself in that circle. You pick it; it does not have to be your real name, and it is visible only to other members of the same circle.
Places you deliberately share into the circle — a label and coordinates. These are the shared places, not your personal watchlist.
Your safety status — safe, needs help, or no answer yet — with the time you set it and an optional short note you write.

What is still never uploaded

Your personal watchlist stays on your phone even when you use a circle. The places you follow privately, their notes, your alert history and your settings are not sent to us and are not visible to your circle. Only what you explicitly add to a circle is shared.

Who can see it

Only the other members of that circle, and only while you are a member of it. Circles are not public, are not listed anywhere, and are not searchable. Someone who is not in your circle cannot see it exists, let alone read it.

Invites

An invite is a random single-use code that stops working after it is used once, and expires after 48 hours in any case. Anyone holding a valid code can join that circle, which is why the app tells you to send it directly to the person you mean rather than posting it publicly.

Leaving and deletion

Leaving a circle removes your membership, your name in it and your safety status from it immediately. When the last member leaves, the circle and everything in it — shared places and outstanding invites — are deleted. To have your device identifier and all associated circle data deleted from our servers, contact us at the address below.

Safety statuses are never inferred

A member who has not answered is shown as “no word yet”. We never mark anyone safe on their behalf, and no one can set a status for anyone else.

Location

Alerts and your watchlist never use your location. Every place you watch is one you searched for and added yourself, and that is deliberate: the app is built for following places you are not at, such as where family live. Nothing about which places you follow depends on where you are.

Location is used in exactly two places, and only if you ask for it each time. The app asks for permission the first time you tap one of those controls — never at startup, and never as a condition of using anything else. Refusing costs you nothing: everything else in the app behaves identically.

Attaching an approximate position to a report you are sending. This is the only one that leaves your phone.
“Near me” — showing which monitored events are within about 250 km of you. Your position is used on that screen to sort and filter events already downloaded to your phone, and is then discarded. It is not sent to us, not saved on your device, and not added to your watchlist. Close the screen and nothing of it remains.

A position attached to a report is rounded to about 110 metres before it leaves your phone, and rounded again on arrival. A report is sent from wherever you are standing, very often your home. Rounding says which street is affected without saying which building. Doing it on the phone as well as on the server means the precise value never travels at all — not in a request, not in a server log — rather than merely being discarded once it gets here. We keep no history of where you have been: a report holds one rounded position, and nothing links two reports to the same person.

Notifications and push

Every decision about whether to show you an alert is made on your phone. The app wakes up periodically in the background, downloads the public event feed, compares it against your watchlist locally, and raises a notification if something matches. Your watchlist is not sent anywhere for this.

Because a background check can be up to fifteen minutes late — which is fine for a flood and not fine for an earthquake — the app also subscribes to Google Firebase Cloud Messaging. It subscribes to topics named after map squares, roughly a hundred kilometres across, covering the places you watch. We publish an event to a map square; we are never told who is listening to it, and we hold no list of devices. What arrives is only the raw event: your phone then applies the same rules — your severity setting, your quiet hours, the daily limit — and decides whether to show anything at all.

Firebase itself issues your installation a messaging token, in the same way any push service must. That token is held by Google, not by us.

Notification permission is requested only when you turn alerts on, and declining it leaves the rest of the app fully usable.

Emergency contacts and safety guides

Emergency agency contacts for 145 countries and all safety guides are bundled inside the app and work with no network connection. An agency's own website is contacted only if you choose to tap its link, which opens in your browser and is then subject to that agency's privacy policy.

Third-party code in the app

There are exactly two third-party components, both from Google, and they are listed here rather than described as absent:

Google Mobile Ads (AdMob) — serves the adverts, and collects what is listed under Advertising, including diagnostic and crash information about the app.
Firebase Cloud Messaging — delivers alerts, as described under Notifications and push.

There is no analytics SDK, no separate crash-reporting product, no social media SDK, and no other tracking library. We receive no usage statistics from the app at all: we cannot tell how many people opened it today, or which screens they used.

We do not sell personal information. Because adverts are personalised by default, sharing your advertising identifier with Google counts as a "sale" or "share" under some privacy laws, including in California, and you can stop it by turning on Opt out of Ads Personalisation in Android Settings → Privacy → Ads, or — in the EEA, the UK and Switzerland — by declining in the consent form the app shows. Nothing you enter in the app — your watched places, your circles, your safety status — is used for advertising or given to an advertiser in any case.

Advertising

The app shows adverts supplied by Google AdMob. Google publishes what its advertising SDK collects, and rather than summarise it loosely, here is the whole list:

your device’s advertising identifier and app set ID — resettable IDs Android provides for this purpose;
your IP address, which Google may use to estimate the general area your device is in — this is not the app reading your location, and it happens whether or not you have ever given the app location permission;
how you interact with the advert — that it was shown, and whether it was tapped;
diagnostic and crash information about the app and the SDK itself.

Google uses these for advertising, measurement and fraud prevention, and acts as an independent controller for that data; its own description is at policies.google.com/technologies/partner-sites and the SDK’s disclosure at developers.google.com/admob/android/privacy/play-data-disclosure.

You can reset or delete the advertising identifier at any time in Android Settings → Privacy → Ads, and the app keeps working exactly as before.

If you are in the EEA, the UK or Switzerland, the app asks for your consent before any advert is requested, using Google’s consent form, and no advertising identifier is read until you answer. You can change that answer at any time from Settings → Ad privacy choices inside the app.

Where adverts appear, and where they never do. This changed in August 2026 and the list below is the current one.

Banners at the foot of the home, events, map, event, place, circles, circle and add-place screens — below the content, behind a divider, labelled “Advertisement”.
Native adverts at the bottom of Settings and at the end of the alert history list. These carry Google’s own “Ad” badge as well as our label.
Full-screen adverts when you open an event that is not urgent, and after you finish adding a place.
An advert when you open the app, on a cold start or a real return to it.

They never appear on the emergency contacts screen or a safety guide, they never appear on a live severe or extreme event, and one is never shown when you opened the app by tapping an alert or while an extreme alert is running. Those are rules enforced in the app’s code and covered by its tests, not promises about intentions.

What adverts never involve is anything you entered: your watched places, your circles and your safety status are not sent to Google or to any advertiser, and the advertising identifier is not joined to the device identifier described above.

Sharing an event

If you use the share button, the app hands plain text to Android's standard share sheet and you choose the destination. Nothing is sent anywhere until you pick an app and confirm.

Reports you send

Nothing here happens unless you send a report. Reading event pages, watching places and receiving alerts involve none of it.

What a report contains

Observations you picked from a fixed list — water in the street, road blocked, power out. There is no free-text field anywhere in a report, so nothing you type can be published, because there is nothing to type into. That is a safety decision rather than a limitation, and it is explained in our content policy.
Optionally one photograph. Every image is decoded and written out again as a new file, which discards all of its metadata. A phone photograph normally carries the exact coordinates it was taken at; none of that survives. We never store or serve the file you sent.
Optionally an approximate position, rounded to about 110 metres. See Location above.
The time you sent it, and the anonymous device identifier the app already uses for Family Circle.

What a report does NOT contain

No name, no email, no phone number, no account — there are none of those in this app. Nobody reading our database can tell who sent a report, including us. Other people see the observations, the photograph if you attached one, the rounded position and the time. They do not see anything that identifies you.

Reports are published immediately, and labelled

A report appears on the event page as soon as you send it, marked unverified and kept in its own section, separate from the agency measurements. We do not check it first — pre-approval would make reports useless during the event, which is the only time they matter. What carries that instead is the label, the separation, and the controls below.

Controls you have

Delete your own report at any time, from the app.
Flag any report, including someone else's. Two people flagging the same report hides it automatically, pending review.
Block a reporter. Their reports disappear for you and for nobody else. It is not a way to remove something, and it never counts as a flag.

What we may do

We can remove a report that breaks the content policy, and can stop a device sending further reports. Losing the ability to report does not affect Family Circle — those are separate, and are revoked separately.

How long a report is kept

A visible report stays while its event page does. A report you delete, or one we remove, stops being shown immediately and is retained only so that repeated abuse from one device remains visible to us. To have a report deleted outright, contact us and say which event it was on — or use Delete my Family Circle data in the app’s Settings, which deletes every report sent from your phone, and any photo attached to one, outright.

On iPhone

The iPhone app shows adverts from Google AdMob, in the same places and under the same rules as described in Advertising. On iPhone the advertising identifier (IDFA) is read only if you tap “Allow” when iOS asks whether the app may track you. If you tap “Ask App Not to Track”, adverts are still shown but are not personalised with that identifier, and the app works exactly the same. You can change your answer at any time in iPhone Settings → Privacy & Security → Tracking. In the EEA, the UK and Switzerland, Google’s consent form is shown first.
Alerts on iPhone come from checks the phone runs itself, when iOS allows the app to run in the background. No push notification service is used on iPhone yet, so no push token leaves the phone.
Camera, photos and location are used exactly as described above: only when you attach a photo or an approximate position to a report you are sending. iOS asks your permission before the app can use the camera or your location, and a photo picked from your library is only the one you picked.

If push notifications are ever switched on for iPhone, this section will be updated before that version is released.

Children

The app is not directed to children and we do not knowingly collect personal information from children.

Your rights

Almost all app data lives on your device, so you control it directly: clear your alert history in the app, remove places individually, or uninstall the app to erase everything. For that data there is no server copy for us to return or delete.

If you use Family Circle, the circle data described above is held on our servers. You can delete all of it yourself from Settings → Delete my Family Circle data in the app (Android 0.4.3 and later, and every iPhone version): that removes you from every circle, deletes your name, safety status and reports, and deletes this phone’s identifier on our server, immediately. You can also remove it circle by circle by leaving the circle, which deletes your membership, your name in it and your safety status; when the last member leaves, the whole circle is deleted. To request a copy of your circle data, or deletion of your device identifier and everything attached to it, email admin@shahzebspeaks.com. We do not need to verify your identity to do this, because the request is authenticated by the app itself — but for the same reason, we can only act on a request that comes from the installation in question.

If you have also subscribed to email alerts on the website, those are covered by the website privacy policy, which explains how to access or delete them.

Changes to this policy

If a future version of the app collects or transmits anything not described above, this page will be updated before that version is released, and the change will be reflected in the app's Data safety disclosure on Google Play. In particular, we would have to update this page before ever targeting a notification at an individual device rather than at a map square, because that would mean holding a list of devices; that is not the case today.

Contact

Privacy questions about the app: admin@shahzebspeaks.com

Shahzeb Speaks LLC
1500 N Grant St
Denver, CO 80203-1859
United States

You can also use the contact form.