AirLocal Privacy Policy

The short version

This policy explains how Hyperstatic LLC handles information when you use AirLocal, its widgets, notifications, Shortcuts, and related cloud services.

No AirLocal accountNearby air works without signing up. Connecting a private PurpleAir sensor may ask for its registration email; AirLocal uses it for that connection and does not save it.

No tracking or adsThere are no advertising SDKs, tracking domains, or cross-app profiles.

Location stays localExact phone coordinates are used on the iPhone and are not sent to AirLocal's backend.

Deletion is built inYou can delete AirLocal cloud data from Settings without contacting us.

If you email support, we receive the address, message, and attachments you choose to send. That support conversation is separate from normal app use.

How location works

With your permission, AirLocal uses the iPhone's location to identify nearby public air-quality sources. The phone performs the nearby choice locally. Exact latitude and longitude are not sent to the AirLocal backend.

To retrieve public data, the app may send canonical map tile identifiers and public PurpleAir or AirNow station identifiers. These requests describe the data being viewed, not a precise phone-location history.

If you enable an alert that follows your location, iOS provides low-power significant location changes to the app. The phone chooses the new public sensor locally and sends only that chosen sensor identifier to the backend.

Location permission is your choice.

You can change AirLocal's location permission in iOS Settings. Some automatic Nearby features will be limited when location is unavailable.

Information stored on your iPhone

Saved sensors: Sensor identifiers, placement, the active sensor, and the last working local-network address are stored in app preferences until you remove them.
Local readings: AirLocal keeps up to 24 hours of one-minute sensor readings in protected app storage for charts and trends.
Sensor credentials: Private PurpleAir read keys and AirLocal-managed connection credentials are kept in the device Keychain using a ThisDeviceOnly protection class until the sensor is unlinked.
App verification: When available, Apple's App Attest key identifier and a rotating cloud-session credential are kept in the app's Keychain. Widgets receive a separate, limited session.
Widgets and Shortcuts: Protected App Group files hold the latest snapshots and limited credentials needed by the app, widget, and Shortcut to coordinate.
Public caches: Map tiles, nearby summaries, and public history are cached for speed and honest fallback when a provider is temporarily unavailable.
Preferences: Appearance, public favorites, Home focus, and map choices are retained until changed or the app's data is removed.

When iCloud is available, Apple's iCloud key-value service syncs a short list of choices between your devices: appearance, public favorites, map display choices, and the PurpleAir reading method. It also keeps a copy of your alerts on public stations (the station and its name, the AQI levels, the offline notice, and whether the alert follows your location) so a new iPhone or a reinstall can offer to turn them back on. A location-following alert's station is saved only when you change the alert, never as you move. Alerts on your own sensors appear only as a count. Exact location, the map viewport, saved sensors, local addresses, read keys and other credentials, sessions, push tokens, and reading history never enter iCloud. This copy stays in your iCloud account and is never sent to AirLocal's backend. Delete cloud data empties it.

Information sent to AirLocal's backend

Cloud features use a random installation identity. It is not an email address, Apple ID, advertising identifier, or named user account. Cloud settings, security records, and usage limits can be linked to this installation, so we treat them as device-linked data in our App Store disclosures.

Session details: The random installation identifier and the app's version and build establish and protect an anonymous session. The backend also notes when the installation was first used and, at most once a day, when it was last used.
App verification: When the app enrolls with Apple App Attest, the backend stores an installation identity, key identifier, public key, Apple verification receipt, app build, verification counters and times, and hashes of session-recovery credentials. These records help prevent unauthorized use of the service.
Public-data requests: Canonical map tile identifiers and public sensor or station identifiers retrieve viewed-region data, favorites, readings, and history.
Alerts and notifications: An APNs device token is registered only after notification permission exists and at least one alert is enabled; the app sends the phone's locale and time zone with it. We retain the selected sensor, display name, thresholds, and monitoring choices to run your alerts. Notification payloads can include the provider, sensor identifier, event type, AQI when applicable, and observation time.
Connecting your PurpleAir: AirLocal sends the sensor's local device identifier and its indoor or outdoor placement to PurpleAir through our backend. For a private sensor, you may also enter the email used to register it with PurpleAir. These values are used to complete the connection. AirLocal does not save or log that email or the raw device identifier, and the entered email is not saved on the phone. To find an outdoor sensor's public PurpleAir listing, the app may also send our backend the name and position the sensor reports; the backend compares them with PurpleAir's public sensor list and does not keep them. An indoor sensor's name and position are not sent.
Saved cloud connections: To retrieve your sensor's readings and history, the backend retains a keyed digest of its device identifier, a random connection identifier, and PurpleAir group, member, and sensor identifiers linked to your installation. The phone receives a revocable credential for that sensor. AirLocal's project API keys are never sent to the phone.
Private sensor requests: A private read key is normally forwarded over TLS only for the request and kept in backend memory. It is not placed in shared public caches.
Private remote alerts: If you explicitly enable reliable remote monitoring for a private sensor, the backend stores an AES-GCM encrypted copy of its read key until you remove the rule or stop remote monitoring.
Live Activities: A Live Activity that keeps updating after the app closes sends the station it shows and its Apple push token, which the backend stores encrypted. For your own private sensor it also stores an encrypted copy of the read key, only after you agree. Both are erased when the activity ends, after eight hours at most.
Request counts: The backend counts each installation's requests per day to watch service health and costs. It keeps today's and yesterday's counts and removes older ones in its regular cleanup. These counts never limit your use and are not used for advertising or behavioral analytics.

As with other internet services, our delivery and hosting providers receive a source IP address. AirLocal's application database and structured logs do not retain the raw address. To limit abuse, the backend counts each network address's requests over the past minute in its memory only; these counts are never written to its database or logs and disappear when the backend restarts.

The backend also stores public source catalogs and caches, alert state, and operational cost records. Public PurpleAir and AirNow records are observations published by those providers; they are not a history of your phone's location. Data retrieved through a managed or private sensor connection is not placed in shared public caches.

Services AirLocal relies on

Apple: iOS location permission, Keychain, App Attest, iCloud preference sync when available, WidgetKit, Shortcuts, and Apple Push Notification service.
PurpleAir: public air-quality observations and, when you connect a sensor, verification of its registration and access to its readings and history.
AirNow: public monitoring-station observations.
Hetzner: infrastructure hosting AirLocal's backend and its protected operational data.
Cloudflare: delivery of the website and secure routing of requests to AirLocal's backend.

These providers process information under their own terms and privacy practices. AirLocal does not sell personal information or share it for targeted advertising.

Your controls and deletion

Delete AirLocal cloud data

In AirLocal, open Saved → Settings → Privacy & cloud data and choose Delete cloud data. This revokes the current cloud session and removes that installation's notification destination, alert rules and events, encrypted private-alert credentials, Live Activity registrations, request counts, and App Attest identity and challenges from the active backend database.

Managed sensor connections are revoked at the same time. Their installation and device digests are erased, and minimal PurpleAir group and member identifiers remain only until provider cleanup succeeds. AirLocal removes these cloud links from the phone and stops automatic relinking; direct local sensor use can continue. Incomplete connection setup expires after seven days.

Deletion leaves only a one-way hash of the deleted random installation identifier and the time it was deleted. This prevents an old token or replayed identifier from recreating the erased installation; it cannot be used to recover the original identifier.

The per-address request counts described above live only in the backend's memory and are not linked to an installation. Protected operational backups may contain earlier records; deleting active cloud data does not rewrite existing backups.

Uninstalling the app does not itself request cloud deletion. AirLocal's server removes an installation's cloud records on its own in three cases: 30 days after Apple reports that the app is no longer on the iPhone (checked about once a week for installations with alerts, and whenever an alert is sent); 30 days after a year without any request from an installation that cannot receive alerts; and 30 days after a newer AirLocal identity on the same iPhone replaces it, for example after a reinstall. The records removed are alert rules and the encrypted sensor keys stored for them, queued alerts, the notification token, Live Activity registrations, App Attest records, and managed sensor connections. A sensor connection the iPhone keeps using under its newer identity moves to that identity instead. Deleting cloud data also removes, at once, any earlier identity that iPhone replaced. To revoke cloud access immediately, stop remote monitoring or delete cloud data before uninstalling.

Remove device-held sensor data

Cloud deletion also removes the 7-day history AirLocal downloaded through your sensor's PurpleAir connection. It does not erase saved sensors, readings recorded on the iPhone, or private read keys. To remove a saved sensor, its local history, and its device-held read key, open the sensor in Saved and choose Forget sensor.

Permissions

You can change location, local-network, and notification permissions in iOS Settings. You can also disable or delete individual alerts inside AirLocal.

Security and diagnostics

AirLocal uses TLS for backend traffic, device Keychain protections for sensor credentials, signed installation sessions, App Attest where enrolled, encrypted storage for notification tokens and explicitly enabled private-alert credentials, and restricted operational logging. Registration emails, raw sensor device identifiers, keys, and session tokens are excluded from application logs.

AirLocal's prepared support diagnostics include the app and iOS versions, appearance, saved-sensor count, and active connection state. They exclude exact location, network addresses, sensor names and identifiers, and credentials.

Apple's MetricKit can deliver crash or hang information to the app on your phone. AirLocal keeps only a small local summary, limited to twelve entries and thirty days; it does not automatically upload this information. A redacted summary may be included in a support message, which leaves your device only if you choose to send it.

No system can promise absolute security. If you believe you found a security or privacy issue, contact us so we can investigate.

Changes and contact

We may update this policy when AirLocal's features or data practices change. The effective date at the top will be revised, and material changes will be reflected here before they apply.

Questions, deletion problems, or privacy concerns can be sent to [email protected].

AirLocal is provided by Hyperstatic LLC.

Last updated October 30, 2026