Privacy Policy

• There are no accounts. You never give us a name, an email address or a password to use the app.
• If you allow location access, your position is used on the device to centre the map and find what is near you. It is not sent to us.
• The app is paid for by ads and by an optional subscription, so it contains Google advertising and Google analytics and crash reporting.
• This website loads no tracking at all unless you press Accept on the cookie notice.
• We do not sell your personal data, and we do not build advertising profiles ourselves.

The app and this website are operated by Meðalheimur ehf. (Kt. 430221-0190), Iceland. We are the data controller for the information described here. You can reach us at any time at medalheimur@medalheimur.is.

A device identifier. The app generates or reads an identifier for your device and sends it to our server together with whether you currently have a subscription or trip pass, your app settings, and your chosen language. The identifier is what links a purchase to a device, because there is no account to link it to instead.

Purchases. When you buy a subscription or a trip pass, the purchase receipt issued by Apple or Google is sent to our server so we can verify it and unlock the feature. Payment itself happens entirely inside the App Store or Google Play — we never see your card details, and we cannot see them.

Usage and crash data. The app uses Google Firebase Analytics to understand which parts of the app are used, and Firebase Crashlytics to receive crash reports. These record events, device model, operating system version, language and region, and similar technical data. We use them to fix faults and decide what to work on.

Notifications. If you turn on notifications, a push token for your device is registered so we can send you the alerts you asked for — for example when road conditions change on a road you follow. You can withdraw this at any time in your device settings.

Advertising. Unless you have an active subscription or trip pass, the app shows ads through Google AdMob. Google may use your device advertising identifier and similar data to select and measure ads, under its own privacy policy. Removing ads is one of the things a subscription or trip pass does.

Location, only if you allow it. Location is used on your device: to centre the map where you are and to show the weather stations and cameras nearest to you. Your coordinates are not transmitted to our servers. If you deny or revoke the permission, the rest of the app keeps working.

Things stored only on your phone. Your settings, favourite roads, favourite weather stations and cameras, and similar preferences are stored locally on the device. They are included in the settings summary described above, but they are not otherwise uploaded, and deleting the app deletes them.

Nothing until you agree to it. This site carries one marketing tool, the Meta (Facebook) Pixel, and it is not loaded until you press Accept on the cookie notice. If you press Decline, or simply ignore the notice, it is never loaded and nothing is sent to Meta. Your answer is remembered in your browser’s local storage so we do not ask again; you can clear it by clearing this site’s data in your browser.

If you do accept, the Pixel sets cookies and reports your visit to Meta, which lets us measure whether our advertising reaches people who go on to install the app. Meta processes that data under its own privacy policy.

Separately, and like any website, our hosting provider records ordinary server request logs — including IP address, browser and requested page — for security and reliability. This happens for every visitor and does not depend on the cookie notice.

We use a small number of service providers, each of which processes data under its own privacy policy:

• Google — Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging and AdMob, in the app.
• Apple and Google — payment processing and receipt validation for purchases made in their stores.
• Meta — the Pixel on this website, and only after you accept it.
• Our hosting and infrastructure providers, which run the website, the API and the databases behind them.

Road conditions, road cameras and weather observations come from Vegagerðin (the Icelandic Road and Coastal Administration), and weather alerts come from Veðurstofa Íslands (the Icelandic Met Office). This is a one-way street: we read their public data, and we send them nothing about you. The app is independent and is not operated by or affiliated with either institution.

Under the GDPR and the Icelandic Act on Data Protection, we rely on:

• Performance of a contract — verifying a purchase so we can give you what you paid for.
• Legitimate interests — keeping the service working, diagnosing crashes, and understanding use in aggregate.
• Consent — notifications, location, advertising identifiers where consent is required, and the Pixel on this website. Consent can be withdrawn at any time, in your device settings or by clearing this site’s data.
• Legal obligation — keeping records of sales for as long as bookkeeping and tax rules require.

Purchase records are kept while the entitlement is active and afterwards for as long as accounting and tax rules require. The device identifier and the settings summary are kept while the app is in use on that device. Analytics and crash data are kept for the retention period configured in Firebase. When something is no longer needed for the purpose it was collected for, it is deleted or anonymised.

You can ask us to:

• tell you what we hold about your device,
• correct it,
• delete it,
• restrict or object to how we use it,
• or send it to you or another provider in a portable form.

Write to medalheimur@medalheimur.is and we will answer within one month. Because there are no accounts, we may need your device identifier to find anything at all — the app can show it to you, and without it we may hold nothing that identifies you. You also have the right to complain to Persónuvernd, the Icelandic Data Protection Authority.

The app is a road and weather information tool for drivers. It is not directed at children, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this page when the app or the website changes how it handles data, and we will change the date at the top when we do. The current version is always at https://www.faerdogvedur.is/privacy.

This policy is governed by Icelandic law, and any dispute arising under it falls to the Icelandic courts. Nothing here limits rights you have under the GDPR or Icelandic data protection law.

Meðalheimur ehf. (Kt. 430221-0190)
medalheimur@medalheimur.is