Privacy Policy

• There are no accounts. You never give us a name, an email address or a password to use the app.
• If you allow location access, your position is used on the device to centre the map and find what is near you. It is not sent to us.
• The app is paid for by ads and by an optional subscription, so it contains Google advertising and Google analytics and crash reporting.
• This website sets no cookies, and loads nothing that could follow you to another site, unless you press Accept on the cookie notice. A cookieless count of visits — which cannot identify you or pick you out again later — runs for everyone.
• We do not sell your personal data, and we do not build advertising profiles ourselves.

The app and this website are operated by Meðalheimur ehf. (Kt. 430221-0190), Iceland. We are the data controller for the information described here. You can reach us at any time at medalheimur@medalheimur.is.

A device identifier. The app generates or reads an identifier for your device and sends it to our server together with whether you currently have a subscription or trip pass, your app settings, and your chosen language. The identifier is what links a purchase to a device, because there is no account to link it to instead.

Purchases. When you buy a subscription or a trip pass, the purchase receipt issued by Apple or Google is sent to our server so we can verify it and unlock the feature. Payment itself happens entirely inside the App Store or Google Play — we never see your card details, and we cannot see them.

Usage and crash data. The app uses Google Firebase Analytics to understand which parts of the app are used, and Firebase Crashlytics to receive crash reports. These record events, device model, operating system version, language and region, and similar technical data. We use them to fix faults and decide what to work on.

Notifications. If you turn on notifications, a push token for your device is registered so we can send you the alerts you asked for — for example when road conditions change on a road you follow. You can withdraw this at any time in your device settings.

Advertising. Unless you have an active subscription or trip pass, the app shows ads through Google AdMob. Google may use your device advertising identifier and similar data to select and measure ads, under its own privacy policy. Removing ads is one of the things a subscription or trip pass does.

Location, only if you allow it. Location is used on your device: to centre the map where you are and to show the weather stations and cameras nearest to you. Your coordinates are not transmitted to our servers. If you deny or revoke the permission, the rest of the app keeps working.

Things stored only on your phone. Your settings, favourite roads, favourite weather stations and cameras, and similar preferences are stored locally on the device. They are included in the settings summary described above, but they are not otherwise uploaded, and deleting the app deletes them.

A count of visits, for everyone. Vercel, which hosts this site, records each page request — which page, the sort of device and browser, and an approximate region — and turns that into visit and page-view totals. It sets no cookies and keeps no identifier that could recognise you on a later visit or on any other site, which is why it does not wait for the cookie notice: there is no permission for it to ask for. It tells us how much traffic the site gets and nothing about who you are.

Beyond that, nothing until you agree to it. This site carries two further measurement tools — Google Analytics, through Firebase, which counts visits and which pages get read, and the Meta (Facebook) Pixel — and neither is loaded until you press Accept on the cookie notice. If you press Decline, or simply ignore the notice, neither is ever loaded and nothing is sent to Google or Meta. Your answer is remembered in your browser’s local storage so we do not ask again; you can clear it by clearing this site’s data in your browser.

If you do accept, both set cookies. Google Analytics records the pages you open and the technical data any analytics tool sees — browser, device type, referring site, and an approximate location derived from your IP address — which is how we know how much traffic the site gets and where it comes from. The Pixel reports your visit to Meta, which lets us measure whether our advertising reaches people who go on to install the app. Google and Meta each process that data under their own privacy policies.

Separately, and like any website, our hosting provider records ordinary server request logs — including IP address, browser and requested page — for security and reliability. This happens for every visitor and does not depend on the cookie notice.

We use a small number of service providers, each of which processes data under its own privacy policy:

• Google — Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging and AdMob in the app, and Firebase Analytics on this website.
• Apple and Google — payment processing and receipt validation for purchases made in their stores.
• Meta — the Pixel on this website, and only after you accept it.
• Vercel, which hosts this website and produces the cookieless visit counts described above.
• Our other infrastructure providers, which run the API and the databases behind it.

Road conditions, road cameras and weather observations come from Vegagerðin (the Icelandic Road and Coastal Administration), and weather alerts come from Veðurstofa Íslands (the Icelandic Met Office). This is a one-way street: we read their public data, and we send them nothing about you. The app is independent and is not operated by or affiliated with either institution.

Under the GDPR and the Icelandic Act on Data Protection, we rely on:

• Performance of a contract — verifying a purchase so we can give you what you paid for.
• Legitimate interests — keeping the service working, diagnosing crashes, and understanding use in aggregate.
• Consent — notifications, location, advertising identifiers where consent is required, and the analytics and Pixel on this website. Consent can be withdrawn at any time, in your device settings or by clearing this site’s data.
• Legal obligation — keeping records of sales for as long as bookkeeping and tax rules require.

Purchase records are kept while the entitlement is active and afterwards for as long as accounting and tax rules require. The device identifier and the settings summary are kept while the app is in use on that device. Analytics and crash data are kept for the retention period configured in Firebase. When something is no longer needed for the purpose it was collected for, it is deleted or anonymised.

You can ask us to:

• tell you what we hold about your device,
• correct it,
• delete it,
• restrict or object to how we use it,
• or send it to you or another provider in a portable form.

Write to medalheimur@medalheimur.is and we will answer within one month. Because there are no accounts, we may need your device identifier to find anything at all — the app can show it to you, and without it we may hold nothing that identifies you. You also have the right to complain to Persónuvernd, the Icelandic Data Protection Authority.

The app is a road and weather information tool for drivers. It is not directed at children, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this page when the app or the website changes how it handles data, and we will change the date at the top when we do. The current version is always at https://www.faerdogvedur.is/privacy.

This policy is governed by Icelandic law, and any dispute arising under it falls to the Icelandic courts. Nothing here limits rights you have under the GDPR or Icelandic data protection law.

Meðalheimur ehf. (Kt. 430221-0190)
medalheimur@medalheimur.is