Privacy Policy

Chimes! ("Chimes", "we", "us") is an app that tells you when an ice cream van or other mobile vendor is in your area. This policy explains what information the Chimes app (for iPhone, iPad and Android) and this website collect, why, who we share it with, and the choices you have.

Chimes is run by Richard Stimson in the United Kingdom, who is the data controller for the information described here. You can contact us at chimesapp@just-iot.com.

The short version:

• You can use Chimes as a customer without an account, a name or an email address.
• As a customer, your phone never sends us its location. We store the centre and size of the area you choose, so we can tell you when a van enters it.
• Vendors share their location on purpose, so customers can find them, and only while they choose to.
• We don't sell your information, show adverts, or use advertising or analytics trackers.

1. If you use Chimes as a customer

You don't need to create an account. When you first open the app, we create a random guest ID for your phone. We collect:

• Your notification area (Geofence Circle). The postcode or place you enter, its map position, and the radius you choose. The position comes from what you type, not from your phone's GPS. We use this to work out when a vendor enters your area. We store the area, not a history of where you go.
• Your phone's location, on your phone only. If you allow location access, the app uses it to show where you are on the map. It is not sent to us or stored by us.
• Push notification identifiers. A token from Firebase Cloud Messaging (Google), and on iPhone also an Apple Push Notification service token, so we can send you alerts.
• Your settings. Whether notifications are on, and the vendors you save as favourites.

2. If you use Chimes as a vendor

Vendor accounts are available on iPhone and iPad. When you sign up and use vendor mode, we collect:

• Account details. Your email address. You sign in with a one-time code sent to that address, through our sign-in provider, Amazon Cognito.
• Business details you choose to add. For example your business name, a description, phone number, address, postcode, town, website and social media links, and an icon. These are shown to customers.
• Your live location while you are sharing it. When you are live, the app sends your vehicle's position so customers can see you on the map and be notified when you enter their area. This can continue while the app is in the background. We store your most recent position, and our location provider keeps a position history for up to 30 days. You can stop sharing at any time by going offline or switching on Privacy Mode.
• Service usage. Daily counts of successful and failed location updates, with your app version and platform, so we can spot problems with the service.

Your business details and live location are visible to Chimes users by design. That is the purpose of vendor mode.

3. Businesses listed from public sources

The map also shows some ice cream businesses that haven't registered with Chimes. We add these from publicly available information on the internet: business name, location, and public contact details such as a website, social media page, email or phone number. If it's your business and you'd like the listing corrected or removed, email us and we will do it.

4. When you contact us

If you use "Contact us" in the app, or a form on this website, we receive what you send: your email address, your message, and any other details you type in, such as your name, business name and phone number. We use them to reply to you and, if you register your business, to set up your listing. In-app messages are sent to us by email through Amazon Simple Email Service.

If you pay for a vendor plan, payment is handled by Stripe. We receive your name, email address and payment status, but never your card details.

5. Why we use your information

• To provide the service you asked for: sending alerts when a vendor enters your area, showing vendors on the map, running vendor accounts. (Legal basis: performing our agreement with you.)
• To keep Chimes working and secure: diagnosing faults, preventing misuse, and removing out-of-date push tokens. (Legal basis: our legitimate interests.)
• Where you have given permission: location access and notifications. You can withdraw permission at any time in your phone's settings or the app's settings. (Legal basis: consent.)

We don't use your information for advertising, and we don't make automated decisions about you that have legal or similar effects.

6. Who we share it with

We don't sell your information. We use these service providers to run Chimes, and they process data only on our behalf:

• Amazon Web Services: hosting, database, sign-in, location processing, push delivery and email (USA, us-east-1 region).
• Google Firebase Cloud Messaging: delivering push notifications.
• Apple: push notifications and maps on iPhone and iPad.
• Google Maps: maps on Android.
• Stripe: vendor payments.
• Bluehost and Cloudflare: hosting and protecting this website.

On your phone, postcodes and place names you type are turned into a map position by your phone's built-in location service (Apple on iPhone, Google on Android). We may also disclose information if the law requires it.

Some of these providers process data outside the UK, including in the USA. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK–US data bridge.

7. How long we keep it

• Guest data is kept while the app is in use. We may delete guest records that have not been used for a long time.
• Vendor account data is kept until you delete your account.
• Vendor position history is kept by our location provider for up to 30 days.
• Push tokens are removed when they stop working, for example after you uninstall the app.
• Messages you send us are kept as long as needed to deal with them.

8. Your choices and rights

• Notifications: turn them off in the app's Settings, or in your phone's settings.
• Location: you can refuse or withdraw location access. You can still set your area by postcode.
• Vendors: go offline or use Privacy Mode to stop sharing your location, and delete your account in the app under Settings > Advanced Settings > Account.
• Delete your data: uninstalling the app removes the guest ID from your phone. To have the information we hold about you deleted, email us. If you use a guest ID, include your postcode or the approximate area you set so we can find it.

Under UK data protection law you have the right to access, correct, delete or restrict the use of your personal information, to object to how we use it, and to receive a copy of it. To use any of these rights, email chimesapp@just-iot.com. We will reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

9. Security

Information is sent over encrypted connections and stored with AWS. Access is restricted to what each part of the service needs. No system is perfectly secure, but we take reasonable steps to protect your information.

10. Children

Chimes is not directed at children under 13, and customers don't need to give a name or email address to use it. Vendor accounts are for businesses. If you believe a child has given us personal information, email us and we will delete it.

11. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change significantly affects how we use your information, we will also tell you in the app.