INGV, USGS and EMSC data, with the source next to every number.Sources and limits
Get the app

Privacy policy

Last updated: 19 October 2026 · Version 1.0

The Italian text is the reference version; this English text is a courtesy translation.

This policy explains what personal data Epicentro (the iPhone, Android and Apple Watch apps and the website) processes, why, for how long and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), the Italian Privacy Code (Legislative Decree 196/2003) and related law.

1. Who is the controller

Netlogic Lab di Alessio Pellegrini (sole proprietorship) Via Mevati 1, 03046 San Donato Val di Comino (FR), Italy VAT no. IT03194800607 Privacy contact: info@netlogiclab.it

The controller is an individual running the business in his own name. A Data Protection Officer (DPO) has not been appointed, because none of the cases of Article 37 GDPR applies; for any privacy request write to the address above. We have no offices or representatives in other countries.

2. In short

  • You can use Epicentro without an account. An account is only needed for Plus.
  • Your precise location stays on your phone. The server only receives coordinates rounded to about 1 km, and only if you turn on alerts or the Network.
  • We do not sell data, show no ads and do not track you across apps or sites. We use no advertising SDKs.
  • Your family members' phone numbers never leave your phone.
  • The Epicentro Network (your phone as a sensor) is optional, starts off, and only works if you choose it.
  • You can delete your account from the app at any time.

3. What data we process, why and for how long

Legal bases are those of Article 6 GDPR: (b) performance of the service you ask for, (a) consent, (c) legal obligation, (f) legitimate interests. Where information on your device is accessed, Article 122 of the Italian Privacy Code (ePrivacy) also applies.

Feature Data Purpose and legal basis Retention
Using the app without an account No personal data is sent to us to view events, maps, charts, faults and the simulator. To read seismic data your phone contacts INGV, USGS, EMSC, OpenStreetMap/Overpass and OpenFreeMap directly; they receive your IP address and the requests (for maps and for hospitals and assembly areas, the coordinates of the area shown). Providing the service (b). Depends on those services, which are independent controllers.
Location Your precise location is used on your phone for distances, estimated intensity and “near me”. We do not use background location. Service you requested (b). Stays on the phone until you delete the app data.
Real-time notifications Random install identifier, notification token (Firebase Cloud Messaging or Apple APNs), language, time zone, thresholds, quiet hours and alert zones with location rounded to ~1 km. If you have a Plus account, the server checks your plan to send the “Analysis · Sequence” alert. Sending the alerts you chose (b). While the app is in use; a device is deleted after 120 days without contact or when you turn alerts off. Delivery logs, 30 days.
Account Email, name (if you give it), sign-in method (email, Apple, Google), Apple or Google profile identifier, password stored as a hash, language, preferences. Creating and managing the account (b). Until you delete the account; backups clear within 30 days.
Verification codes (OTP) The code and the email address, sent with Google Workspace. Verifying your email and securing access (b), (f). 24 hours.
Plus subscription Product bought, status, expiry and transaction identifiers supplied by the store. We never see or store payment cards. Tax data of the payment is held by Apple or Google. Activating and keeping Plus, checking with the store that the subscription is valid (b); accounting and tax obligations (c). For the life of the account and, where the law requires it, for the required time.
“I felt it” reports Intensity, floor, location rounded to ~1 km, free-text comment (optional), IP address as a hash and an automatic spam score. Collecting collaborative data and protecting the service from abuse (a), (f). 1,095 days (3 years). Only the administrator sees comments. If you delete your account, reports already sent stay but are no longer linked to you; write to us to delete a comment too.
Security and sign-ins Email, IP address, user agent, outcome and method of sign-in attempts; administration activity log; request limits per IP. Security, preventing fraud and abuse (f). Sign-in attempts 180 days; activity log 730 days.
Crash reports Random install identifier as a hash, app version, phone model and OS, error type, screens visited. No name, email or location. You can turn them off in Advanced settings. Fixing errors and keeping the app stable (f). 90 days.
Anonymous usage statistics Purchase-path events with a random, non-persistent session, platform, version and language. You can turn them off in Advanced settings. Improving the app and the Plus offer (f). 180 days.
AI assistant and summaries The text of your question (up to 600 characters), language and recent public seismic data, with approximate distances from events. Your location is not sent to the AI provider. Event summaries use public data only and are the same for everyone. We only store technical data of the calls (provider, model, tokens, duration), not the text of the questions. Providing the assistant and summaries you ask for (b). Technical data 90 days.
Epicentro Network (optional) If you turn it on: random install identifier, location rounded to ~1 km, a presence signal about every 20 minutes and, if it detects waves, the time and amplitude of the signal. No audio, no photos, no continuous sensor data. Collaborative detection of earthquakes (a); access to the device sensor with your consent (Art. 122 Privacy Code). Presence 14 days; signals 30 days; aggregated events 180 days.
Family, Home, Diary, PDF report Family contacts, building profile, kit, diary of felt quakes. Services you requested (b). Only on your phone. Numbers are never sent to us. You send SMS or share from your own apps.
Image to share The image is generated on your phone; saving to Photos needs your permission. Sharing an event (b). Does not go through our servers.
Widgets and Apple Watch Latest quake, nearby events and, with Plus, zones, family and analysis, already on your phone; synced between iPhone and Watch through Apple services. Service you requested (b). On the device.
Website Technical cookies, IP address and server logs (see section 9). Operation and security (f). Server logs for a limited security period.
Messages to info@netlogiclab.it Email, content of the message, any attachments. Answering your request (b), (f). As long as needed and to protect our rights.

We keep data for the stated time and then delete or anonymise it. Data we are legally required to keep, for the required time, or that we need to defend a legal claim, is kept.

4. Is providing data mandatory?

No, except for the account: without an email and verification we cannot create a Plus profile. Declining notifications, location, the Network, statistics or crash reports does not stop you using the basic features: you can change your mind at any time in your phone and app settings.

5. Who receives the data

Providers processing data for us (processors, Art. 28 GDPR):

  • Hosting provider with data centre in Spain (EU): server, database and backups.
  • Cloudflare (network and website security): traffic and IP addresses.
  • Google Workspace (Gmail): sending emails with verification codes.
  • Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications (they receive the device token and the alert text).
  • Artificial-intelligence providers: Anthropic and Google (Gemini), only for the assistant and summaries.

Independent controllers (with their own privacy notices):

  • Apple and Google, for purchases, subscriptions, “Sign in with Apple/Google” and the app platforms.
  • INGV, USGS, EMSC, OpenStreetMap/Overpass, OpenFreeMap, when your phone contacts them to get data or maps. Place search may use the system geocoding service (Apple or Google).

We do not sell or pass data to third parties for marketing. We may disclose data to authorities where the law requires.

6. Transfers outside the European Economic Area

Some providers (Google, Apple, Cloudflare, Anthropic) may process data in the United States or other countries. We do so only if the country is deemed adequate by the European Commission (including the EU-US Data Privacy Framework, for providers that participate) or with the Commission's standard contractual clauses and supplementary measures. On request we give you a copy of the safeguards.

7. Artificial intelligence

The assistant and summaries are generated by AI systems and may contain errors. They are not safety advice or predictions: in an emergency call 112 and follow civil protection guidance. Do not type your own or other people's personal data into the assistant. We use the providers' paid interfaces (APIs), whose terms exclude using submitted content to train their models. We take no automated decision with legal effects on you (Art. 22 GDPR); an automatic spam filter flags suspicious reports, but a person makes the final decision.

8. Your rights

You can ask at any time, by writing to info@netlogiclab.it:

  • access to your data and a copy (Art. 15);
  • rectification (Art. 16);
  • erasure (Art. 17): from the app, Settings → Account → Delete account, or on the page https://epicentro.netlogiclab.it/p/elimina-dati. Deleting the account does not cancel the subscription, which is managed in the App Store or Google Play;
  • restriction of processing (Art. 18);
  • portability of data you provided, in a structured format (Art. 20);
  • objection to processing based on legitimate interests (Art. 21);
  • withdrawal of consent, for the Network, location and notifications, without affecting the past (Art. 7).

We reply within one month (extendable by two months in complex cases, with notice). We may ask you to verify your identity. If you think the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it) or the authority of the country where you live or work.

9. Website and cookies

The website uses only technical cookies needed to operate: session, protection of forms against abuse and, where active, Cloudflare's security cookies. We use no profiling cookies and no tracking or advertising tools, so no consent banner is needed (Art. 122 Privacy Code; Italian DPA cookie guidelines 2021). You can block cookies in your browser; parts of the site may stop working.

10. Children

The app is intended for people aged 14 or over. Under 14, the consent of the person with parental responsibility is required (Art. 2-quinquies Privacy Code). If you find that a child gave us data without consent, write to us and we will delete it. We do not knowingly collect data from children under 13.

11. Security

We use encrypted connections (HTTPS), passwords stored as hashes, encrypted keys and secrets, administration access protected by two-step verification, activity logs and backups. No system is 100% secure: in case of a personal data breach that presents a risk to you, we will notify it under Articles 33 and 34 GDPR.

12. If you live outside the European Union

  • United Kingdom and Switzerland: equivalent rights to those above apply (UK GDPR and Data Protection Act 2018, nDSG).
  • California (CCPA/CPRA): we do not sell or share personal data for cross-context behavioural advertising; you can ask to know, correct or delete your data. We will not discriminate against anyone exercising their rights.
  • Brazil (LGPD) and other countries: you can exercise the rights your law provides by writing to info@netlogiclab.it.
  • Apple and tracking: the app does not track users across other companies' apps and websites.

13. Changes to this policy

We may update it for new features or legal requirements. The date at the top shows the latest version; for important changes we will notify you in the app or by email before they take effect.

14. Contact

Netlogic Lab di Alessio Pellegrini · Via Mevati 1, 03046 San Donato Val di Comino (FR), Italy · info@netlogiclab.it