Privacy.

What the app keeps, on your device only

• Your place: a town anywhere on earth from the list, the first three digits of a US ZIP code (the other two digits are never kept), or, if you tap Use where I am, the spot your phone gives, rounded to about a kilometre.
• Your reapply timer: when it started and when it ends.
• Your postcards: the words you write, and a photo if you add one.
• Sessions you mark "I'm going": the Host is not told.
• A count of your visits, and your answer to the home-screen card: so the card waits for a second visit and asks only once. Nothing about them is sent.

All of it sits in your browser's storage for this site, under one name. Settings → Delete everything on this device removes it at once. Removing the app or clearing the site's data does the same.

What the app sends

Only the 3-digit ZIP area of your place, to TANNED's own server, for two things:

• Today's UV forecast. The server asks the US EPA for it about one ZIP that stands for the whole area, never yours.
• Sessions nearby. The ones TANNED Hosts have published within about 50 miles.

For a place outside the US it sends nothing at all: the UV there is the app's own clear-sky estimate, worked out on your phone.

To search towns anywhere, the app loads the whole list of 64,451 towns once (about 1 MB) and keeps it, so that request says nothing about what you typed or where you are. If you tap Use where I am, your phone's position is read on the phone, used to find the nearest town, and never sent.

No name, no account, no precise location, no device identifier, no advertising or analytics code, and no cookies set by the app. Your phone never contacts the EPA or anyone else on the app's behalf.

While the app is in preview, it opens only after signing in to TANNED's team site. That sign-in service sets its own cookie, so the app can be reached; the app itself reads none of it, and the server it asks is never told who is signed in.

What TANNED's server does with it

• It keeps the EPA's forecast for each area for about three hours, so the EPA is asked less often. A forecast is about an area, not a person.
• To stop abuse, it counts requests from each network address. It holds a salted, one-way scramble of that address in memory, forgets it within twenty minutes of quiet, and never writes it to disk. The scramble changes every time the server restarts.
• Its log has one line per request: the kind of request and whether it worked. Never an address, a ZIP or a query.
• The sessions it lists are ones a Host chose to publish: a title, a day and time, a public meeting place, and the name the Host chose to show.

Sun exposure and your health

Some US states (Washington, Nevada and Connecticut among them) treat information about a person's health, including sun exposure and skin, as consumer health data with its own protections. The app works out UV and reapply times on your device, and none of that leaves it. TANNED does not collect, sell or share consumer health data. If a future feature ever needed any of it on a server, the app would ask you first, in plain words, and you could say no.

Everything else

• No selling, no ads. TANNED does not sell or rent information about anyone, and the app shows no advertising.
• Picks and links. When TANNED recommends a product and a link earns TANNED money, it says so beside the link.
• Children. The app is not made for children under 13.
• Not medical advice. The UV figures are the EPA's forecast or a clear-sky estimate. Ask a dermatologist about your skin.
• Changes. If what the app keeps or sends ever changes, this page changes first, with the date.

Draft of 5 October 2026, written to match the app's code. It is not yet in force: a lawyer reviews it, and a privacy contact address is added, before the app opens to the public.