Effective date: 2026-10-27
This Privacy Policy explains how S.C. Astra Invent Tech S.R.L. ("we", "us", "our") collects, uses and protects personal data when you use the MuntOS mobile app for iOS and Android (the "App") and the website at muntos.app (the "Website"). MuntOS shows crowdsourced information about ski slopes, lifts and mountain bike trails at mountain resorts.
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Romanian law. We collect as little data as we need to run MuntOS, and we do not sell your personal data or use it for advertising.
The data controller responsible for your personal data is:
S.C. Astra Invent Tech S.R.L. Str. Albastrelelor nr. 15, birou 2Z, Brașov, Brașov County, 500381, Romania CUI: 52821980 · EUID: ROONRC.J2025083993005 Email: contact@astrainvent.com Phone: +40 784 600 281
For any question or request about your personal data, contact us at contact@astrainvent.com.
We collect the following data, depending on how you use MuntOS.
Registered accounts. If you create an account, we collect your username and password. Passwords are stored only in hashed form. We do not ask for your email address, phone number or real name. Because we hold no contact details, we cannot recover an account or reset a password if you lose your credentials.
Guest accounts. You can use MuntOS with a guest account instead. If you submit a report without being logged in, we automatically create a guest account for you so your reports can be linked to a profile. A guest account has no username or password.
Authentication token. For both registered and guest accounts, our server generates a token (JWT) that is stored on your device and keeps you signed in.
Profile information. You can choose to add a display name and a profile picture. Every profile picture is reviewed by a member of our team before it is shown to other users. Rejected pictures are deleted immediately.
Reports. When you submit a report, we store what you selected from the list of options (for example, a closed slope, rocks on a slope, a lift queue time, a closed lift or an issue on a trail), the time of the report and, optionally, a location.
Location. Adding a location to a report is optional. You can either allow the App to use your device's GPS, or place the location manually on the map without enabling GPS. The App only accesses GPS while it is open and in use, never in the background. The location stored with a report is the report's location; we do not track your movements.
Push notifications. If you turn on notifications, we collect your device's Firebase Cloud Messaging (FCM) token and your notification preferences. You do not need an account to receive notifications.
Supporter purchases. You can support MuntOS with an optional yearly purchase, which does not unlock any features. Payments are processed entirely by Apple (App Store) or Google (Google Play). We never receive your card or payment details. We may receive confirmation of the purchase (such as the product purchased and a transaction identifier) to confirm and record your support.
Server logs. When the App or Website communicates with our server, we log your IP address for security and troubleshooting.
Usage metrics and crash reports. We collect your platform (iOS or Android), App version, the screens you view, events within the App (for example, when a report is submitted or a feature is used) and crash reports. We collect this data on our own server and do not use third-party analytics services.
Website. The Website is read-only. You cannot create an account or submit data there. When you visit it, your IP address and basic technical data are processed by our hosting and content delivery providers in order to deliver the pages.
Advertising. The App may show simple advertisements for local businesses, made up of an image and a link. We do not use your personal data to select or target ads, and we do not use advertising networks or advertising SDKs. Links in ads may contain a code that identifies MuntOS as the source of the visit. This code is the same for all users and does not identify you. When you open an ad link, you leave MuntOS and the advertiser's website is governed by its own privacy policy.
Under the GDPR, we must have a legal basis for each use of your data.
You can withdraw your consent at any time by disabling location access or notifications in the App or in your device settings. This does not affect processing that took place before you withdrew consent. Where we rely on legitimate interest, you have the right to object (see section 9).
MuntOS is a community app, so some of your information is visible to everyone who uses the App or the Website:
Choose a display name and picture you are comfortable sharing publicly. We recommend not using your full real name. Your username and password are never shown to anyone.
When you delete your account, your past reports remain visible but are anonymized: they are no longer linked to your display name, picture or account.
We do not sell or rent your personal data. We share it only with the service providers below, and only as far as they need it to provide their service to us.
Hetzner, Cloudflare and Google act as our processors under data processing agreements. Apple and Google process payment data as independent controllers under their own terms.
We may also disclose data if required by law, a court order or a competent public authority, or to protect our rights and the safety of our users.
Our main server is in the European Union (Helsinki, Finland). Some data leaves the EU through Google (Firebase Cloud Messaging) and Cloudflare, which may process data in the United States and other countries.
Where data is transferred outside the European Economic Area, we rely on appropriate safeguards under the GDPR. These include the EU–U.S. Data Privacy Framework, for providers certified under it, and the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.
We keep personal data only as long as we need it.
"Inactivity" means you have not opened or used the App with that account or device during that period.
You can delete your data yourself, at any time, from inside the App.
Deleting your account. When you delete your account (registered or guest), it is removed immediately from the App. Your display name and profile picture stop being shown, and your past reports are anonymized. Any remaining copies in our server logs and usage metrics are deleted automatically within 30 days.
Turning off notifications. You can delete your notification registration from the App. Your FCM token is then removed. Any remaining copies in our logs and usage metrics are deleted automatically within 30 days.
Cached images. Profile pictures may remain in Cloudflare's cache for up to 14 days after you delete them or your account.
Because we do not collect email addresses, we cannot always verify who you are if you contact us by email. For this reason, deleting data from inside the App is the fastest and most reliable option. You can also contact us at contact@astrainvent.com.
Under the GDPR, you have the right to:
To exercise these rights, email contact@astrainvent.com. We may ask you to prove that the account is yours, for example by confirming your username and details only the account holder would know. We will reply within one month.
You also have the right to lodge a complaint with a data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. If you live in another EU country, you can contact your local authority.
We protect your data with appropriate technical and organizational measures. These include encrypted connections (HTTPS), hashed passwords, access to the server limited to authorized staff, and automatic deletion of logs and metrics after 30 days. No system is completely secure, but we work to keep your data safe and will notify you and the authorities of a data breach where the law requires it.
MuntOS is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. We will post the new version in the App and on muntos.app and update the effective date at the top. If the changes are significant, we will notify you in the App.
If you have any questions about this Privacy Policy or how we handle your data, contact us:
S.C. Astra Invent Tech S.R.L. Email: contact@astrainvent.com Phone: +40 784 600 281 Address: Str. Albastrelelor nr. 15, birou 2Z, Brașov, 500381, Romania