Back to sign in

Privacy policy

This privacy policy explains which personal data is processed when you use grawGoDev at dev.go.graw.de: the web application in your browser and the iOS and Android apps, which display the same web application. It does not cover other websites of the controller.

1. Controller

Graw Radiosondes GmbH & Co. KG
Muggenhofer Str. 95
90429 Nuremberg
Germany
+49 911 3201-100
info@graw.de

2. Data protection officer

For any question about your data, or to exercise your rights, contact our data protection officer:

Jannick Preiwisch
Catoire UG (haftungsbeschränkt)
Henkestraße 91
91052 Erlangen
Germany
datenschutz@noris-group.com

3. Who can use the service

There is no self-registration. Accounts are created by the operator of this installation for the people who work with its radiosonde stations.

4. What we process, why, and on which legal basis

4.1 Your account

Name, email address, password (stored only as a hash), time zone, preferred language, role, the stations you have access to, whether and when your email address was verified, and, if you turn on two-factor authentication, its secret and recovery codes (stored encrypted). We also record when the account was created or changed and by whom.

Purpose: signing you in and providing the service. Legal basis: Art. 6(1)(b) GDPR where you are our contracting party yourself; otherwise Art. 6(1)(f) GDPR, our legitimate interest, and that of the organisation you use the service for, in providing the service agreed with that organisation.

4.2 Stations, flights and measurements

Station details (name, location, WMO ID, status, cover images), flights (sonde type, serial number and firmware, frequency, launch and flight times), their measurements (pressure, temperature, humidity, wind, position and altitude), statistics calculated from them, flight events, and files attached to flights. This is mostly meteorological data rather than personal data. It becomes personal data where it can be linked to a person: every record stores which account created and last changed it, and a cover image or an attachment may show or name people.

A flight can be shared through a read-only link containing a random access token. Anybody who has the link can view that flight without signing in. The members of the flight's station find the link on the flight page. It does not expire, but the station's administrators can renew it at any time, after which the old link stops working. Stations set to "Publicly readable" are readable by all accounts on this installation, not by the public.

Purpose: providing the service. Legal basis: as in 4.1.

4.3 Sessions and cookies

When you open a page, a session is started and stored in our database together with the IP address the request reaches the application from, your browser's user agent, the time of your last activity and, once you are signed in, your account. Depending on the network in front of the application, that IP address is your device's own (public) address or the address of a proxy in between.

We set only the cookies the service needs to work:

  • the session cookie (grawgodev_session), which identifies your session; the language you choose on the sign-in page is kept in that session;
  • XSRF-TOKEN, which protects forms against cross-site request forgery;
  • a "remember me" cookie, if you keep that option ticked when signing in (it is ticked by default), so you stay signed in on this device.

The web application also keeps small interface settings (for example, whether the sidebar is open) in your browser's local storage. We use no analytics, no tracking and no advertising cookies.

Legal basis: Art. 6(1)(b) and (f) GDPR; storing and reading the cookies and local storage on your device is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG).

4.4 Logs and monitoring

  • Change history: changes to accounts, stations, flights and other records are logged with the old and new values, the account that made them and the time. Passwords and two-factor secrets are excluded.
  • Application logs: errors and technical events of the server. They can contain IP addresses, account IDs and the addresses of the pages requested.
  • Browser logs: the web application forwards the messages it writes to your browser's console (log, warning, error and debug messages) to our server, together with the address of the page they came from, without its query string and without the token of a shared flight link. Errors are sent as their message only, without the request they occurred in. They are stored with the application logs.
  • Performance monitoring: the server records slow requests, slow database queries, failed jobs and exceptions, and how many requests each account makes, in its own database. Only administrators can see this.

Purpose: keeping the service secure and working, finding errors, and being able to trace who changed what. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, reliable and traceable service.

4.5 Push notifications

You can be notified when a flight is launched, its balloon bursts, or the flight finishes, is closed or fails. The notification contains the event, the station's name and a link to the flight. Notifications are only sent once you allow them, and you can turn them off at any time, in the application or in the settings of your browser or device.

  • In the browser (web push): your browser creates a subscription (an endpoint address and the keys to encrypt messages for it), which we store with your account. Notifications are delivered through the push service of your browser's vendor, for example Google for Chrome, Mozilla for Firefox or Apple for Safari; the content is encrypted end to end on that path.
  • In the iOS app: we store the device token that Apple issues to the app, and deliver notifications through the Apple Push Notification service (APNs) of Apple Inc.
  • In the Android app: we store the device token issued by Firebase Cloud Messaging (FCM), and deliver notifications through FCM, a service of Google.

Legal basis: your consent, Art. 6(1)(a) GDPR, which you give by turning notifications on. You can withdraw it at any time by turning them off again, in the application or in the settings of your browser or device; this does not affect the lawfulness of notifications sent before.

4.6 App lock

In the iOS and Android apps you can turn on an app lock (off by default), which asks for Face ID or Touch ID on iOS, and for your fingerprint, face or device PIN on Android. The check happens entirely on your device, by the operating system. The app only learns whether it succeeded; no biometric data reaches us.

4.7 Emails

If you ask to reset your password, we send a link to your email address. The link is valid for 60 minutes. Flight notifications are not sent by email.

Legal basis: Art. 6(1)(b) and (f) GDPR, as in 4.1.

4.8 Maps

Maps are drawn from map tiles that your browser loads directly from the tile servers of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). For that, your IP address, your browser's user agent and the address of the page are transmitted to it; see its privacy policy. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing flights and stations on a map.

Fonts, scripts and stylesheets are served by this server itself; the pages load nothing else from third parties. The iOS and Android apps contain no analytics, advertising or crash-reporting components; apart from push notifications (4.5), they only display this web application.

5. Recipients

Within the operator, only the people who need it for running the service have access to your data. Other accounts on this installation that can access the same stations see their stations and flights, including who created or changed them. We also use these processors and recipients:

  • Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; servers in Germany
  • Push notifications on iOS: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
  • Push notifications on Android: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA
  • Push notifications in the browser: the push service of your browser's vendor
  • Map tiles: OpenStreetMap Foundation, United Kingdom (see 4.8)

6. Transfers to third countries

Apple's and Google's push services, and the push services of browser vendors, may process data in the USA. Such transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). For the United Kingdom there is an adequacy decision of the European Commission (Art. 45 GDPR).

7. How long we keep data

  • Account data: as long as the account exists. A deleted account is first only marked as deleted so that it can be restored, until an administrator removes it permanently, at the latest when you ask us to erase your data.
  • Stations, flights and measurements, including cover images and attachments: without a time limit. They are mostly meteorological data; personal data in them, namely which account created or changed them and whatever a cover image or attachment shows, is kept with them.
  • Sessions: until they expire, at the latest 12 hours after your last activity; the "remember me" cookie until you sign out, at the latest after 400 days.
  • Password reset links: 60 minutes.
  • Push subscriptions and device tokens: until notifications are turned off, or the push service reports the subscription as no longer valid.
  • Change history: without a time limit, like the stations and flights it describes. It records work done in the service, which has to stay traceable.
  • Application and browser logs: kept only in the server's running log output, which is rotated once it reaches a few megabytes and discarded whenever the application is restarted or updated; in practice a few days at most.
  • Performance monitoring: 7 days.

8. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object on grounds relating to your particular situation (Art. 21). Where you have given consent, you can withdraw it at any time with effect for the future (Art. 7(3)). To exercise these rights, contact us as described in section 2.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence or place of work. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

9. Obligation to provide data, automated decisions

You are not obliged to provide your data, but the service cannot be used without an account. We do not use automated decision-making or profiling (Art. 22 GDPR).

10. Changes

We update this policy when the service or the law changes. Last updated: 2026-10-27.

29 Oct 2026 10:07:31 UTC