What the website and app store on your device.
Effective date: 7 November 2026 Last updated: 7 November 2026
This notice explains what the website gratisparkering.net and the GratisParkering app (iOS and Android) store on your computer or phone, and what we read from it. The controller is VIBECODE AS, org. no. 938 738 750, Gjerdrums vei 12D, 0484 Oslo, Norway. How we otherwise process personal data is set out in our Privacy Policy (gratisparkering.net/en/personvern).
The rules are in section 3-15 of the Norwegian Electronic Communications Act (ekomloven) (storing and accessing information on a user's terminal equipment, formerly section 2-7b) and in the GDPR. Under section 3-15, we need consent before we store or read information on your device, with two exceptions: purely technical transmission of communications, and storage that is strictly necessary to provide a service you have explicitly requested. The rule applies however briefly the information stays on the device, including when it is only in the app's memory.
The website sets no cookies itself, and uses none from others for analytics or advertising. The website is
delivered through Cloudflare. To tell people from automated attacks, Cloudflare may in some cases set a security
cookie (__cf_bm) that lasts up to 30 minutes. It is used only for security, is strictly necessary to deliver the
website safely, and is not used for tracking.
The website's font (Schibsted Grotesk) is served from our own server. Your browser does not contact Google or any other third party when you visit the website.
Like every website, our server, and Cloudflare, which delivers the website, receive your IP address and what your browser requests. This is kept in server logs, not on your device. See sections 3, 5 and 6 of the Privacy Policy.
| What | Where on the phone | Contents | Purpose | How long |
|---|---|---|---|---|
| Sign-in token | Secure storage (iOS Keychain / Android Keystore) | Signed sign-in code from our server | Keep you signed in | Until you sign out, delete your account or the token expires (12 hours at most). On iPhone the token may remain in the Keychain after the app is removed, until it expires |
| Refresh token | Secure storage (iOS Keychain / Android Keystore) (gratisparkering.refreshToken) |
A random code our server exchanges for a new sign-in token. The server keeps only a fingerprint (hash) of it | Keep you signed in without signing in again every day | Until you sign out, delete your account, or it goes unused for 365 days. On iPhone it may remain in the Keychain after the app is removed, but the server no longer accepts it once the account is deleted or after 365 days unused |
| Profile copy | App's local storage | Email address, user ID, upload counts, free time, subscription ID, whether the account is suspended | Start the app quickly and show the map offline | Until you sign out or delete your account |
| Sign-up email | App's local storage | The email address you just registered (never the password) | Fill in the email address when you sign in after verifying it | Until you sign in, and 14 days at most |
| Recent searches | App's local storage | Up to 5 destinations you searched for (name, address, coordinates) | Quick picks on the map | Until you delete your account or remove the app |
| Badges and rewards shown | App's local storage | Which badges you collected and which free month you unlocked in the app | Avoid showing the same celebration twice | Until you delete your account or remove the app |
| Reported spots | App's local storage | Which spots you have reported | Don't offer "Report" again for a spot you already reported | Until you delete your account or remove the app |
| Dismissed announcement | App's local storage | The ID of the last announcement you closed | Don't show the same announcement again | Until you remove the app |
| Introduction completed | App's local storage | Yes/no | Don't show the introduction again | Until you remove the app |
| Usage-statistics choice | App's local storage (gratisparkering.analyticsConsent) |
Yes, no or not chosen yet, and which version of the text you answered | Remember your choice, so the app never sends statistics without permission | Until you change the choice or remove the app |
| Parking timer (Pluss) | App's local storage | The spot you parked at (ID, name and the spot's location), when the time runs out, and how long before you want a reminder | Show the countdown and remind you to move the car | Until you stop the timer, two hours after the time is up, or until you sign out or delete your account |
| "Parkeringstid" widget (Pluss, iPhone) | Storage shared between the app and the widget (App Group) | The spot's ID and name, when the timer started and runs out, the P badge, and the words the widget shows | Show the time you have left on the home screen and lock screen | The timer is removed when you stop it, sign out, or two hours after the time is up. The widget's words stay until you remove the app |
| Lock-screen countdown (Pluss, iPhone) | The phone's own Live Activities system (iOS) | The spot's name, the colour of its P badge and when the time runs out | Show the countdown on the lock screen and in the Dynamic Island | Until you stop the timer or sign out. iOS ends it after 8 hours at most, and an ended countdown can stay on the lock screen for up to 4 more hours |
| Scheduled reminders and zone alerts (Pluss) | The phone's own notification system (iOS / Android) | The notification text (for example the spot's or the zone's name), the time, and which spot a tap opens | Give you the alert at the right time, without anything being sent from our server | Until the alert is shown or cancelled. Cancelled when you stop the timer, turn zone alerts off, no longer have Pluss, or sign out |
| Reminder before a trial ends | The phone's own notification system (iOS / Android) | Notification text with the price, timed two days before the trial ends | Remind you to cancel before you pay, if you don't want to continue | Until it is shown. It stays when you sign out, because the store subscription continues |
| Zone-alert choice | App's local storage | On or off, and how long before (1, 2 or 3 hours) | Remember your choice under Profil → Varsler | Until you change the choice or delete your account |
| Notification question shown | App's local storage | Yes/no | Ask about notifications only once after you share a spot | Until you remove the app |
| Exact-alarm question (Android) | App's local storage | When you last answered "Ikke nå" (not now) | Don't ask about "Alarms & reminders" too often | Until you remove the app |
| Pluss setup and zones | App's local storage | Which tools need Pluss, and a copy of the zones (public data) | Show the right locks and zone warnings, also offline | Until you remove the app |
| Spots for offline use (Pluss) | App's local storage | Up to 1,000 spots you have seen on the map, and your list of favourites | Show the map and your favourites when you are offline | Until you sign out, delete your account or no longer have Pluss. Spots not fetched for 7 days are deleted |
| Street parking kept on the phone | App's local storage | Street lines and rules for the areas you have looked at (public data), up to 400 map tiles | Show street parking faster and use less data | Used for 24 hours at most. Older tiles are replaced by newer ones, and everything is deleted when you sign out or delete your account |
| Street parking on or off | App's local storage | Whether you turned "Gateparkering" off on the map | Remember your choice | Until you turn it back on or delete your account |
| Start timer on arrival | App's local storage | On or off | Remember the "Start timer når jeg er fremme" choice | Until you change the choice or remove the app (kept when you sign out) |
| Map style | App's local storage | Which map style you chose, and whether place names are shown | Show the map the way you chose | Until you change the choice or remove the app (kept when you sign out) |
| Customer parking on the map | App's local storage | Whether you turned "Kundeparkering" off on the map | Remember your choice | Until you turn it back on or delete your account |
| Hidden recent searches | App's local storage | Yes/no: whether you hid the recent-search quick picks | Don't show them again until you search again | Until you search again or delete your account |
| Rating question | App's local storage | When the app was first opened on this phone, and when we last asked for a rating in the App Store or Google Play | Don't ask for a rating in the first few days, and at most every 120 days | Until you remove the app |
This data stays on your phone and is not sent to us or anyone else (except the sign-in and refresh tokens, which are sent to our server when the app fetches data). The fonts are built into the app and are not downloaded. Storing your usage-statistics choice is strictly necessary to respect it, including when you said no.
| Service | What is stored or read on the phone | When | Necessary? |
|---|---|---|---|
| RevenueCat (subscriptions) | A random user ID we give RevenueCat, and a copy of subscription status and offers | While you are signed in | Yes, to give the access you paid for and show prices |
| Apple (APNs) / Google (Firebase Cloud Messaging) and Expo (notifications) | A notification address (push token) for the phone. On Android, Google Play services also keeps an installation ID for notifications | Only if you allow notifications | Yes, for the notifications you turned on |
| Expo (app updates) | New versions of the app, downloaded and kept until you next open it. The app sends its version and platform when it checks for updates | When the app starts | Yes, for the app you installed to work and get fixes |
| Maps: Google Maps SDK (iPhone and Android) | Map data cached. On Android, Google Play services uses its own identifiers under Google's terms | When you view the map | Yes, to show the map |
| Sign in with Google | Sign-in happens in a Google browser window. Google may set its own cookies on its pages in the phone's browser, under Google's privacy policy. We do not read them | When you sign in with Google | Yes, for the sign-in you choose |
| Sign in with Apple | Handled by iOS | When you sign in with Apple | Yes, for the sign-in you choose |
The app does not use an advertising ID (IDFA on iPhone, Google Advertising ID on Android), does not ask for tracking permission (App Tracking Transparency), and has no third-party analytics or crash-reporting tools. We do not let RevenueCat collect advertising device identifiers.
We produce our own simple statistics about how the app is used, to find out where people give up when creating an account, getting started or considering Pluss. There is no third-party analytics tool in the app. The statistics go only to our own server.
| What | Where | Contents | How long on the phone |
|---|---|---|---|
| Session ID | Only in the app's memory, never saved on the phone | A random code created each time the app starts. It is not derived from your phone or your account | Until the app is fully closed. A new one is created next time |
| Events waiting to be sent | Only in the app's memory | Which step or button (for example "chose sign-in with Google"), error code, platform and app version | A few seconds, until sent. If they cannot be sent, they are gone at the latest when the app closes |
The app reads only the platform (iOS or Android) and the app version from the phone. It does not read the advertising ID, a device ID, your location, contacts or anything you type. What we do with the statistics on the server, how long we keep them (90 days) and how they are linked to your account while you are signed in is set out in sections 3 and 6 of the Privacy Policy.
Your choice: the app sends nothing until you tick the box "Hjelp oss med å forbedre opplevelsen din" (help us improve your experience) on the sign-in screen. "Se mer" (see more) next to the box explains what is sent. If you have not ticked it, that counts as no. You can change your choice at any time under Profile → Konto og innlogging → Del bruksstatistikk.
Without consent, the server still counts some sign-up steps from requests the app sends anyway (for example that an account was created or an email address verified), without a user ID or session ID. That involves reading nothing from your phone, and is described in section 3 of the Privacy Policy.
Only for the in-app usage statistics. Everything in sections 3, 4.1 and 4.2 is strictly necessary to provide what you have asked for: signing in, using the map, searching, receiving notifications you turned on, buying or using a subscription, keeping the app updated, and remembering your choices. This is exempt from consent under section 3-15(2) of the Electronic Communications Act, which is why the website has no consent banner. The usage statistics in section 4.3 are not needed for your service, so they require consent, and the app asks you for it. The Norwegian Communications Authority (Nkom) and Datatilsynet jointly supervise section 3-15; Datatilsynet supervises the GDPR information and consent requirements.
Notifications and location are switched on or off in your phone's own permissions. That is not the same as consent to cookies or usage statistics.
If we change what is stored, we update this notice. Before we use anything that is not strictly necessary, we will ask for your consent.
VIBECODE AS · org. no. 938 738 750 · Gjerdrums vei 12D, 0484 Oslo, Norway · [email protected] · gratisparkering.net
