Privacy policy

Who is responsible

The controller is Zorbano s.r.o., ID 09257730, registered at Martinská čtvrť 1702, 744 01 Frenštát pod Radhoštěm, Czech Republic, registered with the Regional Court in Ostrava. RTK Pulse is part of the Corfuse product family.

Contact for anything in this document, including data-subject requests: info@corfuse.com.

What this covers

The RTK Pulse mobile app for iOS and Android, this website (rtkpulse.app), and the account backend at api.rtkpulse.app.

What never leaves your device

• NTRIP usernames and passwords. They are held in the platform secure storage (iOS Keychain / Android Keystore) and are sent only to the caster you chose to test, over that connection.
• The raw diagnostic run — the correction stream itself is decoded on the device.
• If you use the app without an account, everything: profiles, history, results.

Location

The app asks for location to sort nearby mountpoints by distance. That use alone stays on the device.

There is a second use you should know about before you accept: connecting to a network-RTK mountpoint (VRS, MAC, FKP — flagged nmea=1 in the caster’s sourcetable) requires the client to send its position to the caster as an NMEA GGA sentence. The caster operator — a third party you choose — therefore receives your approximate position, and the virtual reference station it returns is computed at that position.

We disclose this before the first test rather than mid-flow. By default the app rounds the position to about a kilometre before it goes upstream — enough for the network to build a virtual reference station, not enough to place you — and you can switch that off on the Test position screen if you would rather send the exact figure. Your position is never uploaded to our own servers.

You can also set the position yourself instead of following the phone’s — type coordinates, drop a pin on a map, take a mountpoint’s published position, or hold the phone’s current fix so it stops moving with you. That is useful when there is no fix indoors, or when you are checking a caster in a region you are not in. A position you set is stored only on the phone, and it is treated exactly like a measured one: it still goes to the caster in the GGA sentence, and it is still left out of a shared report unless you switch it on.

If you create an account

An account is optional. Sign-in uses Apple, Google, or email and password, and happens entirely in the app — no browser. Your identity is kept in our own account service at api.rtkpulse.app, hosted in the EU; we do not hand it to a third-party single sign-on. Apple and Google receive only what their sign-in flow needs; we receive an identifier and, if you allow it, your email address.

• Stored on our servers: your account identifier, profile metadata (caster host, port, mountpoint, label), and session results.
• Never stored on our servers: NTRIP passwords and precise position.
• An account gives you a backup and restore of your profiles and session history. It reaches us over an encrypted connection (TLS) and is stored as an opaque blob we do not read into — but it is not encrypted at rest. That is why it never contains passwords or precise position. The server keeps one copy per account, from whichever device saved last, and puts it back when you sign in somewhere new; continuous sync between two devices in active use does not exist.

Purchases

The app sells nothing. There is no subscription and no in-app purchase, so there is no payment data of any kind — no card details, no receipts, and no purchase processor in the app.

Notifications

Push notifications are off until you turn them on in the app, under Notifications. There is one choice: service notices — an outage, or a change that needs your action. We send no marketing notifications and ask for no consent to any, because we run no mailing or notification list. Nothing in the app depends on notifications, and you can turn them off in the app or in your phone’s settings at any time.

To deliver them we store on our servers a random identifier of the app installation, the push token your phone issues for RTK Pulse, which platform it is, your choice, and — only while you are signed in — which account the installation belongs to. We never put your connection details, credentials or position into a notification. Notifications are delivered by Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging), who receive the token and the text of the message.

Turning both choices off deletes the record; so does deleting your account, and a token that Apple or Google report as no longer valid.

Support reports

A report identifies the stream you tested: it includes your NTRIP username, so the provider can find the account, but never your password. Your own position is left out unless you turn it on when you send it — off by default. If the test ran from a position you set rather than a measured fix, the report says so instead of presenting it as where the phone was.

For a single physical base, the base station’s published coordinates are shown; those are public — the caster broadcasts them to every client. For a network-RTK (VRS) mountpoint the virtual base sits at your location, so its position is treated as yours and withheld unless you opt in. The report is built on your device and is never uploaded to our servers.

Feedback you send us

If you send feedback from inside the app, we receive your message, the app version and build, and which platform and OS version you are on. No account is needed and none is asked for. There is no device identifier of any kind. An e-mail address is optional and exists only so we can reply — leave it blank and the message is anonymous.

Sent from a result, feedback can also carry that test: the caster host, the mountpoint, the verdict and the technical detail of the run. You can switch that off. It never includes your password, and — unlike a support report — it does not include your NTRIP username either: that is there so your provider can find your account, and we are not your provider. The position the test ran from is off by default and included only if you turn it on.

This goes to our own server and our own support mailbox, both run by Zorbano s.r.o., and nowhere else. If you delete your account, feedback you sent is not erased but is detached from you: the e-mail address and the link to your account are removed, and what remains is a bug report with nobody’s name on it.

Analytics and tracking

As of this version the app ships with no advertising SDKs and no third-party analytics. This website is static: no cookies, no trackers, and fonts bundled with the page rather than fetched from anyone. The single script it loads from another host is the contact form described below, from our own service. Our servers keep short-lived access logs (IP address, user agent, requested path) for security and abuse handling.

The form on this site

The “I am interested in RTK Pulse” form asks for your name, your email address and an optional message, and nothing else. It is rendered and stored by SellBoost at sellboost.corfuse.com — our own product, on our own infrastructure, under the same controller as the rest of this site. It is not a third-party form service, and it sets no cookies on this page.

We use what you send to reply and to invite you to the beta. We do not add you to a mailing list and we pass it to nobody. Write to info@corfuse.com and we delete the entry.

How long we keep things

Account data lives until you delete the account, after which backups age out within 30 days. Uninstalling the app removes everything held locally. Access logs are rotated within 30 days. Entries from the form on this site are kept while the beta programme runs, and we delete them sooner on request.

Your rights

Under the GDPR you may request access to your data, correction, erasure, portability, restriction of processing, and you may object to processing. Write to info@corfuse.com; we answer within one month. You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

Transfers and children

Our servers are in the EU. Apple and Google, as the carriers of push notifications, may process data outside the EU under standard contractual clauses. The app is a professional tool and is not directed at children.

Changes

Material changes are reflected here with a new date at the top, and in the app store data-safety labels. The current version is dated above.