Privacy Policy

12. FireWeather App — Additional Disclosures

This section applies to Wildflyer FireWeather, our fire-weather app for iOS, Android and the web (fire-weather.com). It is a separate product from Analyst and FieldKit, it is free to use, and it collects markedly less than either of them. It is written to be read on its own, and where it says something different from sections 2 to 11, this section is the one that applies to FireWeather.

An account is optional. You can open the app, look up any place, read its forecast, use the map and switch on a fire-weather alert without signing in and without telling us who you are. Signing in — with your email address and a one-time code — is needed for two things only: to save places so that they follow you between devices and survive a reinstall, and to buy or redeem a paid plan. Section 12.7 describes what an account stores. Sections 12.1 to 12.6 describe what happens whether or not you have one.

12.1 What Stays on Your Device

Your settings (language, units, light or dark), the place you last looked at, the places you have saved, a copy of the last forecast so the app opens offline, and — once you switch on an alert — a random identifier for this device, are all stored on your phone or in your browser. Without an account, none of this is transmitted, with one exception: the place attached to an alert you switch on, which we must keep in order to send that alert (12.6). With an account, your saved places are additionally kept on our servers so they can be restored on another device (12.7). Deleting the app removes everything stored on the device.

12.2 Data Collected by FireWeather

We do not collect your phone number, contacts, photos, files, calendar or health data through FireWeather, and we never read your location in the background. We do not use advertising identifiers. The app contains no ads and no advertising SDKs. We never see or store a card number — payment details are entered on Stripe's, Apple's or Google's pages, not ours.

12.3 Location — What Actually Happens To It

To show you the weather somewhere, that place's coordinates have to reach the service that produces the forecast. FireWeather sends them to Open-Meteo, in the request itself, and receives weather back. Nothing identifying travels with them: no account, no device identifier, no history. For browsing the forecast, we do not store your location on our servers — in that path there is no server of ours at all, whether or not you are signed in.

A place's coordinates reach our servers in exactly two cases: the place attached to an alert you switched on (12.6), and the places you bookmark while signed in (12.7). Both are places you chose deliberately, not a trail of where your phone has been. The position of your device itself is never stored by us.

If you grant the location permission, it applies while you are using the app only. FireWeather never requests background location and cannot read your position when it is closed. An alert does not change this — it is sent from our servers on a schedule, using the place you picked, and does not read your phone's position.

12.4 Analytics — Measuring Without Identifying Anyone

We want to know whether people find the app useful. Measuring that normally requires an identifier that follows you, and we decided not to have one. Instead:

• Every measurement is computed on your device and coarsened before it is sent. Where a conventional analytics system would send "user 4f2a opened the app on 12 September, day 23 of their use", we send "someone opened the app; they are in the 21+ days bucket and have used it on 14+ distinct days". Those buckets are all we ever receive.
• No identifier is attached — no account, no advertising id, no cookie. Signing in does not change this. Your account id is never attached to an analytics event; the analytics code drops any identifier by name before an event leaves your device, and a sign-in is recorded as "somebody signed in, from this screen", never who. The alerts identifier described in 12.6 is not attached either. We cannot join an account or an alert subscription to anyone's usage.
• Anything that could carry a coordinate, a search term or a place name is removed before the event leaves your device, as a safety net independent of what any individual screen sends.
• Our analytics are Umami, self-hosted on our own infrastructure in the EU. No third-party analytics or advertising company receives anything.

12.5 Crash Reports

We use Sentry (hosted in the EU, Germany) to be told when the app crashes. Because the app fetches forecasts by putting coordinates in a URL, a default crash reporter would ship your exact location to a third party. FireWeather removes coordinates from crash data in three independent places — from breadcrumbs, from the crash event itself, and by switching off the SDK's network breadcrumbs entirely — so that a crash report cannot carry your position even when the crash happened inside a network request. Unlike Analyst and FieldKit (2.9), a FireWeather crash report carries no user id, no email address and no IP address; it names the country the place was in, the app language, and the technical state of the screen, and nothing about you.

12.6 Fire-Weather Alerts

Alerts are off until you switch one on, and the app never asks for notification permission at launch or on opening the alerts screen — only at the moment you turn an alert on. You do not need an account for them.

When you switch one on, your phone or browser generates a random identifier — 122 random bits, minted on the device, not derived from anything about you, your device or your Apple or Google account — and stores it in the app's own storage. We keep one row per alert you enable, containing:

• that random identifier, and a push notification token for your phone (or, in a browser, the browser's push subscription);
• the coordinates and name of the place you chose for the alert, and its time zone;
• which alert it is, how often you want it, the hour of day you asked to hear about it, and which language to write it in;
• the date we last sent it, so an hour that runs twice does not notify you twice;
• if you are signed in on that device, a link to your account, so that the deletion actions in 12.9 can find it.

That is the entire record. There is no history of what we sent you. The identifier is not your device's advertising id or any identifier shared with other apps — it exists only inside FireWeather and only for this purpose. When an alert goes out, the notification — its text, and the place and date it is about, so the app can open on them — is handed to the push services named in 12.2 for delivery.

How it is deleted. Turning an alert off deletes that row immediately and completely — turn off every alert and nothing about your device remains. Deleting the app removes the identifier from your phone, and because our notification relay tells us when a token belongs to an app that no longer exists, we delete the row when that happens. As a backstop, any subscription whose app has not been seen for 90 days is deleted automatically. If you are signed in, Delete my FireWeather data (12.9) removes every alert attached to your account and to that device at once.

Alerts in a browser. The web version asks your browser for notification permission and keeps the same record. At the time of writing, browser alerts are not yet being sent — the alerts screen says so — and the subscription is stored so that they can start without you having to set them up again. It is deleted in the same ways.

12.7 Your Account

Signing in. You enter your email address and we send you a six-digit code, which is valid for ten minutes and is discarded once used or expired. There is no password. The code email is delivered by Brevo (France), our email provider. An account is created the first time you sign in.

What an account stores. Your email address; a display name, which we take from the part of your email address before the @ unless you change it; the language you use the app in; when the account was created; and a record of each sign-in with its date, the method used, the IP address it came from and the browser or device string. Those sign-in records exist for security — they are how an account being used from somewhere unexpected could be noticed — and they are the only place our servers keep your IP address. Attached to the account are the places you save (12.2) and any alert you switch on while signed in (12.6), and, if you buy or redeem a plan, the plan record described in 12.8.

Staying signed in. A signed-in session is kept in a cookie in your browser, or in the secure storage of your phone. It expires after seven days without use, and signing out ends it. Signing out does not delete anything: your saved places stay on the device and on our servers, and your alerts keep working.

One account across our products. If you already have a Wildflyer Analyst or FieldKit account under the same email address, signing in to FireWeather uses that same account. What you do in those products is covered by sections 2 to 11; a FireWeather-only account is a member of no organisation and is not visible in them.

Why we may process it (legal basis). Your account, saved places and plan are processed to provide the service you asked for (Article 6(1)(b) of the General Data Protection Regulation (GDPR), performance of a contract). Sign-in records are kept in our legitimate interest in keeping accounts secure (Article 6(1)(f)). Alerts, and reading your device's location, happen only with your consent, which you withdraw by switching the alert off or revoking the permission (Article 6(1)(a)). Billing records are kept because tax law requires it (Article 6(1)(c)).

How long. Everything above is kept for as long as your account exists and is deleted with it (12.9). Where a session cookie is used, section 10 applies.

12.8 Paid Plans and Payments

FireWeather is free, and the free version stays free. Optional paid plans add capacity, such as more saved places and more alerted places. A plan is attached to your account, which is why buying one requires signing in. What we keep for a plan is small: which plan, when it started, when it renews or ends, and where it came from — a purchase, or a gift or licence code.

Buying on the web. Purchases made on fire-weather.com are processed by Stripe. Stripe receives your email address, your country and, where needed to calculate tax, your billing address, together with your card or other payment details, which you enter on Stripe's pages and which never reach our servers. Stripe calculates and applies value-added tax. We store a reference to your Stripe customer record and the status of your subscription, so the app can show your plan and so a missed notification from Stripe can be corrected. Invoices and receipts are issued by Stripe; you can manage or cancel a subscription through the billing portal Stripe provides, reached from the account screen. See the Stripe Privacy Policy.

Buying inside the app. Where a plan is offered inside the iOS or Android app, the purchase is made through Apple's App Store or Google Play. Apple or Google handle the payment and hold your payment details; we never receive them. What we receive is a record of the purchase — which plan, when it started and when it renews or ends, and an anonymised transaction reference — which we attach to your account so the plan works on every device you sign in on. We use RevenueCat (US) to receive and verify those purchase records from Apple and Google. Refunds and cancellations for in-app purchases are handled by Apple or Google under their terms.

Gift and licence codes. A code is redeemed against your account on the web. We record which code was used, by which account and when. If someone gave you the code, they can see that it was used, but never your email address.

How long. Plan records are kept for as long as your account exists. Billing records — the invoices Stripe issues and our record of the sale — are kept for up to seven years after the purchase, as Dutch tax law requires, and survive account deletion; they are kept for that purpose only.

12.9 Deleting Your Data, and Your Rights

If you have never signed in and never switched on an alert, FireWeather holds no account and no identifier for you, so there is no personal data of ours to look up, correct, export or delete — nothing links any record to you. To remove everything the app has kept, delete the app: the saved places and settings live on your device and go with it.

If you have switched on an alert without an account, the record described in 12.6 exists until you delete it. You can do that yourself at any moment, without contacting us: turn the alert off in the app, or delete the app. We hold nothing that would let us find that record from your name or email address, so self-service deletion in the app is the complete route.

If you have an account, two actions are built into the app, under Settings → Account, on every platform including the web at fire-weather.com — so you can use them without having the app installed:

• Delete my FireWeather data removes, immediately and permanently, every saved place and every alert attached to your account and to the device you are using. Your account stays, so you can sign in again later with an empty slate.
• Delete my account ends the account. For a FireWeather account — one that is not a member of any organisation in Analyst or FieldKit — this is an immediate, permanent, hard delete: the account, its email address, its sign-in records, its sessions, its saved places, its alerts and its plan records are all removed in a single step, and you are signed out. There is no grace period and no way to undo it. If the same account is also a member of an organisation, the app instead sends an erasure request to our privacy team, because your entries in that organisation's incident records cannot be removed automatically; we complete the request within 30 days and confirm it to you by email.

Deleted data is gone from our active systems at once and from backups within 90 days (section 8). Billing records are the one exception, for the reason and the period given in 12.8. Your other rights under the GDPR — access, correction, portability, restriction and objection — are as described in section 9, and the address to write to is the same.

If you believe we hold personal data about you despite the above, contact daan@wildflyer.co and we will investigate and respond within 30 days.

12.10 Third-Party Services in FireWeather

• Hetzner (Germany) — hosts our servers and database, which is where accounts, saved places, alert subscriptions and plan records live.
• Open-Meteo (Germany) — weather forecasts and place search. Receives coordinates and search terms, directly from your device. See the Open-Meteo terms.
• Mapbox (US) — map rendering and turning your coordinates into a place name. The Mapbox telemetry in the phone app is switched off. See the Mapbox Privacy Policy.
• Brevo (France) — delivers the sign-in code email, and the confirmation email if you request erasure. See the Brevo Privacy Policy.
• Sentry (EU, Germany) — crash reporting. See the Sentry Privacy Policy.
• Expo (US) — app builds, over-the-air updates, and the push notification relay for alerts. If you enable an alert on a phone, Expo receives your push token and the notification in order to deliver it. See the Expo Privacy Policy.
• Apple and Google (US) — the operating-system notification services that deliver an alert to your phone (Apple Push Notification service, Google Firebase Cloud Messaging), and, for purchases made inside the app, the payment processing of the App Store and Google Play. Mozilla plays the notification role for Firefox on the web.
• Stripe (US/EU) — payment processing for purchases made on the web. See the Stripe Privacy Policy.
• RevenueCat (US) — receives and verifies in-app purchase records from Apple and Google, where a plan is sold inside the app. See the RevenueCat Privacy Policy.

Our analytics (Umami) run on our own servers and are not a third party. The complete list, with what each processor receives, is the List of Data Processors linked in section 5.