Privacy Policy - Graupel

Overview

Graupel is a personal weather dashboard. We collect the minimum amount of information needed to operate your account and serve forecasts for the locations you ask about. This page explains what we collect, why, how long we keep it, and what you can do about it.

If you have questions, contact the site operator listed in the About page.

What we collect

Account information. Email address, username, first and last name, and a password hash. Required to sign in.
Preferences. Display theme, timezone, units, and an optional home location (name and coordinates) you choose to save.
Favorites. Locations you bookmark (name and coordinates).
Session state. The currently selected location stored in your signed-in session.
Cookies. A sessionid cookie for sign-in and a csrftoken cookie for form security. Both are strictly necessary; we do not use advertising or analytics cookies.
Server logs. Request logs that include a truncated form of your IP address (we drop the final byte of an IPv4 address and keep only the network portion of an IPv6 address) and standard HTTP details. These are used for operations and abuse prevention.

How we use it

To authenticate you and remember your preferences across pages.
To fetch forecasts, observations, alerts, and history for the coordinates you select.
To send you transactional email such as password reset links and account deletion confirmations.
To detect and rate-limit abusive traffic.

We do not sell personal data, and we do not share it with advertisers.

Third parties that receive data

Amazon Web Services (SES). Sends transactional email (password reset, account deletion). Receives your email address and the message contents.
National Weather Service (weather.gov), RCC-ACIS, and USGS The National Map. Receive the latitude and longitude of the location you query. We do not pass your identity to these services.

How long we keep it

Account, preferences, favorites. Until you delete your account.
Sessions. Until you sign out or the session expires.
Server logs. Rolling window (operational; not used to build a long-term profile of you).
Database backups. Backups of the application database are stored in an encrypted Amazon S3 bucket with versioned retention (daily and weekly snapshots). After you delete your account, residual copies in backups expire on that schedule and are not used for any purpose other than disaster recovery.

Your choices

Update your information. Change your name, email, timezone, units, home location, or password from the Preferences page.
Export your data. Download a JSON copy of your account, preferences, favorites, and active session from Export my data.
Delete your account. Permanently remove your account and the data tied to it from Delete my account. This action is immediate and cannot be undone (subject to the backup retention described above).

Children

Graupel is not directed at children under 13 and we do not knowingly collect personal information from them.

Changes to this policy

If we change what we collect or how we use it, we will update this page and adjust the "last updated" date above.

« Back to About