Legal
Privacy Policy
Last updated: July 12, 2026
This policy is drafted to reflect how the product actually handles data, but it has not yet had a final legal review. Sections marked below require confirmation before this is relied upon as a binding notice.
1. Who we are
WindCaster is operated by WindCaster LLC (“WindCaster,” “we,” “us”). This policy covers the WindCaster.ai website, the interactive weather map, and the WindCaster mobile app. It explains what we collect, why, who processes it, and the controls you have — including how to delete your account and data.
2. Information we collect
- Email address — when you create an account. We use it to sign you in (a short verification code), to send the alerts you ask for, and — only if you opt in — occasional product-update emails.
- Password (optional) — if you set one, it is stored only as a salted hash (scrypt). We never store or can see your plaintext password.
- Saved spots — the coordinates and labels of places you choose to save, so the Spot Monitor can alert you. You can edit or delete these anytime.
- Weather Profile — the activities, vessel details, and comfort limits you optionally set to personalize your risk reads.
- Locations and questions you analyze — the coordinates, dates, and questions you submit for an assessment. For safety auditing we keep structured logs that record the coordinates and the computed result only. The full text of your questions and the AI’s replies are not stored in those logs.
- Device location — with your permission, your device’s position only while you are using the app, to center the map and localize the forecast. We do not track your location in the background.
- Push subscription — if you enable notifications, the browser or OS push token needed to deliver them (web push today; Apple Push when the iOS app ships).
- Usage metadata — standard request data (IP address, user agent) and first-party product analytics tied to a rotating, anonymous identifier. Daily usage counts are keyed by a hashed IP; we do not store raw IP addresses in analytics. On your device, we use only local storage (for your session and preferences) — no tracking cookies.
3. How we use it
- To compute and deliver weather risk assessments and the alerts you request.
- To operate, secure, and improve the service — safety auditing of computed results, abuse prevention, and aggregate usage counts.
- We do not use your data for advertising, and we do not sell or rent personal data.
4. Who processes your data
We rely on a small set of service providers, each for a specific purpose:
- AI model providers (currently Anthropic) — the weather facts and your question are sent to a large-language-model API to generate the narrative text. Per the provider’s commercial terms, this data is not used to train their models.
- Email delivery (Resend or Postmark) — to send verification codes, alerts, and update emails.
- Hosting (Fly.io) and a managed datastore — to run the service and store your account.
- Weather, tide, and geocoding sources — coordinates are sent to public APIs (NOAA / National Weather Service, ECMWF, Open-Meteo, NOAA NDBC, NOAA CO-OPS, NGA, RainViewer, and BigDataCloud for reverse geocoding) to fetch forecasts and place names. These receive a location, never your identity.
- Optional diagnostics — error monitoring (Sentry) and privacy-conscious product analytics (PostHog) may be enabled to keep the service reliable. When enabled they run without personal identifiers, with any coordinates rounded to roughly 11 km, and are never used for advertising. They are inactive unless configured by the operator.
- Subscriptions — if and when paid plans launch, an app-store billing provider (RevenueCat) will process purchase entitlements.
5. Retention & your controls
- Delete your account in the app — open the account panel and choose “Delete account.” This permanently removes your email, saved spots, push subscriptions, and sessions. It is immediate and cannot be undone.
- Unsubscribe — every alert and update email has a one-click unsubscribe link; you can also turn alerts off per saved spot.
- We keep account data until you delete it; you may also email us to access or delete your data.
6. Your privacy rights
Region-specific rights disclosures — for example, California (CCPA/CPRA) and the EU/UK (GDPR) — will be added here after legal review. In the meantime, you can exercise access and deletion rights through the in-app “Delete account” control or by emailing us.
7. Children
The service is intended for adults (recreational boaters and outdoor users) and is not directed to children under 13. We do not knowingly collect personal information from children.
8. Changes
We may update this policy as the product evolves; material changes are reflected here with a new “last updated” date.
9. Contact
Privacy requests, data access or deletion, or any question: support@windcaster.ai.
WindCaster LLC · Registered address available on request
See also our Terms of Service and data sources.