Privacy Policy - WindPulse

WindPulse is a small indie app built by one developer. This policy is written to be straightforward and honest — not to hide anything behind legalese. I collect only what the app needs to work, I don't sell your data, and I don't share it with advertisers.

📋 1. What data is collected

Data type	Details	Stored where
Location	Your device's coordinates, used at the time you open the app to find nearby kite spots and weather stations. Not stored continuously or in the background.	Device only
Push token	A unique identifier generated by Expo's push service, used to send you wind alerts and crew notifications.	Supabase
User profile	Your display name and account identifier (email or anonymous ID). Created when you sign up or use crew features.	Supabase
Saved spots	Kite spots you save, including name, coordinates, and your preferred wind speed range and direction for each spot.	Supabase
Sessions	Kite sessions you log (date, spot, duration), used for crew rankings and streak tracking.	Supabase
Crew membership	Which crews you belong to, your role (member or admin), and crew activity you share (planned sessions).	Supabase
Calendar access	Permission to write events to your device calendar when you choose to block time for a kite session. WindPulse does not read your existing calendar entries.	Device only
Notification settings	Your alert preferences (which spots, thresholds, timing). Stored locally and synced to Supabase if you are signed in.	Supabase

🔧 2. How your data is used

Showing forecasts

Your location is used to identify which weather stations and forecast grid points are closest to you. This lookup happens on-device and the coordinates are not stored.

Sending wind alerts

Your push token and alert preferences are used to send you notifications when wind conditions match your thresholds. You can disable all notifications at any time in the app or in your device settings.

Crew features

Your profile, saved sessions, and crew membership are used to power the crew dashboard, rankings, and activity feed. Other crew members can see your display name, planned sessions, and session count.

Calendar blocking

When you tap "Block time" on a forecast, WindPulse creates a calendar event on your device. This requires calendar write permission. No calendar data is sent to any server.

What WindPulse does NOT do

Track your location in the background — sell or share your data with advertisers — use your data to train AI models — read your existing calendar events.

🌐 3. Third-party services

WindPulse relies on the following external services. Each has its own privacy policy.

Supabase

Database and authentication provider. Your profile, spots, sessions, and push tokens are stored on Supabase infrastructure (hosted in the EU by default). — supabase.com/privacy

Open-Meteo

Free, open-source weather API providing hourly wind forecasts (ECMWF, GFS, ICON models). WindPulse sends geographic coordinates to retrieve forecast data. Open-Meteo does not require an account and does not track users. — open-meteo.com/en/terms

KNMI (Royal Netherlands Meteorological Institute)

Provides real-time measured wind data from Dutch weather stations. Coordinates of nearby stations are sent to retrieve live readings. KNMI is a Dutch government institute. — knmi.nl/privacyverklaring

Expo Push Notification Service

Expo's notification infrastructure is used to deliver push notifications to your device. Your push token is registered with Expo's service. Expo does not receive the content of notifications in a way that identifies you. — expo.dev/privacy

🔒 4. Data storage and security

Data stored in Supabase is protected by row-level security policies, meaning each user can only access their own records (unless explicitly shared via crew features). Communication between the app and Supabase is encrypted over HTTPS/TLS.

WindPulse is a small indie project. While reasonable security measures are in place, no system is perfectly secure. If you discover a vulnerability, please report it to privacy@windpulse.app.

Data is retained for as long as your account is active. If you delete your account, your profile, saved spots, sessions, and push tokens are deleted from Supabase within 30 days.

🧑‍⚖️ 5. Your rights

Access and export — You can request a copy of all data stored about you by emailing privacy@windpulse.app. I'll get back to you within 30 days.
Deletion — You can delete your account directly in the app (Settings → Account → Delete account), or by emailing the address above. All associated data is removed from Supabase within 30 days.
Notification opt-out — Disable notifications at any time in the app (Settings → Notifications) or via your device's notification settings.
Location permission — Location access can be revoked at any time in your device's app permissions. The app will still work; you'll just need to search for spots manually.
Calendar permission — Calendar access can be revoked at any time in your device settings. This only affects the "Block time" feature.
GDPR — If you are in the EU/EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to object to processing and to lodge a complaint with a supervisory authority.

✉️ 6. Contact

WindPulse is developed and maintained by Sando van der Helm.

For any privacy-related questions, data requests, or concerns, email: privacy@windpulse.app

I'll do my best to respond within 30 days.

📝 7. Changes to this policy

If this policy changes in a meaningful way (e.g. new data being collected, new third parties), the app will notify you via a push notification or in-app message. The effective date at the top of this page will always reflect the latest version.

WindPulse Privacy Policy