Privacy Policy
Effective October 2, 2026
Airmass Wx ("we", "us") collects as little as it needs to run a soaring forecast. We don't sell your data, show ads or use tracking or advertising cookies. This policy explains what we collect and your choices.
We don't sell or share your data
We never sell your personal data, and we don't share it with anybody for their own use: no advertisers, data brokers, marketing lists or AI training. The only outside services that handle it are the ones that run Airmass Wx for us (listed under "Who processes it" below), and they may use it only to provide their service to us. This includes "selling" and "sharing" as California's CCPA defines them: we do neither.
What we collect
- Account details. Your email address and, if you give one, your name. If you sign in with Google, we receive your name, email address and profile picture from Google. Passwords are handled by our sign-in provider and stored only as a secure hash; we never see them.
- Synced settings. If you're signed in, the app saves your settings (units, glider and custom polar, safety and tow heights, XC task, pinned layers, sidebar and map preferences) to your account so they follow you between devices.
- Billing. If you subscribe, Stripe collects your payment details and billing address. We receive and store only your Stripe customer ID, your subscription status, plan and renewal dates, and whether you've used your free trial. We never see or store your full card number.
- Technical data. Our hosting provider records standard request logs (IP address, browser type, pages and time) to deliver the site, limit abuse and fix problems.
What stays on your device
- Location. On your first visit the map opens near you: from your browser's location if you've already allowed it for this site, otherwise from the approximate (city-level) location of your IP address, which our host Netlify looks up. "Go to my location" uses your browser's location only to move the map. We don't store either.
- Files you open. Waypoint (.cup), task (.cup, .tsk, .xctsk) and flight track (.igc) files are read in your browser and never uploaded. Waypoint files you add are kept in your browser's storage until you remove them (Map → Your files). XC tasks you save are settings: they sync with your account when you're signed in.
- Local storage and cookies. The app keeps your settings and a small radar-station cache in your browser's local storage. When you sign in, it sets session cookies that keep you signed in and let our servers check your plan. They aren't used for tracking.
How we use it
To run your account, sync your settings, provide Pro to subscribers, process payments, send account emails (confirmation, password reset, billing receipts from Stripe), answer you when you contact us, keep the Service secure and fix bugs. We also send What's new emails when a release brings new features: to accounts made before October 2, 2026 unless switched off, and to newer accounts only if switched on in Account. Every one has an unsubscribe link, and you can switch them off in Account at any time. We don't send other marketing email.
Who processes it
We share data only with the services that run Airmass Wx, and only for that purpose:
- Netlify: hosting, sign-in (Netlify Identity) and account storage.
- Resend: sends What's new emails (Resend privacy policy).
- Stripe: payments and subscriptions (Stripe privacy policy).
- Google: "Continue with Google" sign-in, if you use it. The site also loads its heading font from Google Fonts.
- Weather and map providers: when you view a map or sounding, your browser loads data directly from providers such as Open-Meteo, NOAA/NWS, the Iowa Environmental Mesonet, Esri and other base-map providers. Like any website, they see your IP address, and a sounding request includes the map point you picked. They don't receive your account details.
That's the complete list. Beyond it, we'd disclose information only if the law requires it (for example, a valid court order).
How long we keep it
We keep account data until you delete your account. Deleting it (Account → Delete account) removes your sign-in and saved settings right away. Stripe keeps payment and invoice records for as long as tax and financial laws require. Hosting logs are kept only briefly.
Your rights
You can see and change your settings in the app and delete your account at any time. You can also email us to get a copy of your data, correct it or delete it. Depending on where you live (for example, under the GDPR or California's CCPA), you may have further rights, such as to object to processing or complain to a data-protection authority. We honour these requests wherever you live. Where the GDPR applies, we process your data to provide the Service you signed up for (the contract with you), for our legitimate interest in keeping it secure, and, for What's new emails, on your consent or our legitimate interest in telling account holders about the Service, which you can object to at any time by unsubscribing. Your data is processed in the United States.
Children
The Service isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has signed up, email us and we'll delete the account.
Security
Traffic is encrypted (HTTPS), passwords are hashed by our sign-in provider, and payment data stays with Stripe. No system is perfectly secure. If a breach affects your data, we'll tell you as the law requires.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before the change takes effect.