1. Who We Are
WindWindow is a mobile application developed and operated by Tom Schouten, based in the Netherlands (“we”, “us”, “our”). We are the data controller for personal data collected through the App.
Contact: privacy@windwave.dev
2. What Data We Collect
2.1 Account data (Firebase Authentication)
- Email address (for email sign-in or Google Sign-In)
- Google Account UID (Google Sign-In only)
- Profile photo URL (Google Sign-In only, if provided by Google)
2.2 Push notification token
- Expo push notification token — a device identifier used to deliver push alerts
2.3 Spot location data
- Latitude and longitude coordinates of kite spots you add. These are sent to our forecast API and to Open-Meteo to retrieve wind data. We do not use these to track your physical location.
2.4 Wind preferences
- Minimum wind speed threshold, wind direction range, and other alert settings. Stored encrypted on your device (Expo SecureStore) and on our server linked to your account.
2.5 Notification history log
- A log of push notifications sent to you, retained for 90 days, used to avoid duplicate alerts and to display notification history in the App.
3. Legal Basis (GDPR Art. 6)
We process your data under the following legal bases:
- Performance of a contract (Art. 6(1)(b)): Push token, location coordinates, account data, and wind preferences — necessary to provide the alert service you requested.
- Legitimate interests (Art. 6(1)(f)): Notification history log — to prevent duplicate alerts and improve notification reliability. This interest does not override your rights; you can request deletion at any time.
4. How We Use Your Data
- To fetch wind forecasts for your spots from Open-Meteo.
- To send push notifications when wind conditions match your thresholds.
- To sync your spots and preferences across your devices (if you are signed in).
- To enforce freemium tier limits (spot count).
We do not use your data for advertising, profiling, or sale to third parties.
5. Third-Party Processors
We share data with the following processors to provide the service:
- Open-Meteo (EU — terms) — receives spot lat/lon to return forecast data.
- Expo Push Notifications (USA — privacy) — delivers push alerts to your device using your Expo token.
- Firebase / Google (USA — privacy) — Authentication; also processes notifications on Android via FCM.
- Railway (USA — privacy) — hosts our API and database servers.
- Nominatim / OpenStreetMap (EU) — used for reverse-geocoding when you add a custom spot by dropping a pin. Only lat/lon is sent.
6. International Transfers (GDPR Chapter V)
Expo, Firebase/Google, and Railway are US-based. Transfers are covered by Standard Contractual Clauses (SCCs) as provided by each processor under their own DPA or privacy programme. Links to each processor’s privacy documentation are listed above.
7. Data Retention
- Push tokens: retained until you delete your account or unregister the device.
- Firebase Auth data (email/UID): retained until you delete your account.
- Notification log: automatically deleted after 90 days.
- Spot and preference data: retained until you delete your account.
8. Your Rights (GDPR Arts. 15–22)
You have the right to:
- Access the personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure (“right to be forgotten”) — delete your account and all associated data via the App’s account settings, or by emailing us.
- Restriction of processing in certain circumstances.
- Data portability — request a copy of your data in a machine-readable format.
- Object to processing based on legitimate interests.
To exercise any right, email privacy@windwave.dev. We will respond within 30 days.
9. Right to Lodge a Complaint
If you believe we have not handled your data correctly, you may lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens.
10. Children
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided data to us, please contact us.
11. Changes to This Policy
Material changes will be announced in the App. The “Last updated” date at the top of this page always reflects the most recent revision.
12. Contact
Data controller: Tom Schouten, Netherlands
Email: privacy@windwave.dev