1. Who We Are
WindWindow is a mobile application developed and operated by WindWave Development, based in the Netherlands (“we”, “us”, “our”). We are the data controller for personal data collected through the App.
Contact: privacy@windwave.dev
2. What Data We Collect
2.1 Account data (Firebase Authentication)
- Email address — processed by Firebase Authentication (our processor) to sign you in. We do not store your email address on WindWave servers; our own database holds only a pseudonymous user ID.
- Firebase user ID — a pseudonymous identifier linking your spots, preferences, and session logs to your account.
- Display name and profile photo (Google Sign-In only) — shown to you inside the App directly from your Google account; never stored on WindWave servers.
Data minimisation: we deliberately collect no names, no postal addresses, and no device GPS history. The only identifiers our servers hold are the pseudonymous user ID and, if you enable alerts, a push-notification token.
2.2 Push notification token
- Expo push notification token — a device identifier used to deliver push alerts
2.3 Spot location data
- Latitude and longitude coordinates of kite spots you add. These are sent to our forecast API and to Open-Meteo to retrieve wind data. We do not use these to track your physical location.
2.4 Wind preferences
- Minimum wind speed threshold, wind direction range, and other alert settings. Stored encrypted on your device (Expo SecureStore) and on our server linked to your account.
2.5 Notification history log
- A log of push notifications sent to you, retained for 90 days, used to avoid duplicate alerts and to display notification history in the App.
2.6 Session logs (optional)
- If you use the Log feature, we store the kite sessions you record: spot name, date, duration, wind speed, kite size, a 1–5 rating, and an optional free-text note. This data is created only when you log a session yourself, is linked to your account, and is visible only to you.
- Please avoid putting other people’s personal details or sensitive information (e.g. health details) in session notes — notes are stored as you type them.
2.7 Device location (on-device only)
- If you tap “locate me” on the Discover map, the App asks the operating system for your position once and uses it solely to centre the map on your device. Your GPS position is never sent to our servers or stored.
3. Legal Basis (GDPR Art. 6)
We process your data under the following legal bases:
- Performance of a contract (Art. 6(1)(b)): Push token, location coordinates, account data, wind preferences, and session logs you choose to record — necessary to provide the alert and logbook features you requested.
- Legitimate interests (Art. 6(1)(f)): Notification history log — to prevent duplicate alerts and improve notification reliability. This interest does not override your rights; you can request deletion at any time.
4. How We Use Your Data
- To fetch wind forecasts for your spots from Open-Meteo.
- To send push notifications when wind conditions match your thresholds.
- To sync your spots and preferences across your devices (if you are signed in).
- To store and display your logged kite sessions and personal statistics (session count, hours, average wind).
- To enforce freemium tier limits (spot count).
We do not use your data for advertising, profiling, or sale to third parties.
5. Third-Party Processors
We share data with the following processors to provide the service:
- Open-Meteo (EU — terms) — receives spot lat/lon to return forecast data.
- Expo (USA — privacy) — delivers push alerts to your device using your Expo token, and serves over-the-air app updates (EAS Update): on app start your device requests the latest app bundle from Expo’s update servers, which involves standard request metadata (device platform and app version).
- Google Maps SDK (USA — privacy) — renders the Discover map on Android. The Maps SDK may transmit device identifiers and map-usage telemetry to Google as described in Google’s privacy policy. On iOS the App uses Apple Maps (MapKit), provided by the operating system.
- Firebase / Google (USA — privacy) — Authentication; also processes notifications on Android via FCM.
- Railway (USA — privacy) — hosts our API and database servers.
- Nominatim / OpenStreetMap (EU) — used for reverse-geocoding when you add a custom spot by dropping a pin. Only lat/lon is sent.
- Sentry (Functional Software Inc., USA — privacy) — error tracking and crash reporting on both the mobile app and backend server. Data processed: device model, OS version, app version, anonymised stack traces, and breadcrumb events leading up to a crash. No personal data (email, push token, location) is sent to Sentry. EU→US transfer covered by Standard Contractual Clauses.
6. International Transfers (GDPR Chapter V)
Expo, Firebase/Google, Railway, and Sentry are US-based. Transfers are covered by Standard Contractual Clauses (SCCs) as provided by each processor under their own DPA or privacy programme. Links to each processor’s privacy documentation are listed above.
7. Data Retention
- Push tokens: retained until you delete your account or unregister the device.
- Firebase Auth data (email/UID): held by Firebase until you delete your account (in-app deletion also removes your Firebase Auth record).
- Server request logs: client network addresses are masked by default (last segment removed) and kept only within our host’s short log-retention window.
- Notification log: automatically deleted after 90 days.
- Spot and preference data: retained until you delete your account.
- Session logs: retained until you delete the individual session or your account.
- Crash reports (Sentry): retained by Sentry for 90 days under Sentry’s standard retention, then deleted.
8. Your Rights (GDPR Arts. 15–22)
You have the right to:
- Access the personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure (“right to be forgotten”) — delete your account and all associated data via the App’s account settings, or by emailing us.
- Restriction of processing in certain circumstances.
- Data portability — request a copy of your data in a machine-readable format.
- Object to processing based on legitimate interests.
To exercise any right, email privacy@windwave.dev. We will respond within 30 days.
9. Right to Lodge a Complaint
If you believe we have not handled your data correctly, you may lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens.
10. Children
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided data to us, please contact us.
11. Changes to This Policy
Material changes will be announced in the App. The “Last updated” date at the top of this page always reflects the most recent revision.
12. Contact
Data controller: WindWave Development, Netherlands
Email: privacy@windwave.dev