WEATHER BROTHER PRIVACY POLICY

Introduction and Scope. Storm Chasing for Science LLC, a Kentucky limited liability company doing business as Weather Brother (“we,” “us,” “our,” or “Weather Brother”), operates the Weather Brother mobile application (the “App”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the App.

Data Controller Information. The entity responsible for processing your personal data is:

Information We Collect.

Information You Provide Directly.

Account Information. When you create an account, we collect your name, email address, and password. We also assign you a unique account identifier through our authentication provider (Supabase) that is used to link your saved data, preferences, and subscription status to your account.

Profile and Preferences. You may provide your shelter type (e.g., interior room, basement, storm shelter, mobile home), building condition, floor level, household size, mobility constraints, flood-risk information, and alert timing preferences. These allow us to personalize severe weather alerts and crisis guidance.

Shelter and Crisis Profile. You may optionally complete a shelter-preparedness profile that includes building type, foundation type, household size, pets, and mobility constraints. This information is used solely to generate personalized shelter guidance and safety plans.

AI Chat and Summaries. If you opt in to AI features, we collect your chat prompts and the AI-generated responses, AI daily and weather summaries, AI alert summaries, and any feedback or reports you submit regarding AI answers. We also store your AI consent status. See Section 13 for additional details.

Communications. If you contact us for support or feedback, we collect the content of your messages and any information you choose to provide.

Payment Information. If you subscribe to WeatherBrother Pro, payment processing is handled by Apple’s in-app purchase system, Google Play’s in-app purchase system, or RevenueCat, our subscription management provider. We do not directly collect or store your credit card number, bank account number, or other financial account information. RevenueCat receives subscription entitlement state, product and store identifiers, and purchase, renewal, and cancellation event data.

Information Collected Automatically.

Precise Geolocation Data. With your express, opt-in consent, we collect your device’s precise GPS coordinates in real time. This is the core functionality of the App — we use your exact location to determine whether you are in the path of severe weather and to generate personalized alerts. Precise geolocation is classified as sensitive personal data under the Kentucky Consumer Data Protection Act (KRS 367.3574) and the Tennessee Information Protection Act (§ 47-18-3303), and we treat it accordingly. You may also use the App by manually entering or saving locations without granting GPS permission.

Saved and Manual Locations. You may search for, select, and save specific locations for weather monitoring. These saved locations are stored in your account profile.

Device and Push Notification Data. We collect device type, operating system version, unique device identifiers, Expo push token, notification permission state, and critical-alert authorization state (where supported by your device) to ensure compatibility and deliver push notifications.

Usage and App Activity Data. We collect information about how you interact with the App, including features used, screen interactions, weather and radar requests, alert response times, and session events. This data is processed by PostHog, our product analytics provider, and helps us improve the App’s effectiveness.

Crash and Performance Data. We collect diagnostic data, including crash reports, error events, stack traces, device and build metadata, and limited account identifiers when needed to debug account-scoped issues. This data is processed by Sentry, our crash reporting provider.

Information from Third-Party Sources.

Weather and Map Data. We receive weather data from the National Weather Service (NWS) and NOAA, weather data from OpenWeather, and map rendering services from Mapbox. These providers receive your location or query data as necessary to return relevant weather and map information. This data does not contain personal information beyond what is necessary to fulfill the request.

AI/Machine Learning Inputs. Our AI-powered severe weather features are powered by Google Gemini. When you use AI features, your chat prompts, location context, and profile preferences are transmitted to Google Gemini to generate responses. See Section 13 for additional details.

How We Use Your Information. We use the information we collect for the following purposes:

Personalized Weather Alerts and Guidance. Matching your precise location and shelter profile against real-time severe weather data to deliver alerts tailored to your actual risk.

Travel Forecasting. If you use the travel forecast feature, we process your route information to provide weather conditions along your planned path.

AI Chat and Summaries. Our AI-powered features answer your weather-related questions and generate weather summaries using meteorological data and your profile preferences. AI features are opt-in and require a separate consent attestation.

App Improvement. Analyzing aggregated, de-identified usage patterns to improve severe weather tracking algorithms, alert timing, and overall App performance.

Safety Communications. Sending you critical weather safety information, service announcements, and updates related to your account.

Subscription Management. Processing and managing your WeatherBrother Pro subscription, including billing, renewals, restoration, and account status communications.

Diagnostics and Reliability. Identifying and resolving crashes, errors, and performance issues to maintain a reliable App experience.

Abuse Prevention and Rate Limiting. Monitoring usage patterns to enforce AI usage limits and prevent abuse of App features.

Compliance and Legal Obligations. Complying with applicable laws, regulations, and legal processes.

Sensitive Data and Consent. Under the KCDPA and similar state privacy laws, precise geolocation data is classified as sensitive personal data. We process this data only with your affirmative, opt-in consent, obtained through the App’s onboarding flow and your device’s operating system location permission prompt.

How We Share Your Information. We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. We do not share your personal data with affiliate partners, sponsors, or commercial referral networks. We may share your information only in the following limited circumstances:

Service Providers. We share data with service providers who perform functions on our behalf. A complete list of our current third-party service providers, the data each receives, and the purpose of that sharing is set forth in the Third-Party Service Provider Disclosure Table in Section 6.5 below. These providers are contractually required to use your data only for the services they provide to us and to maintain reasonable security measures.

Legal Requirements. We may disclose your information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to protect the safety of any person, to address fraud or security issues, or to protect our legal rights.

Business Transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

With Your Consent. We may share your information for any other purpose with your express consent.

Third-Party Service Provider Disclosure Table. The following table identifies each third-party service provider that receives personal data in connection with the App’s operation, the categories of data shared, and the purpose of that sharing.

Data Retention. We retain your personal data only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Data. Retained for the duration of your active account, plus 30 days following account deletion to process the deletion request.

Geolocation Data. Real-time geolocation data used for alert generation is processed in transit and is not stored in a personally identifiable form after the alert cycle completes. Saved and manual locations are retained as part of your account profile until you delete them or delete your account.

AI Chat and Interaction Data. Chat prompts and AI responses are retained for safety, liability review, and quality improvement purposes. Aggregated, de-identified AI interaction data may be retained for up to 24 months for algorithm improvement.

Usage and Diagnostic Data. Retained in de-identified form for up to 24 months for App improvement purposes.

Payment Records. Retained as required by applicable tax and financial record-keeping laws.

Data Security. We implement reasonable administrative, technical, and physical safeguards to protect your personal data from unauthorized access, use, alteration, and destruction. These measures include:

Children’s Privacy. The App is intended for users aged 13 and older. We do not knowingly collect personal information from children under the age of 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will promptly delete that information.

Your Rights. Regardless of where you reside, all App users may:

“Do Not Sell or Share” and Opt-Out Signals. We do not sell personal data. We do not share personal data for cross-context behavioral advertising, affiliate marketing, sponsored content, or any commercial purpose beyond what is necessary to operate the App and manage your subscription. Because we do not sell or share personal data in these ways, there is no need to opt out of such practices.

State-Specific Privacy Rights. The following supplemental disclosures apply to residents of states with comprehensive consumer data privacy laws. These rights apply in addition to the general rights described in Section 10. If you are a resident of a listed state and the applicable law’s jurisdictional thresholds are met, you may exercise the rights described below.

Kentucky (KCDPA, KRS 367.3571 et seq., effective January 1, 2026). Kentucky residents have the right to: confirm whether we are processing their personal data; access their personal data; correct inaccuracies; delete personal data; obtain a portable copy of personal data; and opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Precise geolocation data is sensitive data under the KCDPA and requires opt-in consent before processing. The KCDPA provides a permanent 30-day cure period for alleged violations. Enforcement is through the Kentucky Attorney General. There is no private right of action under the KCDPA. To exercise your rights: email [email protected]. We will verify your identity and respond within 45 days. If we decline a request, you have the right to appeal, and we will provide instructions for doing so.

Tennessee (TIPA, Tenn. Code Ann. § 47-18-3301 et seq., effective July 1, 2025). Tennessee residents have substantially similar rights to those described for Kentucky residents above, including the right to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. Precise geolocation is sensitive data under TIPA and requires opt-in consent. Tennessee provides a 60-day cure period. Enforcement is through the Tennessee Attorney General. There is no private right of action.

Indiana (INCDPA, IC 24-15, effective January 1, 2026). Indiana residents have the right to confirm, access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale, and certain profiling. Indiana provides a 30-day cure period. Enforcement is through the Indiana Attorney General.

Other States. If you reside in a state with a comprehensive consumer data privacy law not listed above (including but not limited to Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Utah, or Rhode Island), you may have similar rights under your state’s law. Contact us at [email protected], identify your state of residence, and we will process your request in accordance with applicable law.

Artificial Intelligence Disclosure. The App uses artificial intelligence and machine learning in the following ways:

Severe Weather Prediction Algorithms. AI/ML pattern recognition algorithms process publicly available meteorological data (radar, satellite, surface observations, model data) to predict the path, intensity, and timing of severe weather events at neighborhood-level granularity.

Personalized Alert Generation. The predictions generated by our algorithms are matched against your precise location and shelter profile to determine your specific risk level and generate tailored alerts and guidance.

AI Chat and Summaries (Opt-In, 18+ Only). An AI-powered conversational interface answers weather-related questions, and AI-generated daily and alert summaries are available as optional features. These features are powered by Google Gemini. When you use these features, your chat prompts, location context, and profile preferences are transmitted to Google Gemini. You must affirmatively opt in and attest that you are 18 or older before these features are enabled. You may withdraw your AI consent at any time through the App’s Settings, and doing so will disable AI features without affecting your access to core App functionality.

AI Data Practices. We retain AI chat prompts and responses for safety, liability review, and quality improvement purposes. We do not use your personal data to train general-purpose AI models. Any AI training performed on user interaction data uses aggregated, de-identified datasets only.

Third-Party Services and Links. The App may contain links to third-party websites or services, including the National Weather Service, local emergency management agencies, and storm shelter directories. This Privacy Policy does not apply to third-party services, and we encourage you to review their privacy policies before providing them with your information. Our third-party service providers used in App operations are identified in Section 6.5.

Data Storage and Transfers. Your personal data is stored and processed using Supabase, which operates on cloud infrastructure located in the United States. If you access the App from outside the United States, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction.

Data Breach Notification. In the event of a data breach involving your personal information, we will notify you and applicable regulatory authorities in accordance with the breach notification laws of your state of residence. Kentucky’s breach notification statute (KRS 365.732) requires notification without unreasonable delay. We will provide the notifications required by law, including a description of the breach, the types of information involved, and steps you can take to protect yourself.

Changes to This Privacy Policy. We may update this Privacy Policy from time to time. When we make material changes, we will:

Contact Us. If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a complaint about our data practices, please contact us:

Governing Law. This Privacy Policy is governed by the laws of the Commonwealth of Kentucky, without regard to conflict-of-laws principles, except to the extent preempted by applicable federal law. Nothing in this Privacy Policy limits your rights under the consumer data privacy law of your state of residence.

Apple App Store Supplement. This section provides additional disclosures required by Apple’s App Store Review Guidelines (Section 5.1.1):

Data Collected. Contact Info (email address); Location (precise GPS location, saved and manual locations); User Content (AI chat prompts and responses, shelter/crisis profile answers, feedback and reports); Purchases (subscription entitlement state, in-app purchase data processed by Apple and RevenueCat); Identifiers (Supabase user ID, device identifiers, Expo push token, PostHog analytics identifier); Usage Data (feature interactions, screen events, app-flow events, weather and radar requests); Diagnostics (crash reports, error events, performance data via Sentry).

Data Linked to You. Precise Location, Name, Email Address, Supabase User ID, shelter and crisis profile preferences, AI chat history (when AI features are enabled), and subscription status.

Data Used to Track You. None. We do not track you across apps or websites owned by other companies for advertising, advertising measurement, affiliate marketing, or any other commercial purpose. No App Tracking Transparency prompt is presented because no cross-app tracking occurs.

Data Not Collected. We do not collect browsing history, search history, contacts, photos, health data, financial account information (beyond what Apple and RevenueCat process for in-app purchases), or any data from other apps on your device.