Privacy Policy
Last updated: 13 June 2026
1. Who we are
Meteobreeze is operated by Without Limits Digital Ltd, a company registered in England and Wales (Companies House number 14197830). We are the data controller for personal data processed through this service.
To contact us about privacy matters, email [email protected].
2. Scope of this policy
This policy covers personal data collected when you visit meteobreeze.com (the "Site"), create an account, connect a weather station, join the waitlist, or otherwise interact with the Meteobreeze service.
3. Information we collect
Account data
When you create an account: name, email address, hashed password, and the date you registered.
Session data
Session tokens, your IP address at sign-in, and the User-Agent string of your browser. These are stored by Better Auth, the authentication library we use, and are retained for 30 days.
Station and weather data
Station name, location (latitude/longitude), timezone, and weather readings pushed from your devices. Weather readings are not personal data in most cases, but station location can indirectly identify you.
Notification logs
When we send email alerts, we log the fact of delivery (timestamp, alert type, recipient address). Logs are retained for 90 days.
Waitlist sign-ups
If you join our waitlist, we store your email address, an anonymised hash of your IP address (for rate-limiting only — the raw IP is never stored), and the date of sign-up. Waitlist data is retained for 2 years or until you ask us to remove it.
Technical and error data
We use Sentry for error monitoring. Sentry receives a pseudonymous user ID (a database-generated identifier, not your email) so we can correlate errors with accounts. Sentry's automatic PII collection (IP addresses, email addresses) is disabled.
4. How we collect it
- Directly from you when you register, configure a station, or join the waitlist.
- Automatically when your station software pushes data to our API.
- Automatically by our infrastructure (server logs, Sentry error events).
- Via Cloudflare Turnstile (invisible mode) when you submit the waitlist form for bot detection. Turnstile may collect device and signal data as described in the Cloudflare Turnstile Privacy Addendum.
5. How we use your data
| Purpose | Data used |
|---|---|
| Provide the service | Account, session, station and weather data |
| Send alert emails | Email address, notification log |
| Diagnose errors | Pseudonymous user ID, error events (Sentry) |
| Prevent abuse | IP hash (rate limiting on waitlist) |
| Send waitlist confirmation | Email address |
| Display maps | Station lat/lon passed to Mapbox |
6. Lawful bases (UK GDPR)
- Contract — processing necessary to provide the service you've signed up for (account, station data, alerts).
- Legitimate interests — error monitoring with pseudonymous identifiers, server security logging.
- Consent — waitlist sign-up (you explicitly provide your email for that purpose).
7. Cookies
We set a session cookie to keep you logged in. No third-party advertising cookies are used. Cloudflare may set a security cookie (__cf_bm) as part of bot protection.
8. Analytics
We do not currently use a third-party analytics service. Server access logs (request path, timestamp, response code) are retained for operational purposes only and are not shared.
9. Third-party processors
| Processor | Purpose | Data shared |
|---|---|---|
| Resend | Transactional email | Email address, email content |
| Sentry | Error monitoring | Pseudonymous user ID, stack traces |
| Mapbox | Map tiles | Station lat/lon in tile requests |
| Cloudflare | DDoS protection, DNS, Turnstile | IP address, request metadata |
10. International transfers
Our servers are located in the United Kingdom. Some processors transfer data to the United States:
- Sentry — transfers to the US under Standard Contractual Clauses (SCCs).
- Mapbox — transfers to the US under Standard Contractual Clauses.
- Resend — transfers to the US under UK Standard Contractual Clauses and the UK Addendum.
- Cloudflare — global edge network; transfers made under UK Standard Contractual Clauses and the UK Addendum.
11. Data retention
| Data type | Retention period |
|---|---|
| Account and station data | Until account deletion |
| Session data | 30 days |
| Notification logs | 90 days |
| Waitlist sign-ups | 2 years |
| Server access logs | 90 days |
12. Security
We use HTTPS for all connections. Passwords are hashed before storage. Session tokens are rotated. Error monitoring is configured with PII auto-capture disabled. No credit card data is processed or stored by us.
13. Your rights
Under UK GDPR you have the right to access, rectify, erase, or restrict processing of your personal data. You also have the right to data portability and to object to processing based on legitimate interests.
To exercise any of these rights, email us at [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
14. Children's privacy
Meteobreeze is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. Material changes will be indicated by an updated "Last updated" date at the top of this page. We will notify registered users of significant changes by email where required by law.