Privacy Policy

Effective date: 23 July 2026

This policy explains what personal data the Meltema service at meltema.com processes, why, for how long, and what rights you have. The controller is Meltema LLC — contact: hello@meltema.com.

Short version: the map and most of the API work without an account or analytics cookies. We count pseudonymous active devices and API requests on our own server so we can understand traffic and operate the product. If you sign in, we store the minimum needed to run your account. We run no advertising or third-party analytics, and we do not sell data.

1. What we process, why, and for how long

Data	Purpose · legal basis (GDPR)	Retention
Server logs: IP address, user agent, requested URL, timestamp, status	Operating and securing the Service, rate limiting, abuse prevention, debugging · legitimate interest (Art. 6(1)(f))	~30 days, then deleted with log rotation
Account: e-mail address and display name from Google Sign-In	Providing your account, key management · contract (Art. 6(1)(b))	Until account deletion
API keys (stored only as SHA-256 hashes; the plaintext is shown once at creation and never stored)	Authenticating API requests · contract	Until you revoke/delete them
Usage records: secret-keyed pseudonymous device hash derived from IP address + user agent, coarse client type (browser/API client/bot), country code resolved locally from the IP address, key/organisation id when present, endpoint class, timestamp, response status (no raw IP or user agent in this table, no request payloads, no city or coordinates)	Counting daily active devices, understanding product traffic, quota enforcement, service statistics, future billing · contract and legitimate interest	Aggregated or deleted within 24 months
Session cookie (signed, first-party)	Keeping you signed in · contract. Strictly necessary — no consent banner required; we set no advertising or analytics cookies	Expires after at most 30 days (14-day rolling)
Launch-notification e-mail addresses (pre-launch signup form)	One-off launch announcement · consent (Art. 6(1)(a)), withdrawable any time	Deleted after the announcement or on request

2. Third parties that receive data

Google Sign-In (Google Ireland Ltd.) — when you sign in, Google processes your login per its own privacy policy. We receive only your e-mail and display name.
Hosting — the Service runs on servers operated by Hetzner Online GmbH in the EU (Germany/Finland). Object storage for weather data is likewise EU-hosted.
Basemap tiles — the map page loads basemap tiles from the OpenFreeMap public instance (tiles.openfreemap.org). Your browser contacts that host directly, disclosing your IP address and user agent to it, subject to the OpenFreeMap privacy policy. Web fonts are bundled with the site and served from our own servers — your browser contacts no font CDN. The legal pages you are reading load no third-party resources.

We do not transfer personal data outside the EU/EEA ourselves; CDN requests made by your browser may terminate outside the EEA, protected by the providers' standard contractual clauses.

3. What we do NOT do

No advertising, no ad-tech, no cross-site tracking.
No third-party analytics scripts.
No third-party geolocation calls: map centering (/v1/locate) resolves your IP address to a coarse location using a local copy of the free DB-IP City Lite database on our own server; your IP address is never sent to a geolocation provider.
No analytics cookies or browser fingerprinting scripts; traffic statistics are produced server-side from normal requests.
No sale or brokering of personal data.
Weather queries (the coordinates you click) are served from cache infrastructure and are not linked to your account in usage records.

4. Your rights

Under the GDPR you can request access to, rectification, or erasure of your personal data; restriction of or objection to processing; and data portability. Where processing is based on consent, you may withdraw it at any time. Write to hello@meltema.com — we answer within one month. You may also lodge a complaint with your local supervisory authority.

5. Security

All traffic is TLS-encrypted. API keys are stored only as SHA-256 hashes; sessions are signed server-side; production access is limited to the operator. No method of transmission or storage is 100% secure, but we follow current good practice.

6. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

7. Changes

We will post any changes to this policy here with a new effective date; material changes affecting account holders will also be announced by e-mail where required.