Privacy Policy

1. What We Collect

Information You Provide

• Display name — shown on leaderboards, player profiles, and head-to-head challenges. You choose it during onboarding and can change it in Settings. Your real name is never required.
• Email address — used for sign-in and account recovery. If you sign in with Apple’s “Hide My Email,” we only see the relay address Apple provides. If you sign in with Google, we receive the email address associated with your Google account. We do not send marketing emails. If we add marketing emails in the future, we will only send them with your consent, and you may opt out at any time.
• Location (city, state, and precise coordinates) — used to fetch weather data from the National Weather Service for your area, deliver county-level predictions, match you to severe weather events in your area, and place you on city- and state-level leaderboards. We do not store street addresses or real-time GPS traces. Precise location is requested only when necessary for gameplay functionality.
• Mode selection — your chosen difficulty level (Casual, Standard, or Expert). Displayed on your public profile and leaderboard entry.

Information Generated as You Play

• Prediction history — your daily morning and evening forecasts, adjustment-window refinements, Storm Mode predictions (Storm Prediction Center, National Hurricane Center, and Weather Prediction Center across Day 1–3 tiers), scores, and Forecast Accuracy Rating averages.
• Streak data — consecutive calendar days with qualifying predictions, tracked separately for Day, Night, and Precision categories.
• Achievements and badges — milestone unlocks and the dates they were earned.
• Head-to-head challenges — which players you’ve challenged, each window’s predictions, results, win/loss history, and H2H streaks.
• Games tab sessions — scores and personal bests for mini-games.
• In-app preferences — accessibility settings, notification preferences, leaderboard visibility toggles.

Purchase Information

• Subscription status — whether you hold a Premium subscription ($2.99/month or $19.99/year) and which optional weather centers you’ve unlocked ($4.99 each). We also record Streak Freeze purchases (pricing as displayed in the App).
• Payment details — all payment processing is handled by Apple through the App Store or by Google through Google Play, and managed on our side by RevenueCat. We never see, store, or have access to your credit card number, billing address, or payment credentials.

Technical and Diagnostic Information

• Crash reports (via Sentry) — stack traces, device model, OS version, and the app version where a crash occurred. Used exclusively to diagnose and fix bugs.
• Product analytics (via PostHog) — anonymous event metrics. No personally identifiable information is included. You can opt out in Settings.
• Push notification tokens (via OneSignal) — stored only if you grant notification permission. Used to deliver prediction-window reminders, Storm Mode alerts, and challenge notifications.

Information We Do NOT Collect

• Continuous GPS tracking or location history (we collect your location once at setup and when you update it in Settings; we do not track your movements)
• Contacts, photos, microphone, or camera access
• Advertising identifiers (IDFA) or cross-app tracking data. Version 1.0 of the App does not include advertisements. When ads are introduced in a future version, they will be served by Google AdMob in non-personalized mode only. AdMob may process IP addresses and device identifiers for ad delivery, frequency capping, and fraud prevention, but will not collect IDFA, request App Tracking Transparency authorization, or serve behaviorally targeted ads.
• Browsing history outside the App
• Biometric data or health information

2. Why We Collect It

Purpose	Data Used
Run the forecasting game	Prediction history, location, display name, mode
Compute leaderboards and rankings	Display name, FAR score, location, mode, streak data
Score Storm Mode predictions	Storm Mode submissions, NWS verification data, tier access
Operate head-to-head challenges	H2H predictions, opponent pairing, results
Deliver push notifications	OneSignal token, display name, prediction-window timing
Process purchases and subscriptions	App Store / Google Play receipts via RevenueCat
Fix bugs and improve the app	Crash reports, anonymous analytics
Prevent cheating and ensure fair play	Server-side score validation, prediction timestamps
Respond to support requests	Email address (only if you contact us)
Comply with legal obligations	Any of the above as required by law

3. Where Your Data Is Stored

• Game data (predictions, scores, badges, streaks, profiles, H2H records, leaderboard rankings): stored in our Supabase database, hosted on AWS infrastructure in the United States. Encrypted at rest and in transit.
• Authentication (email, OAuth tokens): managed by Supabase Auth. Passwords are hashed using industry-standard algorithms and are never visible to us in plaintext.
• Leaderboard cache: computed every 15 minutes by a server-side function. Contains only display names, scores, ranks, and location scopes — no private data.
• On your device: a subset of your game data is cached locally so the app works during brief connectivity gaps. This cache is cleared when you delete the App.

4. Who We Share Data With

We do not sell your personal information. We do not share your data with advertisers for behavioral targeting or cross-context advertising. We share data only with the following service providers, and only as needed to operate the App:

Provider	Purpose	Data Shared
Supabase	Database, authentication, Edge Functions	All game data, email, hashed credentials
Apple App Store / Google Play	Payment processing	Purchase receipts (platform-managed)
RevenueCat	Subscription management	Anonymous user ID, entitlement status
OneSignal	Push notification delivery	Push token, display name
Sentry	Crash diagnostics	Crash stack traces, device model, OS/app version
PostHog	Anonymous product analytics	Session events (no PII)
Google (AdMob)	Non-personalized ad delivery (planned for future version)	IP address, device identifiers (for frequency capping and fraud prevention only)

Weather data sources — The App fetches forecast and observation data from public services including the National Weather Service API, CoCoRaHS, CWOP, and NOAA MRMS. These are one-way data fetches; we send only location coordinates and receive weather data in return. No user identifiers or account information are transmitted.

We may also disclose information if required by law, court order, or to protect the safety of our users.

5. Your Rights

You have the right to:

• Access your data — visible on your in-app Profile and activity history.
• Correct your display name, mode, and prediction location — available in Settings at any time.
• Delete your account and all associated data — Settings → Account → Delete Account. Deletion is immediate and irreversible.
• Opt out of analytics — Settings → Privacy → Disable Analytics.
• Opt out of push notifications — via device Settings or in-app notification preferences.

For California Residents

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

Categories of personal information we collect. Identifiers (email address, display name, user ID); geolocation data (precise coordinates); internet or electronic network activity information (usage data, prediction history, in-app preferences); commercial information (purchase and subscription history); and inferences drawn from gameplay data (Forecast Accuracy Rating, leaderboard rankings).

Sources. Directly from you (account creation, gameplay, in-app purchases); automatically from the App (usage data, diagnostics, analytics); and from third-party authentication providers (Apple Sign In, Google Sign-In).

Business purposes. Operating the game, computing leaderboards and rankings, processing purchases, delivering push notifications, fixing bugs, preventing cheating, and responding to support requests.

Third parties receiving personal information. The service providers listed in Section 4 above. We do not sell personal information. When ads are introduced in a future version, they will be served by Google AdMob in non-personalized mode. Non-personalized ad delivery does not constitute “sharing” of personal information for cross-context behavioral advertising under the CPRA. AdMob may process IP addresses and device identifiers solely for ad delivery, frequency capping, and fraud prevention.

Your California rights:

• Right to know what personal information we collect, use, and disclose.
• Right to delete your personal information.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA.
• Right to limit the use of sensitive personal information. Precise geolocation is classified as sensitive personal information under the CPRA. We use precise geolocation only for gameplay functionality (weather data retrieval, county-level predictions, and leaderboard placement) and do not use it for purposes beyond what is necessary to provide the App.
• Right to non-discrimination for exercising any of these rights.

How to exercise your rights. Email privacy@rivalwx.app with your request. We will verify your identity by confirming the email address associated with your account. You may also designate an authorized agent to submit a request on your behalf; we may require proof of authorization.

We will respond to verified requests within 45 calendar days. If we need additional time, we will notify you of the extension and the reason.

Users under 16. We do not sell or share the personal information of users we know to be under 16 years of age. If we change this practice in the future, we will obtain opt-in consent from users between 13 and 15 (or parental consent for users under 13, though users under 13 are not permitted to create accounts).

For Indiana Residents

If you are an Indiana resident, you have the following rights under the Indiana Consumer Data Protection Act (ICDPA), effective January 1, 2026:

• Right to confirm whether we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to delete your personal data.
• Right to data portability — obtain a copy of your personal data in a readily usable format.
• Right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data or engage in profiling of this nature.

How to exercise your rights. Email privacy@rivalwx.app. We will respond within 45 calendar days. If we decline a request, you may appeal by replying to our response; we will review the appeal and respond within 60 calendar days, including information on how to contact the Indiana Attorney General if you disagree with our decision.

For Users Ages 13–17

If you are a minor (ages 13–17), you have the right to request removal of content or information you have publicly posted in the App (such as your display name on leaderboards). To make this request, email privacy@rivalwx.app.

6. Children

RivalWx is designed for users ages 13 and older. The App is not directed to children under 13 within the meaning of the Children’s Online Privacy Protection Act (COPPA).

During account creation, users are required to enter their date of birth. If the date of birth indicates the user is under 13, account creation is blocked. The date of birth is checked on the device only and is immediately discarded after the check. It is never transmitted to our servers, never stored in our database, and never retained in any form. Because no personal information is collected during this age verification step, the check itself does not trigger any data collection obligations.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or provided information to us, please contact us at the address in Section 10 and we will delete the account and all associated data promptly.

7. Security

We use reasonable technical and organizational measures to protect your data, including:

• HTTPS/TLS encryption for all network traffic between the App and our servers
• Row-level security policies in our database, restricting each user to their own records
• Column-level access controls ensuring email addresses and private data are never readable by other users
• Server-side score validation — prediction scores are computed by Edge Functions, not by the client app
• Dependency scanning and security audits of third-party libraries
• Authentication via Apple Sign In and Google Sign-In

No system is 100% secure. In the event of a confirmed data breach affecting your personal information, we will notify you as soon as practicable and within the timeframes required by applicable law.

8. Data Retention

• Active accounts: your data is retained as long as your account is active.
• Deleted accounts: all personal data is deleted immediately upon account deletion. Anonymized, aggregated statistics may be retained indefinitely — these cannot be tied back to any individual.
• Crash reports: retained for up to 90 days, then purged.
• Analytics events: retained for up to 90 days, then purged.
• Leaderboard cache: refreshed every 15 minutes; historical snapshots are not retained.

9. Changes to This Policy

We may update this policy as the App evolves. Material changes will be communicated through an in-app notice at least 14 days before they take effect. Continued use of RivalWx after changes take effect constitutes acceptance of the updated policy.

10. Contact

Email: privacy@rivalwx.app

Mailing address: Isobar Works LLC, 5534 Saint Joe Rd, Fort Wayne, IN 46835

We aim to respond to all legitimate requests within 30 days.