Windy Tracker
Sign in

Privacy Policy

Last updated: February 2026

Windy Tracker (“we”, “our”, “us”) is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

When you use Windy Tracker, we collect the following types of data:

Account Data

  • Email address — used to identify your account, send transactional emails, and authenticate you
  • Password hash — stored as a cryptographic hash (never in plain text) for password-based sign-in
  • Account creation date and last sign-in timestamp

Route Data

  • Uploaded route files — the .rtz or other route format files you upload; stored in a private Cloudflare R2 bucket accessible only to our server
  • Converted JSON output — the processed route data stored in a public Cloudflare R2 bucket and accessible via your route code
  • Route metadata — file name, upload timestamp, short route code, optional display name

Billing Data

  • Credit balance — number of conversion credits remaining in your account
  • Purchase history — records of credit batch purchases (amount, date, Stripe transaction reference)

We do not store your payment card details. All payment data is handled exclusively by Stripe.

Usage Data

  • Server logs — standard web server logs including IP address, request path, and HTTP status codes, retained for operational security

2. How We Use Your Data

Purpose Data Used
Authentication Email, password hash, session tokens
Route conversion Uploaded route files
Route visualization Converted JSON (served via route code)
Billing Email (for Stripe), credit balance, purchase history
Transactional email Email address (password reset, magic link)
Abuse prevention Server logs, IP address

We do not use your data for advertising, profiling, or sale to third parties.

3. Storage Providers

Your data is stored with the following providers:

  • Neon — our PostgreSQL database provider. Stores account data, route metadata, and credit balances. Neon Privacy Policy
  • Cloudflare R2 — file storage. Private bucket for original route files; public bucket for converted JSON. Cloudflare Privacy Policy

4. Third-Party Services

We share limited data with the following third parties to operate the Service:

Stripe

Payment processing. When you purchase credits, your payment information is collected and stored by Stripe. We receive only a confirmation of payment and a transaction reference. We pass your email address and credit amount to Stripe as session metadata to fulfill your order. Stripe Privacy Policy

Resend

Transactional email delivery (password reset links, magic sign-in links). We share your email address with Resend only to deliver emails you have requested. Resend Privacy Policy

We have no advertising partners and do not share your data with analytics platforms, social networks, or data brokers.

5. Cookies and Local Storage

Windy Tracker uses minimal browser storage:

  • Session cookie — set by our authentication system (Better Auth) to maintain your signed-in session. This is a secure, HTTP-only cookie. It expires when you sign out or after a period of inactivity.
  • localStorage: theme — stores your light/dark mode preference. No personal data.
  • localStorage: locale — stores your language preference (English or French). No personal data.

We do not use tracking cookies, advertising cookies, or analytics cookies.

6. Data Retention

Data Retention Period
Route files (private bucket) Until you delete the route or your account
Converted JSON (public bucket) Until you delete the route or your account
Account data Until you delete your account (within 30 days of deletion)
Server logs 90 days
Billing records 7 years (legal obligation for financial records)

7. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Correction — request correction of inaccurate personal data
  • Deletion — delete your account and associated data at any time from your account settings; we will process deletion within 30 days
  • Data portability — request your route data in JSON format

To exercise any of these rights, contact us at privacy@windytracker.com. We will respond within 30 days.

8. Data Security

We take reasonable technical and organizational measures to protect your data:

  • Passwords are stored as cryptographic hashes (never in plain text)
  • Route files are stored in a private bucket not accessible via public URL
  • All data transmission uses HTTPS/TLS encryption
  • Database access is restricted to the application server

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately.

9. Children’s Privacy

Windy Tracker is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us and we will delete the account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions, requests, or concerns:

Email: privacy@windytracker.com

We aim to respond to all privacy inquiries within 30 days.