Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Icarus, Inc., the developer and operator of Hail Sentinel ("Company," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use any of our services, including:

• The Hail Sentinel marketing website at hailsentinel.com (the "Website")
• The Hail Sentinel mobile application for iOS and Android (the "App")
• The Hail Sentinel Business Console web platform (the "Console")

Collectively, these are referred to as the "Services." By accessing or using any of the Services, you acknowledge that you have read and understood this Policy.

2. Scope and Operator

The Services are designed for, and available only in, the contiguous United States. The business responsible for your personal information is:

3. Information We Collect

3.1 Information You Provide Directly

Across all Services, we may collect information you provide directly:

• Account Information: Email address, name, and password (stored as a salted hash) when you create an account.
• Profile Information: Any additional information you choose to add to your profile.
• Communication Data: Content of messages you send us through contact forms, email, support channels, or surveys.
• Payment Information: Billing details processed through secure third-party payment processors — we do not directly store payment card details.

3.2 Website Data

When you visit our Website, we collect contact information (name, email, phone) when you submit forms or subscribe to our newsletter; device and browser information (IP address, browser type, OS, device type, screen resolution); and usage information (pages visited, time on page, referrer, click patterns). We use Google Analytics 4 and Microsoft Clarity for first-party analytics — see Section 6. We do not run advertising or retargeting pixels on the Website.

3.3 Mobile App Data

When you use the Hail Sentinel App, we collect the following data. This section is provided to comply with Apple App Store and Google Play data disclosure requirements.

3.3.1 Location Data

• Foreground Location: Your device's precise geographic location when the App is open and in use. This is processed to generate forecasts and alerts and is not stored.
• Saved Locations: When you save a location for weather monitoring, we store its precise coordinates and the street address you entered on our servers, so we can generate forecasts and alerts for that location. Saved locations are retained for as long as your account is active and are deleted when you delete your account.
• Background Location ("Follow Me" Mode): With your explicit permission, the App may track your precise location even when closed, so we can target alerts to where you actually are. We store only your most recent position on our servers to do this — we do not keep a server-side history of where you have been. Turning Follow Me off clears the stored position, and it is automatically erased after a few hours if it stops being updated. When an alert is actually sent to you we keep a record of that delivery so we can measure how accurate our alerts are; those records identify you only by a one-way code, place you no more precisely than about 10 miles, and are deleted after around a year. Separately, the App keeps a short activity log of arrival and departure events (place names and timestamps) so you can see your own recent movement; this log is stored only on your device, is never uploaded to our servers, and is automatically capped at 45 days. You can enable or disable Follow Me at any time in App settings or device location permissions.

Precise geolocation — including saved-location addresses and your Follow Me position — is treated as sensitive personal information under the California Consumer Privacy Act and as sensitive data under other state privacy laws. We use it only to deliver the Services you signed up for (alerts, forecasts, historical analysis) and never for advertising, marketing, profiling, or sale.

3.3.2 Device Information

Device type, model, and manufacturer; operating system and version; app-scoped device identifiers (push notification token, vendor identifier); mobile network information; time zone and language settings; App version.

We do not use your device's advertising identifier (IDFA on iOS, Advertising ID on Android). The App does not build an advertising profile of you, does not target ads at you, and does not follow what you do in other companies' apps and websites.

3.3.3 Usage and Notification Data

App features accessed and actions taken; frequency and duration of usage; crash reports and performance data; push notification interactions and tokens; your promotional-message choices (see Section 4.5); search queries within the App.

3.3.4 Hail Reports, Notes, and Alert Feedback

If you submit a hail report, you provide the hail size, an optional no-hail flag (if you're reporting that hail did not occur), and any notes you choose to add — we do not collect or store photos with hail reports. Any notes you type into a hail report, along with feedback you give us on alerts, are stored and may be used — always in de-identified form — to improve our hail-detection models.

3.3.5 Phone Number

If you opt in to SMS alerts, we collect and verify your phone number so we can deliver alert text messages. See Section 5.1 for the vendor that sends these messages on our behalf. We never use your phone number to send promotional text messages.

3.3.6 Biometric App Lock

If you enable the optional Face ID, Touch ID, or fingerprint app lock, all biometric matching happens on-device through your phone's operating system. We never receive, see, or store any biometric data.

3.3.7 Third-Party Data

If you sign in using Google, Apple, or other third-party authentication, we receive basic profile information as permitted by those services. RevenueCat provides subscription status, purchase history, and entitlement information. In-app purchases are processed through Apple App Store or Google Play Store.

3.4 Business Console Data

3.4.1 Account & Organization Information

Administrator details (name, email, phone, job title); organization information (company name, address, industry, size, billing); team member data (names, emails, roles).

3.4.2 Location & Asset Data

Monitored locations (addresses, coordinates, property details); asset information (optional vehicle fleets, equipment, property values); custom geographic zones and alert boundaries.

3.4.3 Usage & Technical Data

Console activity (features, reports, alerts, actions); API usage (calls, endpoints, parameters); device information (browser, OS, IP); access logs, error logs, and security audit trails.

3.4.4 Integration Data

Data exchanged with connected third-party services (CRM, ERP, fleet management); webhook transmissions; SSO/SAML authentication tokens and user attributes.

3.4.5 Damage Assessment Photos

If your organization uses the damage assessment feature, photos you upload are processed by Google's Gemini models via Vertex AI to generate the assessment. Uploaded photos are processed transiently for that request and are not retained by us. AI-annotated result images and saved assessment results are stored with your organization's account data and retained per the Business Account Data period in Section 7. Do not upload photos containing identifiable people; the feature is intended for property and asset damage.

3.5 Categories of Personal Information Collected (CCPA/CPRA Notice at Collection)

In the preceding 12 months, we have collected the following statutory categories of personal information, from the sources and for the purposes described in this Policy:

Category	Examples	Sold or Shared?
Identifiers	Name, email, phone, account ID, IP address, device ID	No
Customer Records	Billing address, payment information (handled by processors)	No
Commercial Information	Subscription tier, purchase history, entitlement state	No
Internet Activity	Pages visited, click patterns, session duration, referrer; promotional email delivery and engagement	No
Geolocation Data	Precise device location (App, with permission); coarse IP-based location (Website)	No
Sensory Data	Microsoft Clarity heatmap and session recording metadata (no audio, no video, form fields auto-redacted)	No
Professional Information	Company, job title, role (Console only)	No
Inferences	Risk profiles, preferred locations, alert thresholds	No
Sensitive PI	Precise geolocation (used only to deliver Services, never for advertising or marketing)	No

4. How We Use Your Information

4.1 Core Service Delivery

Providing weather forecasts, hail predictions, and storm alerts; sending push notifications (App); enabling "Follow Me" mode (App); generating reports and analytics (Console); managing your account and preferences; processing subscriptions; processing API requests (Console).

4.2 Service Improvement

Analyzing usage to improve features; improving forecast accuracy and alert timing; debugging technical issues; research and development; measuring marketing effectiveness (Website and promotional messages).

4.3 Communications

Responding to support requests; service announcements and updates; promotional emails and, if you opt in, promotional push notifications (see Section 4.5); subscription status notifications; maintenance notices (Console).

4.4 Legal, Security & Compliance

Complying with legal obligations; protecting against fraud and unauthorized access; enforcing our Terms of Service; maintaining audit trails (Console).

4.5 Promotional Communications

We may occasionally send you promotional messages about Hail Sentinel — for example, a heads-up that hail season is starting, news about new features, or an offer on a subscription. How this works depends on the channel:

• Email — on unless you unsubscribe. If your account has an email address, we may send promotional emails to it. They come from news@mail.hailsentinel.com and identify Hail Sentinel as the sender. Every promotional email has an unsubscribe link that works in one step. You can also turn off Seasonal news & offers in the App under Account → Privacy & Data → Emails & promotions, or email privacy@hailsentinel.com. We act on opt-outs promptly, and always within 10 business days.
• Push notifications — off unless you opt in. We send promotional push notifications only if you turn them on in the App after seeing a consent screen. You can turn them off at any time in the same place, or in your device's notification settings.
• Text messages — never. We do not send promotional text messages. Your phone number is used only for the SMS alerts you opt in to.

What we use. To send promotional messages we use your email address (for email), your App's push notification token (for push), your subscription status (free or Premium — for example, so we don't send a Premium offer to someone who already has Premium), and your promotional-message choices. We do not use your precise location, saved locations or addresses, alert history, or any other sensitive personal information to decide who receives a promotion or what it says. We do not personalize promotions with your name, and we do not share your information with anyone for their own marketing.

What unsubscribing doesn't change. Opting out of promotional messages never affects your hail alerts. We will still send messages about your account, security, purchases, and changes to our Terms or this Policy.

Delivery and measurement. Promotional emails are delivered by Twilio SendGrid, and promotional push notifications by Firebase Cloud Messaging (see Section 5.1). Our email provider may record whether a message was delivered, bounced, or opened, or whether a link in it was clicked, using standard techniques such as a small image in the email and link redirects. We use this only to measure and improve our own emails, and to stop emailing addresses that bounce or report spam.

Keeping your opt-out. When you unsubscribe from promotional email or report one as spam, we keep a one-way hashed copy of that email address and the date, so that we keep honoring your choice — including if you later delete your account. We use this record only to stop promotional email.

Offers. A promotional message that makes an offer states its material terms. For subscriptions, that includes the price and that the subscription renews automatically until you cancel.

Age. We do not knowingly send promotional messages to anyone under 18.

Timing. We will not send promotional email under this section until at least 30 days after this section was first published.

5. Information Sharing and Disclosure

5.1 Service Providers

We share data with trusted third-party service providers under contracts that bind them to use the data only on our behalf:

• Firebase (Google): Authentication, database (Firestore), push notifications (FCM) — including promotional notifications you opt in to, analytics, crash reporting (Crashlytics), performance monitoring (Performance Monitoring), App Check
• RevenueCat: Subscription management and in-app purchase processing (App)
• Apple & Google: In-app purchase payment processing (App)
• Twilio: SMS alert delivery (App) — receives your phone number and the content of alert messages
• SendGrid (Twilio): Email delivery — alert, account, and promotional emails (App, Website, Console) — receives your email address, message content, and an internal account identifier
• Stripe: Payment processing and billing (Console)
• Google Cloud Platform: Data hosting and processing, including Vertex AI (Gemini) for damage-assessment photo processing (Console)
• Google Analytics 4: First-party website analytics, configured with Google Signals and ad personalization disabled (opt out)
• Microsoft Clarity: First-party heatmaps and session recordings, with form input fields auto-redacted. Does not run unless you explicitly turn it on (opt in)

A complete current list, including data categories and certifications, is maintained on our Subprocessor List.

5.2 Your Integrations

When you configure integrations, data may be shared with third-party services you connect (CRM, ERP, fleet management), webhook endpoints you configure, and your identity provider for SSO/SAML authentication.

5.3 Other Disclosures

We may share anonymized or aggregated location data with weather data partners. We may disclose your information to comply with legal process, protect rights and safety, enforce our Terms, or in connection with a merger or acquisition (with notice).

6. Cookies and Tracking Technologies

Cookies are small text files stored on your device when you visit a website. The Hail Sentinel mobile app does not use browser cookies. The Website uses two categories of cookies:

Category	Purpose	Examples
Strictly Necessary	Required for the Website to function (e.g., remembering your light/dark theme preference, session continuity).	localStorage keys (hs-theme, hs-analytics-optout, hs-clarity-optin)
Analytics	First-party analytics that help us understand how visitors interact with the Website. We do not use these cookies for advertising.	Google Analytics 4 cookies (_ga, _ga_*); Microsoft Clarity cookies (_clck, _clsk)

You can manage analytics on this Website at any time through our Your Privacy Choices page, by enabling Global Privacy Control in your browser, or by using your browser's cookie controls. Blocking strictly necessary cookies may impact your experience. For measurement in promotional emails, see Section 4.5.

7. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Policy:

Data Type	Retention Period	Platform
Contact Form Submissions	Up to 2 years	Website
Newsletter Subscriptions	Until you unsubscribe	Website
Website Analytics	Up to 14 months (GA4); up to 90 days (Clarity)	Website
Foreground Location (real-time)	Processed immediately, not stored	App
Saved Locations (address + coordinates)	Active + deleted with your account	App
Follow Me Live Position	Most recent position only; cleared when Follow Me is turned off, and automatically erased after a few hours if it stops being updated. Alert-delivery records are kept about a year, identified by a one-way code and placed no more precisely than ~10 miles	App
Follow Me Activity Log (arrivals/departures)	Up to 45 days, stored on-device only — never uploaded to our servers	App
Hail Reports & Alert Feedback (analytics)	Retained indefinitely for model improvement, keyed to a one-way hashed identifier — not deleted when you delete your account, because it is de-identified and no longer tied to you	App
Account Data	Deleted immediately across our primary systems (Firestore, Cloud Storage, and Firebase Authentication) when you request account deletion — see the note below the table	App, Website
Promotional Message Choices & Consent Records	While your account is active; deleted with your account	App
Promotional Email Opt-Out Record (one-way hashed email address + date)	Kept indefinitely so we keep honoring your opt-out — not deleted when you delete your account, and used only to stop promotional email	App, Website
Business Account Data	Contract duration + 3 years	Console
Location/Asset Data	Contract duration + 1 year	Console
Usage/Analytics Data	Up to 2 years	All
API Logs	90 days (customizable for business)	Console
Transaction/Billing Records	Up to 7 years	All
Support Communications	Up to 3 years after resolution	All
Security Audit Logs	Up to 3 years	Console

Backup retention after deletion: When you delete your account, we immediately delete your data from our primary, live systems. Because we maintain encrypted disaster-recovery backups to protect all users against data loss, a copy of your data may persist in point-in-time recovery snapshots for up to 7 days and in encrypted backup archives for up to 91 days after deletion, until those backups age out on their normal rotation schedule. These backups are used solely for disaster recovery — restoring service in the event of an outage, corruption, or catastrophic data loss — and are never accessed to serve, analyze, or restore your individually deleted data for any other purpose.

Business customers may have custom retention periods. When data is no longer needed, we securely delete or anonymize it.

8. Your Privacy Rights (All U.S. Users)

Regardless of which state you live in, we extend the following rights to all U.S. users of the Services:

• Right to Know / Access: Request a copy of the personal information we have about you.
• Right to Delete: Request deletion of your personal information, subject to legal retention requirements (e.g., billing records). App users can delete their account and data directly — see Delete Your Account.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising — there is nothing to opt out of. Our Your Privacy Choices page lets you opt out of website analytics, and the App's Account → Privacy & Data controls let you turn off usage analytics.
• Right to Opt Out of Promotional Messages: Unsubscribe from promotional email or turn off promotional notifications at any time — see Section 4.5.
• Right to Limit Use of Sensitive Personal Information: We use sensitive PI (precise geolocation) only to deliver the Services you requested, and never for marketing.
• Right to Non-Discrimination: We will not deny service, charge a different price, or provide a different level of service because you exercised a privacy right.
• Right to Appeal: If we deny a privacy request, you may appeal by replying to our denial notice or contacting privacy@hailsentinel.com.

To exercise any of these rights, email privacy@hailsentinel.com or use the in-product privacy controls in the App. We will verify your identity before responding (typically by confirming control of the email on your account) and will respond within 45 days, with a possible 45-day extension where permitted. You may designate an authorized agent to submit a request on your behalf.

9. California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), grants you additional rights. We honor all CCPA/CPRA rights described in Section 8.

9.1 Categories Collected, Sources, Purposes, and Recipients

See Section 3.5 for the categories of personal information we have collected in the preceding 12 months. Sources include: directly from you, automatically from your device when you use the Services, and from service providers (e.g., authentication and payment processors). Business and commercial purposes include service delivery, security, fraud prevention, debugging, analytics, and sending you our own promotional messages (see Section 4.5). Recipients are the service providers listed in Section 5.1.

9.2 No Sale; No Sharing for Cross-Context Behavioral Advertising

We have not sold and have not shared (as those terms are defined under CCPA/CPRA) any personal information of California residents in the preceding 12 months. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

9.3 Sensitive Personal Information

The only sensitive PI we collect is precise geolocation (App). We use it only to deliver the Services you signed up for (alerts, forecasts, historical analysis) — uses that are exempt from the right to limit under CCPA §1798.121(d). We do not use sensitive PI for marketing, and we do not infer characteristics about you from it.

9.4 Shine the Light

California Civil Code §1798.83 permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

9.5 How to Exercise CCPA/CPRA Rights

Email privacy@hailsentinel.com, or use the toggle on Your Privacy Choices. We honor Global Privacy Control as a valid opt-out signal — see Section 13.

10. Other U.S. State Privacy Rights

Many states have comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Whether or not a particular state's law applies to us, we extend the rights described in Section 8 to residents of every state.

• Targeted advertising: We do not engage in targeted advertising as defined under any state privacy law, and we do not sell or share personal information for cross-context behavioral advertising. Sending you our own promotional messages is not targeted advertising, and you can opt out of it at any time — see Section 4.5.
• Sensitive data: We process precise geolocation — your device location, with your permission, and the addresses you save — only to provide the alerts and forecasts you request. We never sell it and never use it for marketing, targeted advertising, or profiling.
• Minors: We do not sell personal data or engage in targeted advertising, and we do not knowingly send promotional messages to anyone under 18.
• Profiling for legally significant decisions: We do not use your personal information for automated decision-making that produces legal or similarly significant effects.
• Universal opt-out signals: We honor Global Privacy Control as a valid opt-out request from residents of every state — see Section 13.
• Appeals: If we deny a privacy request, you may appeal by replying to our denial notice or emailing privacy@hailsentinel.com. If your appeal is denied, you may contact your state Attorney General.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Authentication: Secure authentication mechanisms, including Firebase App Check
• Access Controls: Role-based access control (RBAC) limiting access to personal data
• Infrastructure: Secure cloud infrastructure through reputable providers
• Monitoring: Regular security assessments and updates

For Business Console customers, additional measures include infrastructure built on Google Cloud's SOC 2 Type II certified platform, Google Cloud built-in security monitoring and audit logging, and comprehensive audit trails.

While we strive to protect your information, no method of transmission or storage is 100% secure. You are responsible for maintaining the security of your account credentials.

12. Children's Privacy

The Services are not directed to children under the age of 13. In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@hailsentinel.com and we will promptly delete it. We do not knowingly sell or share the personal information of consumers under 16 years of age (CCPA/CPRA), and we do not knowingly send promotional messages to anyone under 18.

13. Global Privacy Control

Hail Sentinel honors the Global Privacy Control (GPC) browser signal as a valid opt-out request, as recognized by the California Privacy Protection Agency, the Colorado Attorney General, and the Connecticut Attorney General. When your browser sends a GPC signal, we automatically disable analytics cookies on this Website on a per-browser basis — no further action is required from you.

Because the Services do not engage in cross-context behavioral advertising, "Do Not Track" browser signals do not change our behavior. You can manage your analytics preferences at Your Privacy Choices.

14. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by posting the updated Policy, sending a push notification or email for significant changes, posting notice in the App or Console, and updating the "Last Updated" date. Material changes will have a 30-day notice period before taking effect. Your continued use of the Services after changes become effective constitutes acceptance.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices: