Privacy
What we store, what we set in your browser, and who else sees any of it. Last changed 2026-09-26.
The short version
- You can read the storms, the map and the forecast without an account and without telling us anything but the fact that a browser asked for a page.
- Signing in stores your email address, because a magic link has to go somewhere.
- We do not sell anything about you, we run no advertising, and we set no advertising or cross-site tracking cookie.
- Nothing leaves the building unless somebody presses it. We send email only when a person took an action that sends it — an owner inviting a colleague, or you switching on an alert for yourself.
What we hold
| What | Why |
|---|---|
| Your email address | To send the sign-in link, and to show your colleagues who is on the crew. It is held by Supabase Auth, not in our own tables. |
| Your organisation and its crew | The name, a web address, and who belongs to it. One operator’s rows are invisible to every other operator, enforced by row-level security in the database rather than by this application. |
| Your alert rules | A hail size, optionally a base location and a radius, and how many vehicles you want underneath. A rule can only ever page the person who created it — a database constraint, not a setting. |
| Which storms your crew marked | Watching, working, worked or dismissed, so the list stops re-surfacing one you have dealt with. |
| A record of alerts we sent you | Which storms went out in which message, and when. It is what stops you being paged twice about the same storm. |
| Ordinary server logs | IP address, page, time, and the response. Kept by our host as part of running a website. |
Everything else on the site — hail footprints, ground reports, dealerships, population and vehicle counts — is public reference data about places, not about you. It is the same for every reader.
Cookies
These are all of them. None is for advertising, none tracks you across other sites, and none is shared with anybody. No consent banner is required for cookies of this kind in the United States, and asking your permission to keep you signed in would be theatre — but you are still owed the list, so here it is.
| Cookie | Kind | What it holds | How long |
|---|---|---|---|
| hs_origin | Functional | a latitude and longitude rounded to about 100 m, and the place name you picked. Remembers where you are answering from, so distances are measured from your town on the first paint of your next visit instead of from the Dallas fallback. Set by HailCatch, in your browser. | One year, or until you clear it. |
| sb-qnswdylfvrmbvyckuefh-auth-token | Strictly necessary | your signed session token, sometimes split across two cookies with a numeric suffix. Keeps you signed in. Without it every page load would be a signed-out one. Only set once you sign in, and removed when you sign out. Set by Supabase Auth, which runs our sign-in. | Until it expires or you sign out. |
The site also keeps a copy of pages and map assets in your browser’s cache so it still works in a truck with no signal. That is storage on your own device; clearing your browser data removes it, and none of it is sent anywhere.
Who else sees any of it
| Company | What they do | What they see |
|---|---|---|
| Supabase | Database and sign-in | Your email address, your organisation and crew, your alert rules, and the storms your crew has marked. |
| Vercel | Hosting and analytics | Ordinary server logs, including your IP address, and cookieless page-view counts. Vercel Web Analytics sets no cookie and does not build a profile. |
| OpenFreeMap | Map tiles | Your browser fetches map tiles directly from them, so they see your IP address and roughly which part of the map you are looking at. We send them nothing about you. |
| Stripe | Payments | Card details and billing address, handled entirely on their side — they never reach our servers. Only relevant once an organisation has a paid plan. |
NOAA, the U.S. Census Bureau, OpenStreetMap and GeoNames are where our hail and exposure data comes from. None of them receives anything about you — the distinction is worth stating, because a list of “data partners” that mixed the two would imply we send your details to a weather service.
Email we send
Three kinds, and there is no fourth:
- Your sign-in link, because you asked for it.
- An invitation, when an owner or admin of an organisation types a colleague’s address and presses the button. That is the one time we write to an address that is not already ours.
- Storm alerts, if you set up a rule. Every alert carries an unsubscribe link that turns that rule off without needing to sign in, and works from the link alone.
There is no newsletter and no marketing list, and no automated message goes to anyone who did not press something themselves.
Keeping and deleting
We keep what is above for as long as your account exists. Deleting an organisation deletes its crew list, alert rules, storm decisions and alert history with it. To ask for your account and everything attached to it to be removed, write to us — and today that is the gap on this page:
Write to support@hailcatch.com.
What this data is not
HailCatch is a find-the-work tool, not claims documentation. Radar hail sizes are calibrated estimates, not measurements; ground reports are third-party observations we pass through. Nothing here is meteorologist-certified, court-ready or insurance-grade, and it must not be presented as any of those.
Children
HailCatch is a tool for a trade. It is not directed at children, and we do not knowingly hold anything about anyone under 13.
Changes
When this page changes, the date at the top changes with it. There is no archive of previous versions yet, which is worth saying rather than implying there is one.