Introduction

BashWeather ("we", "us", or "our"), operated by Bashar Sawaqed, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information about you when you use the BashWeather progressive web application ("Service") available at bashweather.app.

This policy is drafted in compliance with:

• The EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679
• The California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
• Jordan's Personal Data Protection Law No. 24 of 2023
• The UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection
• ePrivacy Directive 2002/58/EC (as amended)

By using BashWeather, you acknowledge you have read and understood this policy. If you do not agree, please discontinue use of the Service.

Data Controller

1. What Personal Data We Collect

We collect the following categories of personal data:

1.1 Account & Identity Data (Google Sign-In)

• Full name — provided by your Google account upon sign-in
• Email address — used to identify your account and send service-related communications
• Profile photo URL — displayed in the application interface
• Google User ID (sub) — a unique identifier assigned by Google to distinguish accounts

1.2 Location Data

• GPS coordinates (latitude/longitude) — collected with your explicit permission when you request weather for your current location. Coordinates are transmitted to Open-Meteo's API to retrieve weather data and are not stored on our servers beyond the session request.
• Saved locations — city names and coordinates you manually save are stored in your browser's localStorage and, if logged in, associated with your account in our backend.

1.3 Device & Technical Data

• IP address — logged by Cloudflare at the network edge for security, abuse prevention, and geographic routing. Cloudflare may truncate IPs for privacy.
• User agent string — browser and OS type, used for compatibility and analytics
• Device type — mobile, tablet, or desktop (derived from user agent)
• Screen resolution and language settings — used to optimise the display

1.4 Usage & Analytics Data

• Pages viewed and navigation paths — collected via Google Analytics 4
• Feature interactions — e.g., which weather variables are viewed, whether daily brief is used
• Session duration and frequency
• Referral source — how you arrived at the app (search engine, direct link, etc.)

1.5 Push Notification Data

• Push subscription endpoint URL — a unique URL issued by your browser's push service (e.g., FCM, Mozilla Push) used to deliver notifications. Stored on our servers only if you opt in to notifications.
• Notification preference flags — whether you have been asked for permission, stored in localStorage.

1.6 Cookies and Local Storage

We use cookies and localStorage for session management, preferences, and analytics. See our Cookie Policy for full details.

2. How We Use Your Personal Data

We use your personal data for the following purposes:

• Providing the Service — delivering weather forecasts, daily briefings, and location-based features
• Authentication — verifying your identity via Google OAuth to secure your account and saved preferences
• Personalisation — remembering your saved locations, language preference (English/Arabic), and theme settings
• Push Notifications — sending weather alerts and daily briefings if you opt in
• Analytics & Improvement — understanding how users interact with the app to improve features, fix bugs, and enhance performance
• Security & Abuse Prevention — detecting and preventing fraudulent access, scraping, or abuse of the Service
• Legal Compliance — meeting our obligations under applicable laws and responding to lawful requests from authorities
• Communications — sending service-related emails (e.g., account security notices) when necessary

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Legal Basis for Processing (GDPR Article 6)

For users in the European Economic Area (EEA) and the United Kingdom, we process your personal data under the following legal bases:

Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

4. Third-Party Services & Data Sharing

We do not sell your personal data. We share data only with the following trusted third parties, strictly as necessary to provide the Service:

4.1 Google LLC (Sign-In & Analytics)

Purpose: Authentication via Google OAuth 2.0 / OpenID Connect; usage analytics via Google Analytics 4.

Data shared: Google manages your identity data directly. Analytics data (pseudonymous identifiers, usage events) is transmitted to Google's servers.

Location: United States (with EU Standard Contractual Clauses for EEA users)

Privacy Policy: policies.google.com/privacy

Opt-out: Google Analytics Opt-out Browser Add-on

4.2 Open-Meteo (Weather Data API)

Purpose: Retrieving weather forecasts based on your location coordinates.

Data shared: Latitude and longitude of requested locations. No account or identity data is sent.

Location: Germany (EU) — Open-Meteo is GDPR-compliant and does not store user IP addresses.

Privacy Policy: open-meteo.com/en/terms

4.3 Cloudflare, Inc. (Infrastructure & Security)

Purpose: Our backend API runs on Cloudflare Workers. Cloudflare also provides DDoS protection, CDN, and edge caching.

Data shared: All network traffic passes through Cloudflare's infrastructure, including IP addresses and request metadata.

Location: United States / Global edge network (with EU SCCs where applicable)

Privacy Policy: cloudflare.com/privacypolicy

4.4 Legal Authorities

We may disclose personal data to law enforcement or government authorities when required by a valid legal order, court order, or applicable law. We will notify you of such requests where permitted by law.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

When data is no longer needed, it is securely deleted or anonymised.

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

Rights under GDPR (EU/EEA/UK users)

• Right of Access (Art. 15) — You may request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
• Right to Erasure / "Right to be Forgotten" (Art. 17) — You may request deletion of your data where there is no overriding legitimate ground for continued processing.
• Right to Restriction of Processing (Art. 18) — You may request that we limit how we use your data in certain circumstances.
• Right to Data Portability (Art. 20) — You may receive your data in a structured, machine-readable format to transfer to another service.
• Right to Object (Art. 21) — You may object to processing based on legitimate interests, including for analytics purposes.
• Rights Related to Automated Decision-Making (Art. 22) — We do not perform solely automated decision-making with legal effects; this right is noted for completeness.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw at any time by adjusting your browser settings or contacting us.

Rights under CCPA/CPRA (California users)

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of sale or sharing of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

How to Exercise Your Rights

Submit your request via email to privacy@bashweather.app with the subject line "Data Subject Request". We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing the request.

Right to Lodge a Complaint

If you are in the EU/EEA, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.

7. Cookies

We use cookies and similar technologies (localStorage, sessionStorage) to operate and improve the Service. Our Cookie Policy provides full details, including how to opt out. See our Cookie Policy.

Essential cookies are necessary for the Service to function and cannot be disabled. Analytics and preference cookies may be declined by adjusting your browser settings or using our opt-out mechanisms.

8. Push Notifications

If you opt in to push notifications, your browser generates a unique push subscription endpoint. This endpoint is stored on our servers solely to deliver weather alerts and daily briefing notifications to you.

What we send: Weather condition alerts, daily briefing summaries, and occasional service announcements.

How to opt out: You can revoke notification permission at any time through your browser settings (typically under Site Settings > Notifications). You may also delete your push subscription by contacting us at privacy@bashweather.app. Revoking permission will automatically invalidate the stored endpoint.

9. Children Under 13

BashWeather is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take prompt steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@bashweather.app and we will investigate and delete the data promptly.

Users between 13 and 16 years of age in the EU/EEA may require parental consent for certain processing activities (see Article 8 GDPR). We rely on the terms of Google's age verification for sign-in purposes.

10. International Data Transfers

BashWeather is operated from the Hashemite Kingdom of Jordan. Your data may be transferred to and processed in countries outside your country of residence, including the United States, European Union member states, and other jurisdictions where our third-party providers operate.

For transfers from the EEA/UK to countries without an EU adequacy decision (such as the United States), we rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) GDPR — applied to our agreements with Google and Cloudflare
• EU-U.S. Data Privacy Framework — Google LLC and Cloudflare, Inc. participate in the EU-U.S. Data Privacy Framework

Jordan does not currently hold an EU adequacy decision. Where we receive data from EEA users, we implement appropriate safeguards as described above to ensure an equivalent level of protection.

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These include:

• All data in transit is encrypted using TLS 1.2 or higher
• Google OAuth tokens are handled server-side and not exposed to the client
• Cloudflare's edge infrastructure provides DDoS mitigation and WAF protection
• Access to backend systems is restricted to authorised personnel only

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by Article 34 GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by applicable law or where changes significantly affect your rights, provide additional notice (e.g., a notification in the app or by email).

We encourage you to review this policy periodically. Continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

BashWeather is not required to appoint a formal Data Protection Officer (DPO) under GDPR as it does not fall within the mandatory scope of Article 37. However, the contact above handles all data protection matters with equivalent diligence.