Crystal Weather — Privacy Policy

Effective Date: October 13, 2026Last Updated: October 13, 2026

Crystal Weather is operated by Alexander Ross ("we," "us," "our"). This Privacy Policy explains what information we collect through the Crystal Weather mobile application (the "App"), how we use it, who we share it with, and the rights and choices you have.

Crystal Weather is a social weather app that lets you share real-time, crowdsourced "feels like" weather conditions — including what you're wearing and how the weather actually feels — with friends and your local community.

By using the App, you agree to the practices described in this policy.

1. Who This Policy Covers

This policy applies to everyone who uses Crystal Weather, whether or not you have an account.

• Guests — You can use the App without creating an account to view the local summary for your area. We collect less from you, as described in Section 2.3. You cannot post without an account.
• Account holders — If you create an account, you can post reports, add friends, comment, and like. Everything in this policy applies to you.

2. Information We Collect

2.1 Information You Provide Directly

• Account information — Username, email address, and password, collected when you create an account. Authentication is managed through Amazon Cognito.
• Posts and content — Photos you upload, outfit tags, weather-feel tags, and any text you add to a post.
• Post location — The location associated with a post you create, captured from your device when you post.
• Comments — Any comments you write on posts.
• Communications — If you contact us for support or with a privacy request, we collect your email address and the content of your message.

2.2 Information Collected Automatically

• Device location — With your permission, we access your device's location to determine your local feed, retrieve weather data for your area, and tag your posts. You can manage location permission at any time in your device settings; the App includes a shortcut to those settings. Disabling location will limit core features such as the Local feed.
• Push notification tokens — If you enable notifications, we collect and store a push token for each device you enable them on. Tokens are issued by the Expo push notification service and are used only to deliver the notifications described in Section 5.1.
• Analytics and diagnostic data — We use PostHog and Sentry to understand how the App is used and to find and fix crashes. This includes session recordings with content masked. See Section 7 for the full description, including what is recorded and what is not.
• Server logs — Our servers record technical details of requests, which may include your user ID, errors, and similar diagnostic information. These logs do not record IP addresses automatically. Our firewall may briefly process IP addresses in order to detect and block abusive traffic.

2.3 Guests (Using the App Without an Account)

If you use Crystal Weather without creating an account:

• Your location is rounded before it leaves your device. We round your location to roughly 100 meters and send that rounded value to our server in order to fetch the local summary for your area. Our server does not store it. It is used to answer your request and then discarded.
• Place search uses your phone's built-in geocoding service. When you search for a place by name, that search is handled by the platform's built-in geocoding service, which sends the search text or coordinates to Apple (on iOS) or Google (on Android). Their handling of that information is governed by their own privacy policies.
• Analytics and crash reporting still run. PostHog and Sentry operate for guests under an anonymous identifier that is not tied to a name or email. If you later create an account, that anonymous identifier is linked to your account, which means activity recorded before you signed up becomes associated with you. See Section 7.
• Drafts stay on your phone. If you prepare a report without an account, it is saved only on your device for up to 3 hours. It is not sent to us unless and until you create an account and post it.

2.4 Information From Other Sources

We do not collect personal information about you from third-party sources such as social login providers or data brokers. If this changes, we will update this policy.

3. How Location Data Works

Location is central to how Crystal Weather functions, so we want to be specific about how it is handled:

• Guests — Location is rounded to roughly 100 meters, used to fetch the local summary, and not stored. See Section 2.3.
• What is stored for posts — When you create a post, your device's coordinates are stored with that post on our servers, along with derived place names (neighborhood, city, state). Coordinates are used server-side to determine which local area a post belongs to.
• What other users see — Your exact coordinates are never shared with other users. Location shown to others is reduced on our servers before it is sent:
  • Public posts on the Local feed display city-level location only.
  • Friends viewing your posts see neighborhood-level location.
  • Only you can see the full location detail on your own posts.
• Your control — Location permission is managed through your device settings. The App's Settings screen shows your current permission status and links directly to your device settings.

4. The Local Summary

Crystal Weather shows an anonymous summary of current conditions in an area — for example, how many people nearby report that it feels colder than the forecast. Please read this section carefully, because it is the one place where information from a friends-only post is used outside your circle.

To protect against a summary revealing any one person's report, we show nothing for an area with fewer than 3 reporters. Below that threshold, no summary is displayed at all.

In short: marking a post friends-only keeps your post — the photo, the caption, your name, your location detail — visible only to your friends. The weather observation inside it still contributes anonymously to the count for your area.

5. How We Use Your Information

We use the information we collect to:

• Provide and operate the App (posting, feeds, friends, weather data, local summaries)
• Enable interaction between users (friends, posts, comments, likes)
• Send push notifications about social interactions directed at you, as described in Section 5.1
• Understand how the App is used, and find and fix crashes and performance problems
• Protect the service and its users, including detecting and blocking abuse and enforcing our Terms of Service
• Respond to support inquiries and privacy requests
• Send administrative communications, such as account and security notices
• Comply with legal obligations

We do not use your information for targeted advertising or profiling, we do not sell your information, and we do not send marketing or promotional communications.

5.1 Push Notifications

If you enable notifications, we send them only for social interactions directed at you personally. There are four types:

• Someone sends you a friend request
• Someone accepts your friend request
• Someone likes one of your posts
• Someone comments on one of your posts

We do not send promotional, marketing, or broadcast notifications.

What notification content includes. To be useful, notifications include context about the interaction: the display name of the person who acted, and — for likes and comments — a short excerpt. A like notification includes a summary of the post being liked (its conditions, temperature, and location name, or the first part of your caption). A comment notification includes the first part of the comment text. This content is transmitted through the Expo push notification service and then through Apple's or Google's push services in order to reach your device. Notification content may also appear on your device's lock screen, depending on your device settings.

Your control. You can turn notifications off at any time in the App's Settings, which removes that device's push token from our servers. Note that this control is per device — turning notifications off on one device does not disable them on other devices where you are signed in. You can also disable notifications entirely through your device's system settings.

6. Privacy Defaults

All Crystal Weather accounts are private by default:

• Users who are not your friends can see only a limited profile card: your username, avatar, bio, and join date. They cannot see your posts, your friends, or your location.
• Your posts are visible only to your accepted friends, unless you individually choose to make a specific post public.
• Public posts appear on the Local feed with city-level location only. A user who taps your public post sees only your limited profile card.
• Your email address is never visible to other users.
• The one exception is the anonymous local summary described in Section 4, which counts the weather data from all reports — including friends-only ones — without any identifying information.

7. Analytics, Session Replay, and Crash Reporting

We use two third-party services to understand how the App is used and to keep it working. Both run for guests as well as account holders.

7.1 PostHog (product analytics and session replay)

• What it records — Events describing how you use the App, including when you open and close it, and a session recording of the screens you visit.
• What is masked in recordings — All images and all text fields are masked in session recordings. This means photos you view or upload, and anything you type, are obscured rather than captured.
• Identifiers — Guests are recorded under an anonymous identifier. A session identifier persists across App restarts. If you create an account, your anonymous identifier is linked to your account, which associates earlier activity with you.
• Where the data goes — PostHog's United States cloud service.

7.2 Sentry (crash and performance monitoring)

• What it records — Crash reports, plus performance traces for roughly 20% of sessions.
• Where it runs — Production builds only. Sentry does not record sessions.
• Identifiers — Crash and performance data is linked to your user ID once you are signed in.

We use these services to improve the App and fix problems. We do not use them for advertising, and we do not sell the data they collect.

8. Sharing and Disclosure

We do not sell your personal information. We disclose information only to service providers that process it on our behalf to run the App:

• Amazon Web Services (AWS) — Cloud infrastructure for storage, compute, and API hosting. Processes account data, posts, photos, location, push tokens, and server logs.
• Amazon Cognito — Account authentication. Processes username, email, password, and session tokens.
• Google Geocoding API — Converts coordinates into place names on our servers. Receives location coordinates.
• Apple and Google platform geocoding — When you search for a place by name, your device's built-in geocoding service sends the search text or coordinates to Apple (iOS) or Google (Android).
• Open-Meteo — Provides weather data. Receives location coordinates.
• PostHog — Product analytics and session replay, as described in Section 7.1. United States cloud service.
• Sentry — Crash and pe