Privacy Policy

Where to Go for Great Weather (“the service”) is operated by Power Pioneer, a sole proprietorship (eenmanszaak) established in the Netherlands, registered at Van Diemenstraat 138, 2518 VG Den Haag, Netherlands (KvK 98272969). That entity is the data controller for the personal data described here.

For any question about this policy, or to exercise a right under the GDPR, write to powerpioneer@pm.me. No Article 27 representative is named, and none is required: that Article applies to controllers established outside the Union, and this one is established in the Netherlands.

If you never sign in

Nothing that identifies you. The map, the country pages and the month pages are served as static documents; the climate figures on them are baked into the map tiles and the pre-rendered HTML, so browsing them sends us no queries about what you looked at. Your weather preferences on the map live in the page URL, which means they never leave your browser except when you choose to share the link.

Our servers keep ordinary web-server request logs. Analytics for this traffic is cookieless and non-identifying — see Analytics.

If you create an account

• Your email address. It is the account identifier: sign-in is a magic link mailed to it, or Google sign-in, which returns your address and name from Google.
• What you save. Trips (a destination, a month, and the weather preferences you saved them with), favourites, and email alerts.
• Your plan. Free or paid, and for agency accounts the organisation you belong to and your role in it. We do not store card details — see processors.
• Agency data you enter. If you run an agency account: the names, optional email addresses and notes you record about your own clients. You are responsible for having a lawful basis to put them there; as between us, we process them on your instructions.

We do not buy personal data, we do not sell it, and we run no advertising network on the site.

The site sets five cookies of its own. All five are strictly necessary — they exist to sign you in, to keep sign-in safe, to remember that you pressed “upgrade” before you had an account, to remember whether you read temperatures in Celsius or Fahrenheit, and to remember that you have already seen the short guide on the map. None of them is used to profile you or to advertise, and there is nothing here for a consent banner to switch off, which is why the site does not show one.

Local storage is not used. Your weather preferences are held in the URL precisely so that they are shareable and so that nothing has to be written to your device; if you are signed in they are also saved to your account, so they follow you to another device. The two readable cookies above are the only exceptions: a preference that has to survive on a pre-built page cannot live in a URL you did not type, and neither can the fact that you have already seen the map’s guide.

One third party may set storage of its own: Paddle, inside the checkout window it opens when you choose to buy. Paddle’s script is loaded only on the checkout pages, the window itself is served from Paddle’s domain, and what it stores is governed by Paddle’s policies rather than this one. Plausible, our analytics, sets none, and neither does PostHog — see below.

Analytics: Plausible, cookieless

Anonymous traffic is measured with Plausible Analytics, which we run on our own server. It sets no cookies, stores no identifiers on your device, and does not follow you between sites. It counts page views in aggregate. Because it neither reads nor writes anything on your device and processes no personal data, it needs no consent — this is the reason the site has no cookie banner.

After you sign in: PostHog, EU-hosted

Once you are signed in, we measure how the product is used with PostHog, on its EU cloud. It records the pages you open and the actions you take in the app, linked to your internal account id, your plan and, for agency accounts, your role and organisation id. It is not sent your email address or your name. It is never loaded for visitors who are not signed in.

PostHog is configured to keep its identifiers in memory only: it sets no cookies and writes nothing to your device, so nothing survives once you close the tab. Session recording is switched off in the code itself, not merely in a dashboard setting — no recording of your screen takes place. We rely on our legitimate interest (Art. 6(1)(f)) in understanding which features are used, and you can object at any time by writing to us; a content blocker also stops it, and the site works identically without it.

If you would rather not be counted at all, most content blockers stop Plausible, and the site is built to work identically when it is blocked.

Errors

Crashes and server errors are reported to GlitchTip, which we also self-host. Reports are scrubbed before they are sent: email addresses and IP addresses are replaced with markers at the point the report is built, and the client is configured not to attach personally identifying request data.

These are every third party that sees any part of your data, and what they see. Each processes it under a data processing agreement with us, as Article 28 of the GDPR requires — except Paddle for the sale itself, which it makes as merchant of record and therefore as a controller in its own right.

Plausible and GlitchTip are not on this list because they are not third parties: both run on our own server, and the data they hold never leaves it.

Where data leaves the EU/EEA, this is the basis for it. Paddle is in the United Kingdom, which the European Commission has found to provide adequate protection. Google LLC is certified under the EU–U.S. Data Privacy Framework. Backblaze and PostHog store our data in the EU but are U.S. companies, and bunny.net serves from edge locations worldwide; for those, transfers rest on the Commission’s standard contractual clauses in each provider’s data processing agreement.

• Account data — for as long as the account exists, and 30 days after you close it.
• Purchase and tax records — seven years, as Dutch tax law requires. Paddle keeps its own records of the sale for as long as the law requires of it as merchant of record.
• Backups — database backups are taken nightly, encrypted, and each copy is deleted after at most 42 days. Deleted data survives in backups until those copies age out; it is not restored into the live service.
• Error reports — 90 days.
• Server logs — rotated automatically by size and typically gone within a few weeks; they never hold your email address or IP address in readable form.

• Everything is served over HTTPS. Session cookies are HttpOnly, Secure and SameSite=Lax, and their contents are cryptographically signed, so a tampered cookie is rejected rather than trusted.
• We never handle your card. Paddle takes payment on its own pages and tells us only that a subscription started, changed or ended.
• The database is reachable only from inside the application’s private network — it is not exposed to the internet.
• Backups are encrypted on our server before upload, so the storage provider holds ciphertext.
• Logs are written with email addresses and IP addresses redacted at the point the log line is constructed.

No system is perfect. If you find a security problem, please report it to powerpioneer@pm.me before disclosing it publicly.

If you are in the EU/EEA or the UK you have the right to access a copy of your data, to have it corrected, to have it erased, to restrict or object to processing, to portability, and to withdraw consent where processing rests on it. Everyone who uses the service gets the same treatment on request regardless of where they live.

Email powerpioneer@pm.me and we will answer within one month. There is currently no self-service delete button in the account area — closure and erasure are handled by that address. Write from the email address on the account; we close it, erase its trips, favourites, alerts and saved preferences, cancel any running subscription, and confirm by reply. Records Paddle must keep as the seller are Paddle’s to keep.

Alert emails carry a one-click unsubscribe, which takes effect without needing to contact anyone.

You may also complain to your local supervisory authority. Ours is the Autoriteit Persoonsgegevens, the Dutch data protection authority.

The service is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

None of it is about you — it is reference data, computed once and served to everybody identically. It is listed here because knowing what a page is built from is part of knowing what it does.

• Climate — ERA5, the ECMWF reanalysis distributed through the Copernicus Climate Data Store. We compute ten-year monthly averages and percentiles from it.
• Country and region boundaries — Natural Earth (public domain) for countries and first-level subdivisions, and geoBoundaries for second-level districts.
• Travel advisories — the published advisories of six governments: the United States, the United Kingdom, Canada, Australia, Germany and the Netherlands. Each record keeps its source link and the date it was fetched, and the level shown by default is the highest of the six.

Attribution and licence terms for these sources are set out in the Terms of Service.

If this policy changes materially we will say so on the site before the change takes effect, and where the law requires it we will ask again for your consent. The date at the top of this page is when this version took effect.