Privacy policy

The controller of puhub.ee is Wormsi OÜ, registry code 17075551, at Paali, Rumpo village, 91309 Vormsi, Estonia. This means we decide why and how personal data is used within Puhub and are responsible for protecting it. For privacy questions, email [email protected].

The amount of data depends on how you use Puhub. We do not need your name or email when you simply check the weather. More information is created only if you choose your location, create an account, or save a place or rule.

• Technical data: IP address, request time and address, browser and device type, referring page, and error information.
• Account data: email address, user identifier, authentication and session data, account creation time, and latest sign-in time.
• Profile data: display name, language preference, and notification or briefing settings you select.
• Saved places: your label for a place, a weather-station identifier, or coordinates you enter.
• Saved views and alert rules, if you use those features.
• Preferences stored on your device, including theme, language, and public-map favourites (localStorage).
• Limited usage analytics: page views, features used, and browser, device, and approximate-region information accompanying the request, processed by PostHog EU. PostHog is configured without cookies, localStorage, sessionStorage, a persistent visitor identifier, automatic click capture, or session recording.

Puhub does not ask for your precise location when the page opens. Your browser asks only after you press the location control. You can decline and search manually; the rest of the service continues to work. If you allow it, coordinates are used to move the map or show nearby weather. You can withdraw permission in browser or phone settings at any time.

If you save a place to your account, the selected station identifier or coordinates are linked to your account until you delete the place or erase the account data.

We do not collect information just in case. Every use must have a specific purpose and legal basis.

• Providing the service and account, sign-in, saved places, export, and erasure: performance of a contract or steps you request before entering into a contract.
• Service security, abuse prevention, reliability, and technical logs: our legitimate interest in keeping the service secure and operational.
• Compliance with legal requirements: legal obligation.
• Limited usage analytics without a persistent identifier: our legitimate interest in understanding general service use and improving reliability. We protect your rights through data minimisation and by disabling PostHog browser storage, automatic click capture, and session recording.
• Storing local preferences you request on your device: providing the feature you requested. You can remove these preferences by clearing browser data.
• Notifications or newsletters you choose: consent; you can unsubscribe at any time.

Puhub does not operate in a technical vacuum. We use the providers below, but give them only what their task requires. They may not use Puhub data for their own advertising or sell it.

• Supabase: user accounts, authentication, and account-related database records.
• Cloudflare: website delivery, security, and technical logs.
• Google Cloud: application interfaces, data processing, and service logs.
• PostHog EU: limited usage analytics and product improvement; PostHog browser storage, automatic click capture, and session recording are disabled.
• Email service provider: sign-in and service-related messages.
• Weather and map providers may receive an ordinary technical request when the browser loads data directly from them; the methodology page contains a fuller source list.

We retain account and profile data and saved places while the account remains active. The erasure control in Settings removes the profile, saved places, views, and alert rules, but not the Supabase Auth sign-in identity. To delete the sign-in identity, email [email protected]. Deleted information may remain in backups for a limited period until those backups are routinely overwritten.

Security and service logs and analytics data are retained only for as long as needed for their purpose, according to the configured retention period of the relevant provider. We retain information for a longer period where required by law.

We prefer processing in the European Union or European Economic Area. If a provider processes data outside the EEA, we use an applicable safeguard such as a European Commission adequacy decision or Standard Contractual Clauses.

You may request access to your data, correction of inaccurate data, erasure or restriction, object to processing based on legitimate interests, and receive data you supplied in a machine-readable format where the legal requirements apply. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

You can export and erase saved account data in Settings. To delete the sign-in identity or make another request, email [email protected]. We normally respond within one month. You may also complain to the Estonian Data Protection Inspectorate (aki.ee).

The service is not directed at knowingly collecting children's personal data. If this policy or our processing changes materially, we will update the date on this page and, where appropriate, notify users through the service.