Privacy policy

1. Who is responsible

Controller under the GDPR and Data Fiduciary under India’s Digital Personal Data Protection Act 2023 (“DPDP Act”):

2. What we process, why, and on which legal basis

2.1 Delivering the website

When you open a page, your browser sends technical data that any web server needs to answer: your IP address, the date and time, the address of the requested page or data, and your browser’s user agent. This is processed only to deliver the site and keep it secure and working (GDPR Art. 6(1)(f); our legitimate interest is a working, secure service).

Our application server keeps an access log for troubleshooting. Before a line is written, coordinates, search terms and postcodes in the request are replaced by “…” and the IP address is shortened (the last part is removed), so the log cannot show who you are or where you are. The log is rotated daily and deleted after 14 days. The web server in front of it logs even less: the shortened IP address, the time, the result and your browser’s user agent — no page addresses, no address of the page you came from, no cookies — and deletes it after 14 days as well.

2.2 Place search

What you type into a search box is sent to our server to find matching places and is answered immediately; it is not stored (the access log masks it, see 2.1). Basis: GDPR Art. 6(1)(b) — providing the search you asked for; DPDP Act § 7(a) — data you provided voluntarily for this purpose.

2.2a Contacting us

If you write to us by email or with the form on the contact page, we process your email address, your name if you give it and your message, only to answer you. The form also names the page you wrote from (its path and what it showed, e.g. the layer — never coordinates, places or searches). It passes your message straight on as an email to our mailbox (with your address as the reply address) through our mail provider; the website does not store it and does not log it. To stop abuse, the server counts the messages sent per connection for one hour, in memory only, using a shortened and scrambled form of your IP address that is not written anywhere. Basis: GDPR Art. 6(1)(b) where your request concerns a service, otherwise Art. 6(1)(f) (our legitimate interest in answering); DPDP Act § 7(a). We delete the correspondence once your request is settled, at the latest after 12 months, unless the law requires us to keep it longer (e.g. business letters under commercial and tax law).

2.3 Your location

The weather map (the home page) asks your browser for your location when it opens, so it can start with the weather where you are; elsewhere, only when you press a “my location” button. Your browser shows a permission prompt first — nothing happens if you decline. If you allow it, the other pages (places, radar, alerts) use the same permission to start at your nearest place, without asking again. Your approximate coordinates are sent to our server only to find the nearest place and its forecast; they are rounded to about 100 m, not stored, and masked in the access log. With the same permission, the alert banner checks once a minute whether an official warning or a model alert covers your location; for this the coordinates are rounded to about 1 km, not stored, and masked in the access log. Without the permission, the banner never asks for it on its own — only when you press “Check my location”. You can withdraw the permission at any time in your browser settings. Basis: your consent given in the browser prompt (GDPR Art. 6(1)(a); DPDP Act § 6) and the service you requested (GDPR Art. 6(1)(b)).

2.4 Device settings used in your browser only

To show India’s official borders to visitors in India, to centre the weather map on your country before (or without) location access, and to show the alerts of your country in the banner when you have not shared your location, the page reads your device’s time zone and language — inside your browser. These settings are not sent to us; the banner requests only the two-letter country code derived from them. We do not look up your location from your IP address.

2.5 Storage on your device

We set one cookie of our own (mk-units, below). To provide what you asked for, the site stores a few items in your browser, which is permitted without consent because it is strictly necessary for the service you requested (EU ePrivacy Directive Art. 5(3)):

• mk-settings (local storage) — your settings for this site: units, clock and time zone, how directions are written, map options (grid, label language, wind animation, smooth radar and satellite animation, altitude labels), your pinned layers, the places you saved in “My places” (their names and coordinates, at most 50, and which one is your home place), the last five places you chose in a search (the forecast card can start there) and, if you choose it, the map position and layer to start with;
• mk-show-place (session storage, for a moment) — when you open a saved place from another page, its name until the weather map has opened it;
• mk-units (cookie, 12 months) — a short code of the same unit, clock and direction choices (e.g. 200000000000), so city forecast pages arrive in your units. It holds no identifier and is set only when your choices differ from the default units (°C, m/s, mm, hPa, cm, metres, km);
• mk-projection (local storage) — whether you chose the globe or the flat map;
• mk-warning-dismissed (local storage) — alert banners you closed;
• Cache Storage mk-tiles-v1-… (a service worker) — map tiles and weather data already downloaded, so maps load faster and use less data.

Your saved places stay in this browser: we keep no copy, and there is no account. To show the current weather at your saved places on the weather map (you can turn this off in “My places”), your browser asks our server for the forecast values at their coordinates — without their names — as it does for a point you click on the map. For the 4-day forecast card at your home place, it also asks which place is nearest to your home’s coordinates. The answer is sent at once and nothing is stored; the coordinates are masked in the access log (see 2.1). Basis: GDPR Art. 6(1)(b) — the service you asked for; DPDP Act § 7(a). Export and import create or read a file on your own device; nothing is uploaded.

Apart from the mk-units cookie, which your browser sends with every page request to this site and which we use only to choose the units of the page (it is not logged), and the coordinates of your saved places described above, none of this is sent to us. You can delete all of it at any time with “Delete my data from this device” in Settings, or by clearing the site data for this website in your browser.

2.5a Files you open on the map

GPX and KML files you open on the map are read in your browser and are never sent to MeteoKite. If you choose “Keep on this device”, the file is stored in your browser’s storage (IndexedDB) on this device only, until you remove it or use “Delete my data”.

2.5b MeteoKite embedded on other websites

Maps and forecasts embedded on other websites set no cookies and store nothing in the visitor’s browser. Our server receives the usual request data, handled as described under “Server logs”. The website that embeds MeteoKite is responsible for its own pages.

2.6 Third parties and hosting

Your browser only connects to this website; on city weather pages also to Google’s ad servers (section 2.8). Map imagery from other providers (terrain relief from the AWS Open Data “Terrain Tiles”, Sentinel-2 satellite imagery from EOX) is fetched by our server, so these providers do not see your IP address.

The site runs on rented servers; the hosting provider processes data only on our behalf (data processing agreement, GDPR Art. 28).

We do not sell your data, and we do not use it for advertising ourselves. City weather pages show Google ads (section 2.8).

2.8 Ads on city weather pages (Google AdSense)

Where: only the city weather pages (/weather/<country>/<city>) show ads. The maps, radar, satellite, alerts and all other pages show none and load nothing from Google’s ad servers.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for visitors in the EEA, the UK and Switzerland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, elsewhere. Google decides itself how it uses the data for its ads (as an independent controller); how it does so is described at policies.google.com/technologies/partner-sites.

What Google receives: when a city page loads, your browser contacts Google’s ad servers, which receive your IP address, the page’s address, your browser and device details and the cookies or identifiers Google stores for ads.

Your choice: in the EEA, the UK and Switzerland, Google shows its own consent message (certified under the IAB Transparency & Consent Framework) before using cookies or personal data for ads; you can accept, reject or choose per purpose, and change your choice later with the link Google’s message places on the page. If you do not consent, Google may still show limited ads that do not use your data for personalisation. Elsewhere you can manage or turn off personalised ads at myadcenter.google.com. Basis: GDPR Art. 6(1)(a) and the ePrivacy rules (your consent) in the EEA, the UK and Switzerland; DPDP Act § 6 (consent) in India.

Cookies: Google’s ad cookies belong to Google’s own domains, so “Delete my data from this device” cannot remove them; your browser’s settings can.

Children: the site is not directed at children; under the DPDP Act § 9 targeted advertising must not be directed at children. If you are under 18, please do not consent to personalised ads.

3. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21); you can withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.

Under the DPDP Act you have the right to information about your personal data and its processing (§ 11), to correction and erasure (§ 12), to grievance redressal (§ 13) and to nominate another person to exercise your rights (§ 14). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Wherever you live, we honour the same requests: you can ask what personal data we hold about you and have it corrected or deleted, and you can complain to the data protection authority of your country.

Because we keep no account data and our logs cannot identify you, we will usually hold no personal data about you — we will tell you so. To exercise your rights, write to privacy@meteokite.com.

4. Children

The site offers general weather information, has no accounts and does not knowingly process personal data of children, nor profile anyone; the ads on city weather pages are Google’s, and the site is not directed at children (section 2.8).

5. Security

The site is served over an encrypted connection (HTTPS). We keep only the data described here, for the time stated, and protect our servers with reasonable security practices.

6. Changes

We update this policy when the site changes; the date at the top shows the current version. See also the legal notice and the terms of use.