Privacy Policy

Grand Tracker ("we," "us," or "our") operates the Grand Tracker progressive web application and the website at grandlakeapp.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.

1. Information We Collect

Information you provide directly:

• Payment information: When you subscribe to Grand Tracker Pro, payment is processed securely by Stripe. We do not store your credit card number, CVV, or full card details on our servers. Stripe handles all payment data per their Privacy Policy.
• Email address: If you contact us via email or subscribe through Stripe, we may collect your email address.
• Restore/access codes: If you enter a restore code to unlock features.

Information collected automatically:

• Device and browser information: Device type, operating system, browser type, screen resolution, and language preferences.
• Usage data: Pages visited, features used, time spent, clicks, and interactions within the app.
• Approximate location: Country, state, and city derived from your IP address.
• GPS location (Lightning Alerts only): If you enable Lightning Alerts, we request your device's GPS location. Your coordinates are rounded to 2 decimal places (~0.7 mile precision) before being stored on our server. This approximate location is used solely to determine if lightning strikes are occurring near you and to send proximity-based push notifications. Your location is stored in our database (Upstash Redis) and is automatically deleted when you disable Lightning Alerts. You can disable this feature at any time in the Events tab notification preferences, which immediately removes your stored location.
• Referral data: How you found our Service (search engine, social media, direct link, etc.).
• App install events: Whether you added the app to your home screen and whether you open it in standalone mode.

2. Analytics and Tracking Technologies

We use the following third-party services to analyze usage, deliver the Service, and improve our Service:

• Google Analytics 4 (GA4): Collects anonymized usage data including pages visited, session duration, device info, and traffic sources. Google may use this data per their Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity: Records anonymized session replays and heatmaps to understand how users interact with the app. Clarity masks sensitive input fields by default. See Microsoft's Privacy Statement.
• Vercel Analytics: Collects anonymized page view and performance data. See Vercel's Privacy Policy.
• Meta Pixel (browser-side): When active, collects data about page visits in your browser to enable advertising measurement and audience building on Meta platforms. See Meta's Privacy Policy. You can manage your ad preferences at Facebook Ad Preferences.
• Meta Conversions API (server-side): When you complete a purchase or other key conversion event, we forward a server-side event to Meta containing the event type, a hashed (SHA-256) version of your email address if available, the event timestamp, and your client IP and user agent. This is used for advertising measurement and is suppressed when you decline marketing cookies.
• OneSignal: Powers push notifications. OneSignal stores a per-device push subscription identifier. If you enable Lightning Alerts, OneSignal also receives an approximate (rounded) latitude/longitude so we can route nearby-strike alerts to you. See OneSignal's Privacy Policy.
• Anthropic (Claude): AI-powered features forward your prompt text to Anthropic for processing and return a response. We send only the prompt and any conversation context required for the response; we do not send your account email, location, or push tokens to Anthropic. See Anthropic's Privacy Policy.
• Upstash (Redis / KV): Hosts our serverless key-value database, which stores billing/subscription state, anonymized analytics aggregates, your push subscription record, and (when Lightning Alerts are on) your rounded coordinates. See Upstash's Privacy Policy.
• Stripe: Processes all payments and stores billing records. We do not store your full credit card details. See Stripe's Privacy Policy.

These tools may use cookies, local storage, or similar technologies. See Section 5 for your opt-out options.

3. Push Notifications

We use OneSignal to deliver push notifications about weather alerts, lake conditions, and events. Push notifications are entirely optional. You must explicitly grant permission before receiving them, and you can disable them at any time through:

• The notification preferences section in the Events tab of the app
• Your device's notification settings
• Your browser's site notification settings

OneSignal may collect a device identifier to deliver notifications. See OneSignal's Privacy Policy.

4. How We Use Your Information

• To provide and maintain the Service
• To process payments and manage subscriptions
• To send push notifications you've opted into
• To understand how the app is used and improve it
• To measure advertising effectiveness
• To detect and prevent abuse or unauthorized access
• To communicate with you about your account or support requests

5. Your Rights and Choices

Opt out of analytics tracking:

• Use the Google Analytics Opt-out Add-on
• Enable "Do Not Track" in your browser settings
• Use a browser extension like uBlock Origin or Privacy Badger
• Clear cookies and local storage to reset tracking identifiers

Manage push notifications: Disable in the app's Events tab or your device settings.

Cancel your subscription: Email us at howdy@grandlakeapp.com or manage directly through Stripe's customer portal.

California residents (CCPA): You have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, email howdy@grandlakeapp.com.

EU/EEA residents (GDPR): You have the right to access, rectify, erase, restrict processing, and port your data. To exercise your rights, email howdy@grandlakeapp.com.

6. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the third-party service providers listed in Section 2 (Stripe, Google, Microsoft, Meta — including the Meta Conversions API server-side integration — OneSignal, Anthropic, Upstash, and Vercel), and only as necessary to operate the Service. These providers have their own privacy policies governing their use of your data.

If you reside in California, the server-side forwarding of conversion events to Meta may be considered a "share" for cross-context behavioral advertising under the CPRA. You can opt out by declining marketing cookies on the consent banner, which suppresses this forwarding for your browser.

7. Data Retention

We retain analytics data for up to 26 months (Google Analytics default). Payment records are retained per Stripe's policies and applicable tax/legal requirements. You may request deletion of your data at any time by contacting us.

8. Data Security

We use commercially reasonable measures to protect your information, including HTTPS encryption for all data in transit, secure server-side API key storage, and Stripe's PCI-compliant payment processing. However, no method of transmission or storage is 100% secure.

9. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

10. Third-Party Links and Data Sources

The Service contains links to third-party websites (Google Maps, restaurant websites, event pages, etc.). We are not responsible for the privacy practices of these external sites.

For the list of public-agency and third-party data feeds that power the visible content in the app (USGS, NOAA, USACE, GRDA, ODWC, Blitzortung, OpenStreetMap, etc.), see our Data Sources page.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: howdy@grandlakeapp.com