Privacy Policy

Last Updated: June 22, 2026

Welcome to XcThermal ("we," "our," or "us"). We are committed to protecting your privacy and being transparent about how your information is accessed, used, stored, shared, retained, and deleted when you use our web application and services (collectively, the "Service"). This policy applies to all users of xcthermal.com.

1. Google User Data

XcThermal offers "Sign in with Google" as a convenient way to create and access your account. This section specifically discloses how we handle Google user data, in compliance with the Google API Services User Data Policy (including the Limited Use requirements) and the Google APIs Terms of Service.

Data We Access

When you choose to sign in with Google, we request the OAuth scopes openid, email, and profile. Through these scopes we access only the following Google user data:

Email address — your primary Google account email.
Basic profile information — your display name (used to create your XcThermal username) and your unique Google account identifier (Google ID).

We do not request or access your Google contacts, Google Drive, calendar, location history, or any other Google services or data.

How We Use This Data

To create your XcThermal account and to securely authenticate you on each subsequent sign-in.
To populate your username and identify your account within the Service.
To send you essential account-related communications (e.g., security notices, password resets, and support replies).

We use Google user data only to provide and improve these user-facing features. We do not use it for advertising, and we do not use it to build profiles for purposes unrelated to the Service.

How We Share This Data

We do not sell, rent, or transfer your Google user data to third parties. Your Google user data is not shared with our weather, mapping, or AI providers (Meteoblue, Open-Meteo, Mapbox, or Google Gemini) — those services receive only anonymous location and weather parameters needed to generate forecasts, never your Google identity. We may disclose Google user data only where required by law or to comply with a valid legal request. XcThermal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How We Store & Protect This Data

Google user data is stored in an access-controlled SQLite database on our secured server. All data is transmitted over encrypted HTTPS/TLS connections, account passwords (for non-Google accounts) are stored only as salted hashes, and access to the production server and database is restricted to authorized administrators.

Retention & Deletion of This Data

We retain your Google user data for as long as your account remains active. You may request deletion of your account and all associated Google user data at any time by emailing info@xcthermal.com. We will permanently delete the data from our active systems within 30 days of a verified request (excluding any records we are legally required to retain). Disconnecting XcThermal from your Google account permissions also revokes our future access to your Google data.

2. Other Information We Collect

2.1. Information You Provide to Us

Account Information: When you register without Google, we collect your username, email address, and a hashed password.
User Content: Settings preferences (e.g., units, language, map style) and any feedback you provide.
Communications: If you contact us, we may collect your name, email address, and the content of your message.

2.2. Information We Collect Automatically

Location Data: To provide our thermal map and weather analysis, we process geolocation data (latitude, longitude, altitude) when you interact with the map or use the "Locate Me" feature.
Usage Data: Information about your interactions with the Service, such as features used, frequency of visits, and your IP address.
Device Information: Information about the device and browser you use to access the Service.

3. How We Use Your Information

To provide, maintain, and improve the Service (e.g., generating thermal maps and AI weather interpretations).
To personalize your experience, such as saving your map preferences and flight settings.
To communicate with you about your account, updates, security alerts, and support.
To monitor and analyze trends, usage, and activity in connection with the Service.
To detect, prevent, and address technical issues and fraudulent activity.

4. Sharing of Information

We do not sell your personal data. We may share information with third parties only in these circumstances:

Service Providers:
- Meteoblue & Open-Meteo: Location coordinates are sent for weather data and meteograms.
- Google Gemini (AI): Location and weather summaries are processed to generate interpretations. Your Google account identity is never sent.
- Mapbox: For map tiles and geocoding.
- Brevo (formerly Sendinblue): For sending transactional emails.
- Stripe: For processing payments. We do not store your full card details.
Legal Compliance: Where required by law or in response to valid requests by public authorities.
Business Transfers: In connection with a merger, acquisition, financing, or sale of company assets.

5. Data Retention and Security

We retain personal information only for as long as necessary for the purposes set out in this policy. We implement appropriate technical and organizational measures — encrypted transport (HTTPS/TLS), hashed passwords, and restricted server access — to protect your data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

6. Your Rights & Data Deletion (GDPR & CCPA)

Depending on your location, you may have the right to:

Access — request copies of your personal data.
Rectification — request correction of inaccurate information.
Deletion — request erasure of your personal data ("Right to be Forgotten").
Restriction — request that we limit the processing of your data.
Data Portability — request transfer of your data to you or another organization.

To exercise any of these rights, or to request deletion of your account and data, contact info@xcthermal.com. We respond to verified requests within 30 days.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service and remember your session. You can instruct your browser to refuse cookies, but some features (e.g., staying logged in) may not work.

8. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will remove it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last Updated" date. Please review it periodically.

10. Contact Us

If you have questions about this Privacy Policy, contact us by email at info@xcthermal.com.