PRE-LAUNCH DRAFT — not effective. Version 1.0 · Prepared 26 October 2026. Effective date: [EFFECTIVE_DATE]. Provider, hosting and retention placeholders must be completed before publication. Planned licensing functions described here are not operational in the development build.
1. Controller and scope
The controller responsible for personal data processed to provide Weast, licensing and support is [PUBLISHER_LEGAL_NAME], [POSTAL_ADDRESS], Poland. Contact: [PRIVACY_EMAIL]. Support: [SUPPORT_EMAIL]. Website: [WEBSITE_URL].
This notice covers the application and our related licensing and support operations. Paddle independently handles purchase-related processing under its Privacy Notice. External map and weather providers also receive requests as explained below. A future website, additional tracking or new services require an updated notice before they are introduced.
2. Local media and data leaving the device
Your original photos, videos, projects, GPX files and media index are handled locally in ordinary operation. We do not automatically upload those originals to our servers. Location names can be resolved using a local GeoNames database. Cached previews, weather and map resources can be stored on your Mac.
Local processing does not mean every operation is offline or anonymous. Map requests reveal an IP address, request time and the requested geographic tiles or view. Weather requests contain geographic coordinates or grid cells and relevant dates, times and weather variables. Such information can reveal where material was recorded. Only use those functions with locations you are authorised to process.
We do not currently use product analytics, automatic crash-report uploads or marketing newsletters. Infrastructure providers may still keep technical access and security logs. Reports or files you voluntarily email to support become part of that correspondence.
Weast Privacy Policy
PRE-LAUNCH DRAFT — not effective. Version 1.0 · Prepared 26 October 2026. Effective date: [EFFECTIVE_DATE]. Provider, hosting and retention placeholders must be completed before publication. Planned licensing functions described here are not operational in the development build.
1. Controller and scope
The controller responsible for personal data processed to provide Weast, licensing and support is [PUBLISHER_LEGAL_NAME], [POSTAL_ADDRESS], Poland. Contact: [PRIVACY_EMAIL]. Support: [SUPPORT_EMAIL]. Website: [WEBSITE_URL].
This notice covers the application and our related licensing and support operations. Paddle independently handles purchase-related processing under its Privacy Notice. External map and weather providers also receive requests as explained below. A future website, additional tracking or new services require an updated notice before they are introduced.
2. Local media and data leaving the device
Your original photos, videos, projects, GPX files and media index are handled locally in ordinary operation. We do not automatically upload those originals to our servers. Location names can be resolved using a local GeoNames database. Cached previews, weather and map resources can be stored on your Mac.
Local processing does not mean every operation is offline or anonymous. Map requests reveal an IP address, request time and the requested geographic tiles or view. Weather requests contain geographic coordinates or grid cells and relevant dates, times and weather variables. Such information can reveal where material was recorded. Only use those functions with locations you are authorised to process.
We do not currently use product analytics, automatic crash-report uploads or marketing newsletters. Infrastructure providers may still keep technical access and security logs. Reports or files you voluntarily email to support become part of that correspondence.
3. Categories, purposes and legal bases
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Local media metadata, locations and project settings | Display your materials and provide requested functions on your device | Performance of the agreement; where an organisational user is not the contracting person, legitimate interests in providing the requested tool |
| Minimal device identifier, trial start/end, activation and entitlement status | Activate the once-per-device trial, validate a licence and prevent duplicate activations | Performance of the agreement for activation and access; legitimate interests for proportionate abuse prevention |
| Licence key or secure identifier, Paddle customer/transaction/subscription references, purchase email, plan, payment/refund status and term dates | Supply and manage paid access and assist with billing | Performance of the agreement; legal obligations where applicable |
| IP address, request time, application version and limited diagnostic/security records | Operate and protect licensing infrastructure | Legitimate interests in security, reliability and abuse prevention |
| Email address, messages and attachments you send | Answer support requests, address complaints and establish or defend claims | Performance of the agreement, legal obligations and legitimate interests, depending on the request |
| Records required by tax, accounting or other law | Meet applicable record-keeping duties | Legal obligation |
We do not receive full card numbers through our normal Paddle integration. Paddle and its payment providers handle payment credentials. We may receive the purchase and status data needed to supply your licence.
The device identifier will use [DEVICE_IDENTIFIER_METHOD]. It is [IDENTIFIER_SCOPE_AND_RESET_BEHAVIOUR]. A pseudonymous or hashed identifier can still be personal data. No specific hardware-identification method should be inferred from this draft.
Where we rely on legitimate interests, we balance those interests against your rights and use proportionate data. Consent will be requested separately if a future optional purpose requires it; accepting this notice is not blanket consent to data processing.
4. Online providers and recipients
| Provider or category | When used and information involved |
|---|---|
| OpenFreeMap | Tiles and related resources; receives IP address and map-resource requests indicating the viewed area |
| Mapterhorn | Elevation/terrain tiles; receives IP address and requested terrain tile coordinates |
| NASA POWER | Weather requests with coordinates or geographic cells, relevant time ranges and variables, plus connection metadata |
| Copernicus Climate Data Store | Only when optional CDS/ERA5 access is configured; receives the configured account credentials and requested weather region/time/variables through that integration |
| Paddle | Purchase, subscription, payment, refund and fraud-prevention processing as an independent controller; shares relevant fulfilment/status records with us |
| [LICENSING_PROVIDER] / [HOSTING_PROVIDER] | Device activation, trial and licence records and necessary security logs; role and hosting region: [PROVIDER_ROLE_AND_REGION] |
| [SUPPORT_EMAIL_PROVIDER] | Support correspondence and voluntarily supplied attachments; role and hosting region: [EMAIL_ROLE_AND_REGION] |
Providers process requests according to their applicable terms and privacy information. We do not send original media to these map and weather providers as part of ordinary requests. This does not prevent a location or date in a request from being personal information.
We disclose data to authorities or professional advisers only where required or justified by law, and to service providers only as needed for their role. We do not sell your personal data. Where a provider processes data on our behalf, appropriate contractual arrangements must be in place.
5. International processing
Requests to external map, weather and payment services can be processed outside Poland or the EEA. Some providers act independently and explain their international processing in their own notices.
For transfers for which we are responsible, the destinations and safeguards are: [TRANSFER_DESTINATIONS_AND_SAFEGUARDS]. Where required, these include an applicable adequacy decision or appropriate contractual safeguards and supplementary measures. Contact [PRIVACY_EMAIL] for information about applicable safeguards and how to obtain a copy. This placeholder must be resolved using the actual provider arrangements, not assumptions about their headquarters.
6. Retention
Local files and projects remain until you remove them. Clearing the application cache removes designated temporary previews, indexes and cached resources; it does not delete your original files, added routes, recent items, settings or licence. Uninstalling may leave application data on the device. Contact support for removal instructions if needed.
Our server-side retention schedule is:
| Record | Retention |
|---|---|
| Active licence and subscription records | [ACTIVE_LICENCE_RETENTION_AND_POST_TERMINATION_PERIOD] |
| Minimal one-trial-per-device record | [TRIAL_RECORD_RETENTION_AND_REVIEW_PERIOD] |
| Security/access logs | [SECURITY_LOG_RETENTION] |
| Support correspondence and attachments | [SUPPORT_RETENTION] |
| Records required by law | For the applicable statutory period; relevant categories and periods: [LEGAL_RECORD_PERIODS] |
Records may be retained longer where necessary for an actual dispute or legal obligation, with access restricted as appropriate. Trial records must be limited to what is necessary; they are not a reason to retain entire device or support histories indefinitely. Paddle applies its own retention rules to purchase records. Clearing local caches does not erase those records or restart a trial.
7. Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. Some records must remain to meet legal obligations or defend claims; we will explain applicable limits.
Send requests to [PRIVACY_EMAIL]. We may request proportionate information to verify identity, without routinely asking for identity documents. We respond within the applicable legal deadline, normally one month under the GDPR, subject to permitted extensions.
You may complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, or another competent supervisory authority. For processing controlled independently by Paddle, you may also exercise rights directly with Paddle.
Licence validation can automatically grant or refuse feature access based on payment and device records. It is not intended to produce legally or similarly significant effects within GDPR Article 22. Contact support to request human review of a disputed access decision.
8. Choices and security
No card or email address is required for the trial. A purchase requires the billing information requested by Paddle. Activation and a minimal device record are necessary for the once-per-device trial and paid access. Without required information, those functions cannot be supplied. You may avoid optional weather requests by not using those features.
We use proportionate technical and organisational safeguards. No system can guarantee absolute security. Keep licence keys private, maintain your own backups and avoid including unnecessary private material in support requests.
9. Changes
We will update this notice when data handling changes and provide additional notice where required. New analytics, marketing, cloud media uploads or materially different recipients require an assessment and an updated notice before introduction.
3. Categories, purposes and legal bases
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Local media metadata, locations and project settings | Display your materials and provide requested functions on your device | Performance of the agreement; where an organisational user is not the contracting person, legitimate interests in providing the requested tool |
| Minimal device identifier, trial start/end, activation and entitlement status | Activate the once-per-device trial, validate a licence and prevent duplicate activations | Performance of the agreement for activation and access; legitimate interests for proportionate abuse prevention |
| Licence key or secure identifier, Paddle customer/transaction/subscription references, purchase email, plan, payment/refund status and term dates | Supply and manage paid access and assist with billing | Performance of the agreement; legal obligations where applicable |
| IP address, request time, application version and limited diagnostic/security records | Operate and protect licensing infrastructure | Legitimate interests in security, reliability and abuse prevention |
| Email address, messages and attachments you send | Answer support requests, address complaints and establish or defend claims | Performance of the agreement, legal obligations and legitimate interests, depending on the request |
| Records required by tax, accounting or other law | Meet applicable record-keeping duties | Legal obligation |
We do not receive full card numbers through our normal Paddle integration. Paddle and its payment providers handle payment credentials. We may receive the purchase and status data needed to supply your licence.
The device identifier will use [DEVICE_IDENTIFIER_METHOD]. It is [IDENTIFIER_SCOPE_AND_RESET_BEHAVIOUR]. A pseudonymous or hashed identifier can still be personal data. No specific hardware-identification method should be inferred from this draft.
Where we rely on legitimate interests, we balance those interests against your rights and use proportionate data. Consent will be requested separately if a future optional purpose requires it; accepting this notice is not blanket consent to data processing.
4. Online providers and recipients
| Provider or category | When used and information involved |
|---|---|
| OpenFreeMap | Tiles and related resources; receives IP address and map-resource requests indicating the viewed area |
| Mapterhorn | Elevation/terrain tiles; receives IP address and requested terrain tile coordinates |
| NASA POWER | Weather requests with coordinates or geographic cells, relevant time ranges and variables, plus connection metadata |
| Copernicus Climate Data Store | Only when optional CDS/ERA5 access is configured; receives the configured account credentials and requested weather region/time/variables through that integration |
| Paddle | Purchase, subscription, payment, refund and fraud-prevention processing as an independent controller; shares relevant fulfilment/status records with us |
| [LICENSING_PROVIDER] / [HOSTING_PROVIDER] | Device activation, trial and licence records and necessary security logs; role and hosting region: [PROVIDER_ROLE_AND_REGION] |
| [SUPPORT_EMAIL_PROVIDER] | Support correspondence and voluntarily supplied attachments; role and hosting region: [EMAIL_ROLE_AND_REGION] |
Providers process requests according to their applicable terms and privacy information. We do not send original media to these map and weather providers as part of ordinary requests. This does not prevent a location or date in a request from being personal information.
We disclose data to authorities or professional advisers only where required or justified by law, and to service providers only as needed for their role. We do not sell your personal data. Where a provider processes data on our behalf, appropriate contractual arrangements must be in place.
5. International processing
Requests to external map, weather and payment services can be processed outside Poland or the EEA. Some providers act independently and explain their international processing in their own notices.
For transfers for which we are responsible, the destinations and safeguards are: [TRANSFER_DESTINATIONS_AND_SAFEGUARDS]. Where required, these include an applicable adequacy decision or appropriate contractual safeguards and supplementary measures. Contact [PRIVACY_EMAIL] for information about applicable safeguards and how to obtain a copy. This placeholder must be resolved using the actual provider arrangements, not assumptions about their headquarters.
6. Retention
Local files and projects remain until you remove them. Clearing the application cache removes designated temporary previews, indexes and cached resources; it does not delete your original files, added routes, recent items, settings or licence. Uninstalling may leave application data on the device. Contact support for removal instructions if needed.
Our server-side retention schedule is:
| Record | Retention |
|---|---|
| Active licence and subscription records | [ACTIVE_LICENCE_RETENTION_AND_POST_TERMINATION_PERIOD] |
| Minimal one-trial-per-device record | [TRIAL_RECORD_RETENTION_AND_REVIEW_PERIOD] |
| Security/access logs | [SECURITY_LOG_RETENTION] |
| Support correspondence and attachments | [SUPPORT_RETENTION] |
| Records required by law | For the applicable statutory period; relevant categories and periods: [LEGAL_RECORD_PERIODS] |
Records may be retained longer where necessary for an actual dispute or legal obligation, with access restricted as appropriate. Trial records must be limited to what is necessary; they are not a reason to retain entire device or support histories indefinitely. Paddle applies its own retention rules to purchase records. Clearing local caches does not erase those records or restart a trial.
7. Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. Some records must remain to meet legal obligations or defend claims; we will explain applicable limits.
Send requests to [PRIVACY_EMAIL]. We may request proportionate information to verify identity, without routinely asking for identity documents. We respond within the applicable legal deadline, normally one month under the GDPR, subject to permitted extensions.
You may complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, or another competent supervisory authority. For processing controlled independently by Paddle, you may also exercise rights directly with Paddle.
Licence validation can automatically grant or refuse feature access based on payment and device records. It is not intended to produce legally or similarly significant effects within GDPR Article 22. Contact support to request human review of a disputed access decision.
8. Choices and security
No card or email address is required for the trial. A purchase requires the billing information requested by Paddle. Activation and a minimal device record are necessary for the once-per-device trial and paid access. Without required information, those functions cannot be supplied. You may avoid optional weather requests by not using those features.
We use proportionate technical and organisational safeguards. No system can guarantee absolute security. Keep licence keys private, maintain your own backups and avoid including unnecessary private material in support requests.
9. Changes
We will update this notice when data handling changes and provide additional notice where required. New analytics, marketing, cloud media uploads or materially different recipients require an assessment and an updated notice before introduction.
