STORMSYNC

Accurate, not yet final

Privacy notice

Describes the Portal as built on 19 September 2026

Two things are missing, and this says which

The legal operator of StormSync Media and the address for formal data requests are not settled yet, so they are not stated here. Until they are, this document is an accurate description of what the Portal does — not a policy you can serve notice under.

Everything below is true of the site as it stands today and is checkable against the database schema in the repository. The full policy, with retention periods, a data export and the contact route, is built in Phase 39.

What the Portal stores

This is the whole list. If a row is not here, the Portal does not keep it.

Your email address, and a hash of your passwordTo let you sign in and to send you a sign-in link. The password itself is never stored — Supabase Auth keeps a hash, so nobody here can read it, including us.auth.users
Your username, display name, avatar and bioShown wherever you appear to other members. You choose all four, and you can change them.public.profiles
Your role and account statusWhat you are allowed to reach. Enforced in the database itself, not in the page — a broken page cannot hand out access it should not.public.profiles.role, .status
Staff notes, if a moderator writes one about your accountOnly for moderation, and only readable by moderators and above. You cannot read your own, and neither can other members.public.profiles.staff_notes
Your theme, menu, font size and reduced-motion choicesSo the site looks the way you left it on every device. Unset means "follow the site default".public.user_preferences
Locations you save, as a label and a latitude and longitudeFor forecasts and alerts about the places you care about. Stored only when you add one, and stored once so the site does not re-look-up the coordinates on every forecast. Nothing tracks your device location.public.member_locations
A hash of your members-area PIN, plus failed attempt countThe PIN is hashed with scrypt and a secret held only on the server, so the stored value cannot be turned back into your PIN even by someone holding the whole database. The attempt count locks the PIN after five wrong tries.public.member_pins
An audit record of significant actions, with the IP and browser they came fromSign-ins, role changes, moderation and administrative edits. This log is append-only and enforced by database triggers, which means an entry cannot be edited or deleted afterwards — not by an administrator, and not by the site itself.public.audit_log

Who can read it

Every table has Row Level Security turned on, which means the database decides what each request is allowed to see and the answer does not depend on the page asking. You can read your own profile, preferences, locations and nothing of anyone else’s beyond what they have made public. Moderators and above can read what moderation requires. Nobody, at any level, can read a PIN hash through the public interface — that policy denies every row to everyone.

When an administrator acts on your behalf, that is recorded as its own session with a reason, and the audit entry names both the administrator and you.

Where it is stored

In a Postgres database hosted by Supabase in US East (Ohio). Nothing is copied to a second provider.

What is sent to anyone else

There is no analytics, no advertising and no tracking on this site. Fonts are served from the Portal itself, not from Google, so loading a page tells no third party that you did.

The signup form has a slot for a Cloudflare Turnstile challenge, which is not switched on at the moment. While it is off, nothing on the signup form contacts Cloudflare.

Sign-in links and account emails are delivered by Supabase Auth, which needs your address to send them.

Cookies

One set, and only after you sign in: the tokens that keep you signed in. They are refreshed as you move around the site so a session does not expire mid-visit. Signing out clears them. There are no cookies for measurement or advertising, so there is nothing here for a consent banner to ask about.

Deleting your account

Deleting an account removes the profile, preferences, saved locations and PIN hash with it: those rows are tied to the account and go when it does.

Audit entries do not go, and this notice is not going to pretend otherwise. An append-only log that could be emptied on request would be worth nothing as a record. Each entry keeps your account’s identifier and the username you had at the time, because an audit entry that cannot say who did something is not evidence. The identifier stops resolving to anything once the account is gone; the username does not. Entries also keep a before and after snapshot of the row that changed, so where a change touched your profile, that snapshot stays in the log.

There is no self-serve delete button yet. That, and the export that should come with it, is Phase 39 — this notice will not claim one before it exists.

Back to legal