Your weather. Your privacy.

Who we are and what this covers

Kevin Fleming publishes Dreadcast and operates its weather service (“we,” “us”). Contact kevin@dreadcast.app about privacy. This policy covers the Dreadcast app on iPhone, iPad, and Mac, the dreadcast.app website, and Dreadcast’s online services: the weather API at api.dreadcast.app and the content-delivery network that serves our radar images. The separate open-source Dreadcast CLI has its own privacy documentation.

Summary

• No Dreadcast app account is required. We do not use advertising identifiers, behavioral analytics, or cross-app tracking.
• We do not sell personal information or share it for targeted advertising.
• Display preferences and notification history stay on your device. The selected weather location is sent as needed to answer weather requests.
• Current Location is optional. The app rounds device coordinates to two decimal places before saving them or using them in requests.
• Current conditions, forecasts, and radar come from Dreadcast’s own service. For weather, it receives your rounded coordinates, IP address, and normal request information. Radar requests contain no location. We cache weather by approximate place, never by person, and keep request logs only briefly, without coordinates.
• No account does not mean no personal data. IP addresses and approximate locations can still be personal information.

Location and your choices

You can enter a US ZIP code, choose Current Location, or choose Skip for now to use New York City without granting device-location access. A ZIP lookup sends the ZIP to a location provider and uses its center for weather. If you choose Current Location, your device asks for permission; the app rounds the returned device coordinate to two decimal places (roughly 1 km, varying by latitude) before geocoding, persistence, or weather requests. On iPhone and iPad, Dreadcast asks for location access only while you use the app and never finds your location in the background.

Weather requests to api.dreadcast.app use a latitude and longitude rounded to two decimal places, and the server keeps that precision. We use these coordinates to find weather, not to build a movement history. A viewed map area or tile address can also reveal an approximate area of interest, which may differ from your actual location.

Switch to ZIP mode, or revoke permission in Privacy & Security → Location Services (in the Settings app on iPhone and iPad, or System Settings on Mac), to stop device-location access. ZIP mode still makes network requests for the selected place. The app does not ask you for a street address.

Information stored on your device

The app stores the following in its sandboxed preferences on your iPhone, iPad, or Mac:

• Your location choice, ZIP code, and the most recent rounded coordinate and city/state label
• Display and map preferences, such as temperature unit, radar range and opacity, enabled layers, saved map views, themes, and palettes
• Assistant connection and permission settings, on Mac
• Notification settings, plus identifiers and dates of recently delivered alerts so you are not notified twice

Weather responses and map images may also be cached temporarily in memory or by the operating system. We do not upload your settings or notification history as a user profile. Requests do include the selected location and options needed to return weather. Our Data Retention Policy explains how long each item is kept and how to remove it.

Our weather service: api.dreadcast.app

Dreadcast runs its own service to provide licensed weather data, share one cached reading among everyone asking about the same place, and turn raw radar scans into map images. It provides:

• Current conditions and forecasts. The app sends the selected latitude and longitude, rounded to two decimal places (about 1 km), plus your temperature and wind units. The service also receives your IP address, the time, and standard technical details about the request, as any web server does.
• Radar. While the Dreadcast map is showing, the app periodically asks for the latest radar loop. That request contains no location. Radar images then load from our content-delivery network, which receives your IP address and the addresses of the map tiles you view, and so the approximate area you are looking at.

We use this information only to return weather and radar, keep the service reliable and affordable, diagnose problems, and prevent abuse. The service has no accounts and sets no cookies. It never receives your name, email, contacts, notification history, device identifiers, or Apple payment details.

Weather caches. Readings are cached by rounded coordinate so that everyone asking about the same place shares one result. Cache entries are not linked to an IP address, device, or person, and they are deleted automatically once out of date, as described in our Data Retention Policy.

Request logs and rate limits. Our logs filter out coordinates, so a log line never pairs a place with an IP address. Logs may contain IP addresses, request details, and times, and are deleted automatically after a limited period. To prevent abuse, short-lived rate-limit counters use a pseudonymized form of your IP address rather than the address itself, and we still treat it as personal information.

Install tokens. The open-source Dreadcast CLI asks our service for an install token the first time it uses it and sends it with its requests, so its rate limits count per installation instead of per network. The token is a random number our service creates; it contains nothing about you or your device. We keep only a fingerprint of it, which kind of client asked for it, when, and the last day it was used, not your IP address, location, or requests. When an installation goes over its rate limit, the log line names it so we can stop abuse. We delete installations unused for a year, and turning the token off in the CLI deletes it. The Dreadcast app doesn’t use install tokens.

Data sources behind the service. When a fresh forecast is needed, our service sends Open-Meteo the rounded coordinate and the requested weather fields. The request comes from our service, not your device, so Open-Meteo does not receive your IP address. Radar is built from public NOAA and EUMETNET data that our service downloads; no information about you is sent to them.

Services the app contacts

Which services the app contacts depends on the layers and notifications you turn on and the map you view. Direct connections reveal your IP address and normal connection information to that provider.

Scroll the table sideways on smaller screens to read all columns. Keyboard users can focus the table area and use the arrow keys.

Our weather service and content-delivery network run on infrastructure providers in the United States. They process data only on our behalf, to deliver and secure our services, and we require them to protect it consistently with this policy.

Independent weather and platform services operate under their own terms and privacy policies. We send each one only what it needs to answer the request, and we require every third party that receives personal information through Dreadcast to provide protection at least equivalent to this policy and applicable App Store requirements. A provider’s separate policy does not remove our responsibility for data we disclose. See Open-Meteo’s terms and privacy information, Apple’s privacy policy, and Data & Sources.

AI assistants and automations

In the Mac app, you can let AI assistants (such as Claude), Siri, Shortcuts, and dreadcast:// links read what Dreadcast shows and change the map. Dreadcast runs no AI model and sends nothing to an AI service itself. When an assistant asks for conditions, forecasts, alerts, events, or saved view names, Dreadcast gives that information to the assistant on your Mac, and the assistant’s service handles it under its own privacy terms. Locations are shared only at Dreadcast’s two-decimal precision.

Assistant connections start off. You turn them on, and choose what assistants may do, in Settings → Assistants. Changing your weather location or notification settings always asks for your confirmation in Dreadcast. Assistants cannot see purchases or provider settings, and the activity list of recent assistant changes stays in memory on your Mac and clears when Dreadcast quits.

Notifications

Weather notifications are off until you turn them on. While Dreadcast is running, it checks the alert, wildfire, and tropical-storm services above and asks your device’s Notification Center to display matching alerts. On iPhone and iPad, it also checks when iOS allows a background refresh, making the same requests for your saved location. There is no Dreadcast push-notification server, and the app’s notification history stays on your device.

Purchases

Dreadcast Pro is an App Store subscription. Apple processes the purchase and manages your subscription. Dreadcast checks your verified subscription status on your device and sends no purchase information to api.dreadcast.app or anyone else. We never receive your Apple Account credentials or payment details. Apple’s practices are described in the Apple Privacy Policy.

The website

The website does not use cookies, advertising, or third-party tracking scripts, and it does not ask for personal information.

Analytics. To learn how people find and use the site, its pages use Ahoy, an open-source analytics tool that reports to our own service rather than to an analytics company. When a page opens, it sends our service the page’s address, the address of the site that linked to it (not the page), any campaign tags in the link, your screen size, and the time zone your device is set to. As you use the page, it sends each page you view, the text and address of links and buttons you click, how far down the page you scroll, and the outlook themes and radar looks you choose. Our service also receives your IP address and browser details, as with any request. From these it records those page views and actions, the linking site, campaign tags, the device type and screen size, browser and operating system names, and a country worked out from the time zone. To group a visit’s pages and count a visitor once a day without a cookie, it combines your IP address and browser details with a random value that changes every day, keeps only the resulting code, and deletes each day’s random value shortly after the day ends, so the code can’t be traced back to you afterward. It doesn’t store your IP address or browser details, set cookies, follow you across days or other sites, or share analytics with anyone. Analytics records are deleted automatically after two years. To stop your browser being counted, open any page with ?count=off added to its address (for example, dreadcast.app/?count=off); ?count=on starts counting again.

Like most websites, our hosting provider automatically records server logs—IP address, browser type, page requested, and time—to deliver the site and protect it from abuse. Maps on the site load tiles from OpenFreeMap, which receives your IP address and the map areas shown. Pages that show live weather read current events, radar and temperatures from copies this site makes of our weather service’s data every minute, and load radar images from the service’s content-delivery network, which receives your IP address. If a copy is out of date, the page reads it from our weather service at api.dreadcast.app instead, which then receives your IP address too. These requests carry only the places shown on the page, never your location.

When you contact us

If you email us, we receive your email address and whatever you include in your message. We use it only to respond to you and to improve Dreadcast, and we do not add you to a mailing list or share your message with anyone except our email provider, which stores it on our behalf.

Retention and deletion

Settings on your device remain until you change or remove them. On our service, weather caches, rate-limit counters, and request logs are short-lived: we keep them only as long as needed to serve weather, prevent abuse, and fix problems, then delete them automatically. The Data Retention Policy has details, website and support retention, and how to request deletion. Quitting or deleting the app stops future requests; existing server records then expire on their own.

Your choices and rights

• Change or remove settings in Dreadcast Settings at any time.
• Withdraw location consent by switching to ZIP mode or turning off Location Services for Dreadcast in the Settings app on iPhone and iPad or System Settings on Mac.
• Stop notifications in Dreadcast Settings, or under Notifications in the Settings app on iPhone and iPad or System Settings on Mac.
• Delete all app data by following the steps in our Data Retention Policy.
• Ask about information we hold—such as support emails—or ask us to access, correct, or delete it, by emailing kevin@dreadcast.app. We respond within 30 days.

Depending on where you live, including California and the European Economic Area, United Kingdom, and Switzerland, you may have additional rights to access, correct, delete, or port your personal information, to object to or restrict processing, and to complain to your local data-protection authority. We honor these requests for information we control and will not treat you differently for making one. We have no app account directory. We may need limited information to locate a support message or request log, and some shared weather records cannot be attributed to an individual. We do not ask you to send precise location history or credentials to exercise your rights. Records held independently by Apple or other providers are subject to their own request procedures.

Where EU or UK law applies, we process requests to our servers to provide the features you ask for, server logs based on our legitimate interest in keeping the service secure and reliable, website analytics based on our legitimate interest in understanding how people find and use the site, and support emails based on our legitimate interest in answering you.

Children

Dreadcast is a general-audience weather app and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, email us and we will delete it.

Security

The app and our services use encrypted HTTPS connections. The app runs in Apple’s app sandbox on iPhone, iPad, and Mac and rounds location before using it. Access to our systems and logs is restricted to the people and providers who need it to run the service, and we keep only what the service needs. No transmission or storage system is completely secure.

International processing

Kevin Fleming operates Dreadcast from the United States. Hosting, support, Apple, and weather providers may process information in the United States and other countries where they operate. Where the law requires safeguards for an international transfer, we require an appropriate lawful transfer mechanism. Using Dreadcast is not a waiver of your privacy rights.

Changes to this policy

If we change how Dreadcast handles information, we will update this page and its effective date, and update the app’s App Store privacy details before the change takes effect. Material changes will also be noted in the app’s release notes.

Contact

Kevin Fleming, publisher of Dreadcast
kevin@dreadcast.app