Sign up

Last updated: 15 September 2026

This is a convenience translation; the German version is legally binding.

1. Controller

2. General information on data processing

As a matter of principle, we process our users' personal data only to the extent that this is necessary in order to provide a functioning website together with our content and services. The legal bases are Art. 6(1)(a) GDPR (consent), (b) (performance of a contract / the user relationship) and (f) (legitimate interests). The applicable legal basis is stated for each individual processing operation.

3. Hosting

This website is operated on servers of our hosting provider in Germany (netzliving). A data processing agreement pursuant to Art. 28 GDPR is in place with that provider. Legal basis: Art. 6(1)(f) GDPR (secure and efficient operation of the website).

4. Server log data

When the website is accessed, information transmitted by your browser is recorded automatically: IP address, date and time, the page requested, browser type and version, operating system, referrer URL. This data serves to ensure operation, to analyse errors and to fend off attacks, and it is deleted automatically after a short time. In addition, we log sign-ins to and sign-outs from the user account (time, IP address) in order to detect misuse and attacks. Legal basis: Art. 6(1)(f) GDPR.

Page counter. We count page views exclusively as aggregate totals, separated according to whether the view took place with or without a user account. Only these two figures are stored — no IP address, no identifier, no time of the individual view, no time series and no log. No personal reference arises in the process; this is neither an audience measurement nor profiling, and there is nothing to evaluate that could be attributed to a person. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in simple information about how the portal is used).

5. Registration and user account

When you register, we process:

• user name, e-mail address, password (stored only as a cryptographic hash)
• first and last name
• telephone number (country dialling code from a selection list and the remaining number) — mandatory
• confirmation status of the e-mail address (double opt-in procedure)
• language setting, role, team membership
• voluntary profile details (e. g. avatar, team name)

This processing takes place in order to provide the members' area (Art. 6(1)(b) GDPR). The language of the interface is derived from the language setting of your browser (transmission of the Accept-Language header, which is sent with every page request in any case; no location determination and no transfer to third parties takes place). You can change the selected language yourself at any time.

Telephone number. Providing a telephone number is mandatory at registration. It consists of two parts: the country dialling code, which you select from a list, and the remaining number, which you type in. The number serves as the second factor for your account, that is, to secure the sign-in; the one-time codes required for this are currently sent exclusively by e-mail to your confirmed account address — no SMS is sent. The number is stored uniformly in international notation without separators (for example “+491701234567”). It is not displayed publicly anywhere: it appears neither on your profile page nor on your team page nor anywhere else in the portal, and in the interface as well as in e-mails we reproduce it only in masked form (for example “+49•••067”). You can change the number yourself at any time in the settings of your account; the change is made in two steps — it requires you to enter your current password and only takes effect once you have confirmed a code that we send to your confirmed account e-mail address. After a change, a further change is blocked for 30 days. Legal basis: Art. 6(1)(b) GDPR (user relationship, secure sign-in).

Authenticator app (two-factor sign-in). Instead of the one-time code by e-mail, you can run the second factor of your account through an authenticator app on your own device (for example Google Authenticator, Authy, Microsoft Authenticator or 1Password). For this, a secret key is stored in encrypted form in your account; from it, your app and our server each calculate the same six-digit code. In addition, we store eight backup codes for the case that you no longer have access to the app — these we store exclusively as a hash and never in plain text. Both serve solely to verify your sign-in. No transfer to third parties takes place: the app runs locally on your device, nothing is sent or retrieved for it. We delete the key and the backup codes completely as soon as you switch the app off again in your settings or delete your account. Switching it on and off requires your password, and switching it off additionally requires a valid code from the app or a backup code. We inform you about switching it on and off by e-mail to your confirmed account address. Legal basis: Art. 6(1)(b) GDPR (user relationship, secure sign-in).

Deleting your account (Art. 17 GDPR). You can delete your account yourself at any time — in the settings of your account (“Settings” area in the dashboard). The deletion takes effect immediately and without any enquiry on our part; for safety, your password (or, if you sign in via an external provider, your user name) and an express confirmation must be entered. Deleted in the process are your user account with all master data including the telephone number, your settings, stored sessions, trusted devices and sign-in logs, your live position and the associated tracking device, your dispatch log, your notifications, chat messages, friendships, team memberships and invitations, your shopping cart, your support tickets including their history and image attachments, your applications, your rating of the portal as well as your photos including the image files, albums, comments and “like” entries.

What is retained is, on the one hand, editorial content that carries the portal — for instance blog posts, published forecasts or a team you founded: there the text remains, but the reference to your account is removed, so that only “Deleted account” or no name at all appears at that point. On the other hand, reports and moderation decisions are retained as evidence, likewise without any reference to your account (Art. 6(1)(c) and (f) GDPR in conjunction with the Digital Services Act); the reported content itself is not stored there in any case. Invoices, orders and downloads are retained on account of commercial and tax retention obligations (Section 147 AO, Section 257 HGB); Art. 17(3)(b) GDPR exempts this case from the right to erasure. Images already sold remain retrievable for the same reason. Accounts with editorial rights (administration, moderation, forecasting) cannot delete themselves; the role must be relinquished first. Irrespective of this, you can of course continue to request erasure informally by message to info@weatherhunters.de.

Activity points and badges. From your use of the portal we derive a personal score and, from that, a badge (e. g. “Spotter”, “Stormchaser”). These points are not stored separately and are not written along with every action; instead they are calculated from information already present each time a profile is opened — for instance the number of your photos that are not blocked and the “likes” they have received, founding a team and team membership, live tracking that has been set up, having your own profile picture and social media channels on file. There is deliberately no leaderboard and no comparison with others. Visible to third parties is only the badge on your profile page; the breakdown of what the points are made up of is seen only by you on your own profile. Since nothing is stored separately, the score adjusts itself as soon as you change or delete the underlying content. Legal basis: Art. 6(1)(b) GDPR (user relationship).

Friends. Members can send each other friend requests, accept them, decline them or end an existing friendship. For this purpose we store the two linked accounts, who made the request, the status (requested or confirmed) and the times. Among other things, confirmed friendships govern who may see your live position at the visibility level “friends only” (see section 7). Who is friends with whom is not public: the friends list of a profile is visible only to signed-in members, not to visitors without an account. You can end a friendship or withdraw a request that is still pending at any time; if your account is deleted, all your friendship links are removed. Legal basis: Art. 6(1)(b) GDPR (user relationship).

Presence (“online”). So that members can recognise who is currently active, we store the time of your last activity in the portal and derive from it a presence dot on your profile picture — it counts as “online” as long as the last activity was less than five minutes ago. This dot is visible in the same places as your profile picture, that is, also in the publicly accessible photo feed and on your profile page. In addition, we add up the total time spent while signed in; this total duration is shown exclusively to the administration and is neither public nor visible on your profile. Legal basis: Art. 6(1)(b) GDPR (user relationship).

6. Cookies, local storage and your consent

Technically necessary cookies are set without consent; without them, sign-in and forms do not work (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR):

• Session cookie (PHPSESSID) — sign-in status; ends when the browser is closed, on the server side after 24 hours of inactivity at the latest
• CSRF token — a random value held in the session that protects forms against submissions smuggled in from other sites
• Login cookie (“Stay signed in”, only if you tick it) — valid for up to 30 days, the token is renewed on each use and deleted on sign-out
• Device cookie (wh_trust) — only with two-factor sign-in enabled: it remembers that you have already entered the security code on this device, so that it is not requested again at every sign-in. The confirmation is valid for 90 days; after that, a code is requested once more on this device. The cookie itself remains in the browser for up to 400 days so that we can recognise your device afterwards and renew the same entry instead of creating a second one. It contains only a random value with no information about your person.
• List of your trusted devices — for every device confirmed in this way we store on our server a check value of the random value (not the value itself), the times of the first and the last confirmation, the time of the last sign-in as well as the device and browser designation reported by your browser, so that you can tell your devices apart. These entries remain until you change your password (then all of them are deleted), delete your account, or a device has not been used for a year. Legal basis: Art. 6(1)(f) GDPR (secure sign-in without unnecessary hurdles).
• Language cookie (wh_lang) — remembers your choice of language
• Consent cookie (wh_consent) — records how you decided below; valid for 365 days, contains only two yes/no entries and no identifier of your person

Convenience storage (consent). Only with your agreement does your browser remember locally in localStorage which radar layers you had switched on, how opaque they should be and which notices you have dismissed. This information does not leave your device and is not read out by us. If you withdraw your agreement, the stored values are deleted. Legal basis: Section 25(1) TDDDG, Art. 6(1)(a) GDPR.

Google fonts (consent). The typefaces “Outfit” and “Bebas Neue” are loaded from fonts.googleapis.com and fonts.gstatic.com. In doing so, your browser transmits your IP address to Google (Google Ireland Limited or Google LLC, USA). This happens only if you have expressly agreed — without your agreement the server delivers the pages without this embedding and your device uses the fonts of your operating system. Legal basis: Section 25(1) TDDDG, Art. 6(1)(a) GDPR; the transfer to the USA is based on the standard contractual clauses and on the adequacy decision regarding the EU-US Data Privacy Framework.

What there is not here: no analytics or statistics services, no advertising networks, no profiling, no social media plug-ins.

Giving, changing and withdrawing consent. On your first visit a notice window asks for your decision; as long as you have not decided, neither the convenience storage nor the Google fonts are used. You can change or fully withdraw your choice at any time via the link “Cookie settings” in the footer of every page (on the radar map in the header bar next to “Legend”) — with effect for the future (Art. 7(3) GDPR).

7. Live GPS tracking (voluntary)

Members may voluntarily transmit their live position in order to be shown as active spotters on the radar map. At the visibility level “everyone” the position can be seen on the publicly accessible radar map — including by visitors without an account. Processed are: location coordinates, time stamp, speed and, optionally, device data of the tracking app (e. g. battery level, altitude, course).

• Tracking is switched off by default and is used only after it has been expressly activated in the settings (consent, Art. 6(1)(a) GDPR).
• The visibility of your own position can be configured: everyone (public, also without signing in), friends only, my team only, or hidden. The levels “friends only” and “team only” are visible exclusively to authorised signed-in members.
• Home zone: you can store a home address of your own. Positions that lie within a radius of 5 kilometres around that point are not stored in the first place and consequently are not displayed either — the check already takes place when the report is received, so that no coordinate and no entry arises for such positions. On the map you then continue to appear at your last position outside the zone, and as offline.
• For each member, only the most recent position transmitted is stored; every new report overwrites the previous one. No movement history arises in the process.
• This last position appears on the map; if no new report arrives for more than 10 minutes, it is marked as “offline / last seen”. In the live views (position list, proximity search) a position appears only as long as it is less than 60 minutes old.
• An automatic clean-up run removes the stored position every hour as soon as the last report is more than 24 hours old; after that the entry disappears completely from the map and the list. The same happens immediately if you switch tracking off or delete your account.
• Consent can be withdrawn at any time by deactivating tracking.

Stream overlay. Members who broadcast their chases live can generate a secret link in the settings. This link shows a page of its own on which the member's own live position is displayed without signing in on a map with a radar image; it is intended to be shown within the member's own stream (e. g. on Twitch or YouTube). With it, the member deliberately makes their position accessible to everyone who knows the link or watches the stream — also without an account and irrespective of the visibility level otherwise selected. The link can be deleted or regenerated by the member at any time; the previous link then immediately becomes invalid and subsequently no longer shows any position. Without active live tracking, the overlay shows no position in any case. No data beyond that already named in this section is processed. The legal basis is your consent, which you give by generating and using the link (Art. 6(1)(a) GDPR); withdrawal with effect for the future takes place by deleting the link (Art. 7(3) GDPR).

8. Photo uploads and photo spots

Uploaded photos may contain location details, date taken, a description and the name of the team, and — depending on the visibility chosen — are shown to other members in the portal (photo archive, radar map, profile and team pages). Visibility can be controlled per photo; uploads are voluntary (Art. 6(1)(a) GDPR). Please do not upload photos on which third parties are identifiable without their agreement. Photos can be deleted at any time.

Publicly accessible profile and team pages: your profile page and the page of your team can be retrieved without signing in and may be indexed by search engines. Publicly visible are the user name, profile picture, team membership, linked social media accounts as well as those photos that you yourself have released for the profile or the team page. E-mail address and telephone number are not displayed there. Which photos appear there continues to be controlled by you at any time via the switches “show on profile” and “show on team page” on the respective photo. The member and team overviews as well as all other areas of the portal remain reserved for signed-in members.

Example images of weather and sky phenomena: photos that are publicly visible may additionally be shown within the portal as an example image illustrating the phenomenon they are tagged with — in the guidance during upload and in the knowledge area (knowledge base of sky phenomena). Only the preview image, the title and your user name as the author are shown; every example image is linked to the original post. The legal basis is our legitimate interest in comprehensible, illustrated weather knowledge for the community (Art. 6(1)(f) GDPR). You can object to this use at any time — by restricting the visibility of the photo concerned or deleting it, or informally via support. Photos that are not publicly visible or that are blocked are not drawn upon there as a matter of principle.

Likes (“heart”) on photos. Signed-in members can mark photos in the photo feed with a heart. Only which photo was marked by which account, and the time, are stored. The person who took the photograph is notified of a new heart. The number of hearts and the name of the person who most recently marked the photo appear as a line beneath the photo (“Liked by … and N others”) — and, like the photo feed itself, also for visitors without an account. The complete list of everyone who likes a photo, by contrast, is accessible only to signed-in members. You can take back a heart at any time by clicking it again; if your account is deleted, all your “like” entries are removed. The same applies to hearts on individual comments: there, too, we store only which comment was marked by which account and when; the person who wrote it is notified of the first heart, and the list of everyone who marked it is seen only by signed-in members. Legal basis: Art. 6(1)(b) GDPR (user relationship).

Views of a photo. So that photographing members can see whether their images are looked at at all, we count two figures per photo and calendar day: how often it was opened in the enlarged view without an account and how often with an account. Only these counts are stored — no IP address, no time of the individual view, no user account, no referring page and no device. No personal reference arises in the process; nobody can be recognised from such a row. The same person counts at most once per session and photo in 30 minutes; for this, only your own session remembers which images it last opened (the value expires with the session and is not stored anywhere). Search engines and preview robots are not counted, nor is the photographer themselves. The figures are seen only by the photographer; they do not appear publicly anywhere. When a photo or your account is deleted, the associated counters are deleted with it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in simple information on reach without user profiles).

9. Comments, reports and support

Signed-in members can write comments beneath the photos in the photo feed. Stored in the process are the text of the comment, the time and the user account that wrote it. Comments — like the photos they stand beneath — can also be read without signing in and may be indexed by search engines. Please do not write there any information about yourself or third parties that is not intended to be public. A comment can be replied to; a reply is stored together with the comment it refers to, and the person who commented is notified of the reply. If another member is mentioned in a comment with “@username”, that member likewise receives a notification; the mention is part of the publicly readable comment text. When a comment is deleted, the replies to it are removed as well. Legal basis: Art. 6(1)(b) GDPR (user relationship).

Deletion: you can delete your own comments yourself at any time — via the wastebasket symbol on the comment. The photographer of the respective image as well as our moderation team can also delete them. On deletion the text of the comment is actually removed; only the time of the deletion and who carried it out remain stored. This residual entry serves as evidence of our moderation decisions towards users and authorities (Art. 6(1)(c) and (f) GDPR in conjunction with the Digital Services Act).

Reports: photos and comments can be reported by signed-in members if they appear unlawful or inappropriate (notice and action procedure under Art. 16 DSA). For a report we store: which content was reported (type and identifier, not its text), the reason for the report selected, a voluntary note, the reporting user account, the time as well as our decision including the person who handled it and the time. The requirement to be signed in serves to prevent abusive reports (Art. 23 DSA); without an account you can reach us informally at info@weatherhunters.de. Reports are also kept after they have been handled so that it remains traceable how a notice was dealt with; legal basis: Art. 6(1)(c) and (f) GDPR (fulfilment of our obligations under the Digital Services Act, protection of users against unlawful content).

You can contact info@weatherhunters.de informally to object to the removal of your own content; we will then review the decision again.

Support and tickets. Signed-in members can send us enquiries via the support form and via the feedback button in the portal. Such a matter is handled as a ticket. Stored for this purpose are: the subject, the texts of all messages in the history, the area of the portal you selected (for instance account, image archive, radar, live tracking) and the urgency selected, the statement whether the problem is blocking you, your user account, the times of the messages as well as the processing status. With the feedback button, the page you were on is added, together with technical details of your browser for troubleshooting; the area is derived from the address of the page instead of asking you for it. You may voluntarily attach an image to every message; image attachments are re-encoded by us — in the process embedded additional information such as the place the photo was taken and camera data is lost — and are stored outside the publicly accessible area, so that they are only accessible via the ticket history.

We inform you by e-mail about a new ticket and about every reply; for a new ticket you additionally receive an automatic acknowledgement of receipt, which at the same time stands as the first message in the history. We send and answer these e-mails from the address support@weatherhunters.de, so that you can reply directly. A ticket can be viewed by you alone — in your account under “Support” — and by our administration; it is not accessible to other members or to visitors without an account, and it is not displayed publicly either. Tickets remain stored with their history until our administration deletes them; at the latest when your account is deleted, your tickets including messages and image attachments are removed in full. The legal basis is Art. 6(1)(b) GDPR (handling your enquiry within the user relationship), and, as regards keeping the matter on file as evidence of how it was handled, Art. 6(1)(f) GDPR.

Rating of the portal. Once your account has reached more than five hours of actual usage time in total, we ask you up to three times (after a further five hours of use each time, if you close the window) for a rating. Stored in the process are: the mark of one to five stars you award, a text written by you voluntarily, the state of your accumulated usage time at the moment of submission, the page of the portal on which you submitted the rating, and the time. If you close the window without rating, we remember the number of dismissals, your usage time and the time of the dismissal — solely in order not to ask you again before a further five hours have passed, and not to ask you at all after the third time. The purpose is exclusively the improvement of the portal; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in the further development of our offering). The rating can be viewed only by our administration, is not displayed publicly and is not passed on to third parties. It is stored until your account is deleted and is removed in full together with it.

Chat and messages

Registered members can write messages to one another within the portal. A conversation comes about in three ways: as a direct message between two members, as a team chat that we create automatically for every team, and as a conversation about an application or an invitation, in which the applicant and the team management settle open questions and record the decision. You can write directly to members you are friends with or share a team with; everyone else first receives a request that the recipient can accept or decline.

Stored in the process are: the text of your messages, the writing user account, the time, the members of the respective conversation, when you last read a conversation, whether you have muted it, your block list as well as reports about messages. The purpose is communication between members, the organisation of the teams and the conduct of application conversations. The legal basis is Art. 6(1)(b) GDPR (the user relationship); for blocking, reporting and dealing with abuse additionally Art. 6(1)(f) GDPR (protecting members from harassment).

Who can read a message: exclusively the participants of the conversation — in a direct message therefore only you and your counterpart, in a team chat all members of the team, in a conversation about an application the applicant and the team management. Messages are not public, do not appear on the profile and are not indexed by search engines. If you report a message, our support team sees the reported message together with the surrounding messages as context, in order to be able to assess the matter. We do not pass messages on to third parties.

Image attachments and locations. You can attach an image to a conversation; we store it on our server outside the publicly reachable area, remove the image’s embedded metadata in the process (EXIF, that is among other things the place and time of capture and the device), and hand it out exclusively to the participants of that same conversation — with every retrieval we check individually whether the person retrieving belongs to the conversation. You can likewise share your location; this happens only upon your explicit action, and what is stored then are the coordinates, the stated accuracy and a place label if you send one along. The same deletion rules apply to both as to the message itself: they disappear when you withdraw it within 15 minutes, automatically after 12 months at the latest, and in any case when your account is deleted.

Encryption. The transmission between your device and the portal is encrypted with TLS. There is no end-to-end encryption: the messages reside on our server in Germany (on hosting see section 3) and are technically readable by our administration. Please therefore do not write any secrets in the chat and no special categories of personal data (health data, for instance) — neither about yourself nor about third parties.

Retention. Messages are kept for 12 months and are deleted automatically thereafter. You can delete a message of your own yourself within 15 minutes of sending it. If your account is deleted, your own messages are removed in full and your direct conversations are deleted.

Blocking, reporting, notifications. You can block individual members; their messages no longer reach you after that, and no new conversation comes about. What is stored for this is whom you have blocked and since when. We inform you about new messages within the portal; the notification names the conversation but not the content of the message.

Push notifications (app)

The Weather Hunters app can inform you about new messages and notifications even when it is not currently open. Technically this runs through Google Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). What is transmitted is the device address that Google has assigned to your app installation (the registration token) together with the content of the notification — for a chat message, therefore, the sender's name and the message text shortened to 120 characters.

This only happens after you have confirmed your device's prompt ("allow notifications"). The legal basis is your consent (Art. 6(1)(a) GDPR) and, insofar as the notifications serve the use of your account, Art. 6(1)(b) GDPR. You can switch the notifications off at any time — in the app's settings or in your device's system settings. The registration token is then deleted here; it likewise falls away when you log out in the app or revoke the device in the device list. The dispatched notification itself is kept for the delivery attempt for at most seven days.

10. Map and weather services (third parties)

In order to display the maps and weather data, your browser loads content from third-party providers. For technical reasons your IP address is transmitted to the respective provider in the process (legal basis: Art. 6(1)(f) GDPR — a functioning display of the weather maps; some of the providers are established outside the EU):

• Map tiles: OpenStreetMap/CARTO, Esri, OpenTopoMap, Google (map styles “Google streets/satellite”) — also as the ground map of the 3D cell view
• Weather data: Deutscher Wetterdienst (maps.dwd.de, opendata.dwd.de), EUMETSAT (api.eumetsat.int), Open-Meteo
• Lightning data: Blitzortung.org
• Place/address search: OpenStreetMap Nominatim (only when the search is actively used)
• JavaScript libraries: unpkg.com, cdn.jsdelivr.net, cdnjs.cloudflare.com (CDN — among others map and 3D libraries)
• Street photo previews (chase advisor / spot search): Mapillary — your browser loads the preview images from Mapillary servers
• Webcam previews: windy.com (retrieved on the server side by us; your browser loads the preview images from windy.com)

Route links (“Route to here”) open Google Maps or Apple Maps on request — data is transmitted to these providers only once you click on them. Likewise, the place a photo was taken opens Google Maps on request; data is transmitted to Google only once you click on it.

For these embeddings there is deliberately no switch in the consent window (section 6): they are what the map shows — without map tiles and weather data an empty area would remain, so the page would no longer have any content. The processing takes place exclusively on the map pages (/radar/, image archive, 3D cell view) and begins only when you open such a page; all other pages of the portal load none of it. Anyone who does not want this transmission should not open the map pages. Unlike the Google fonts (section 6), the embedding here cannot be substituted — which is why we base it on Art. 6(1)(f) GDPR and name it openly here instead of feigning a choice that does not exist.

Coarse location determination (ip-api.com): at two points we determine the approximate region of your IP address on the server side and transmit the IP address to the service ip-api.com for this purpose: as the initial view of the radar map (only when the map requests it) and for the distance information on the photos in the photo feed. The result is held in the session only for the duration of your visit and is not stored permanently. For the selection of the language, no location determination has taken place since 25 August 2026; the language setting of your browser alone is decisive. Legal basis: Art. 6(1)(f) GDPR (needs-based display of the map and of distances).

Shared radar links

The radar map can be passed on as a link at two points. Mesocyclones (“/radar/?meso=…”) are pure weather data without any personal reference — place, time, rotational velocity and track of a rotation; we keep them for 90 days and then delete them automatically. A snapshot of the 3D cell view (“/radar/?c3d=…”) freezes the volume scan of the nearest radar so that the recipient sees the same cell as the sender; this, too, is exclusively weather data. Snapshots are kept for 30 days and are then deleted together with the file. For every snapshot we count how often it was retrieved — as a mere figure, without any information about those retrieving it. Anyone who generates or opens such a link does not have to be signed in; an account is neither required nor recorded in the process.

When a snapshot is generated we limit the quantity (legal basis: Art. 6(1)(f) GDPR — protection against abusive mass generation). Your IP address is not stored for this: a hash value is derived from it, from which the address cannot be calculated back, and only this forms the name of a temporary file that contains nothing but time stamps and disappears after an hour at the latest.

The sharing targets offered (WhatsApp, Telegram, X, Facebook, e-mail) are plain links. No social media plug-ins are embedded: as long as you do not click a target, nothing is transmitted to these providers.

Embedding on third-party websites. At whunters.net/widget/ our radar map can be embedded into other websites as a widget (/embed/). This widget sets no cookies, stores nothing in the browser and embeds no third-party services; map and radar tiles are served by our own servers. Lightning data is deliberately not part of the widget. When it is called up we count the host name of the embedding page per day and store the address of the embedding page itself (its public URL, taken from the referrer or reported by the frame). The purpose is to verify the agreed condition for embedding — a visible link to whunters.net next to the frame — and to prevent misuse; sites that do not meet it can be blocked. No personal data of the visitors to that page is collected in the process: no IP address, no identifier, no history (legal basis: Art. 6(1)(f) GDPR — knowing how our own offering is distributed and enforcing our terms of use). The data sources are the Deutscher Wetterdienst and further national weather services, plus OpenStreetMap/CARTO for the base map.

11. Sending e-mail

System e-mails (for instance the confirmation of registration, security and confirmation codes, notices concerning your account or replies to support enquiries) are sent by us via the external dispatch service provider smtp.com (provider of the “SMTP.com” service, USA), which acts for us as a processor pursuant to Art. 28 GDPR. Transmitted to the provider are your e-mail address, your name or user name insofar as it appears in the respective mail, the content of the message as well as the technical connection data of the dispatch. The transfer to the USA is based on the standard contractual clauses of the EU Commission. If the service provider is disrupted or a message cannot be delivered by this route, dispatch falls back to our own server (Postfix, located in Germany); for individual recipient domains where the detour via the service provider is known from experience to lead to delivery problems, we send directly via our own server from the outset. Legal basis: Art. 6(1)(b) GDPR (user relationship) or Art. 6(1)(f) GDPR (legitimate interest in reliable dispatch).

Dispatch log. For every system mail we record on what occasion it was sent, to which address and to which user account it went, its subject, the language, the time as well as the result of the dispatch including any error message. This serves to troubleshoot delivery problems, as evidence that a message was sent, and prevents the same mail from inadvertently going out more than once. The content of the messages is not stored in the process. When your account is deleted, your dispatch log is deleted as well. Legal basis: Art. 6(1)(f) GDPR.

Circular mails to members. Occasionally we write to registered members by e-mail in order to inform them about news of the portal (e. g. new features or changes to operations). Since 14 September 2026 this also includes a notice that a new post has appeared on our blog; it contains the title, the cover image, a short teaser and a link to the post. It requires the same consent as any other circular mail and goes to the same group of recipients; anyone who has unsubscribed does not receive this notice either. Such circulars go to members with a confirmed e-mail address. At registration you decide yourself by tick box whether you wish to receive these circular mails; without your consent we do not send them to you. The legal basis in this case is your consent (Art. 6(1)(a) GDPR); we store the time of the consent as evidence (Art. 7(1) GDPR). For accounts created before this question was introduced, receipt continues as before unless you have objected; the legal basis in that respect is Art. 6(1)(f) GDPR — our legitimate interest in informing members about the portal within the existing user relationship (communication with existing customers, cf. Section 7(3) UWG).

Objection and unsubscribing. You can object to receiving such circular mails at any time and withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR) — via the unsubscribe link at the end of every circular mail, which works without signing in, or via the tick box “receive circular mails” in the settings of your account. Unsubscribing takes effect immediately for all future circular mails; no reason need be given and no disadvantages arise from it.

Stored for this purpose are solely your subscription or unsubscription status, the time of a consent given and a random identifier (token) by means of which the unsubscribe link finds your account again. We do not evaluate whether and when a circular mail is opened or a link in it is clicked; the mails contain no counting pixels and no other tracking.

Unaffected by unsubscribing are system e-mails that are necessary for the running of your account — for instance confirmation and security codes, notices about changes to your account as well as personal replies to your enquiries (Art. 6(1)(b) GDPR).

12. Donations

Donations to Weather Hunters are not processed through this website but through your own bank or through PayPal. When you open our donation page, we do not process any payment data ourselves: the QR code shown there (GiroCode) is generated on our own server, no payment service provider and no other third party is embedded, and nothing is transmitted to us as long as you merely look at the page.

Donation by bank transfer: you make the transfer at your own bank. For an incoming payment, our bank provides us with the details that every transfer carries with it — the name of the donor, the IBAN, the amount and the reference.

Donation via PayPal: if you choose the PayPal route, you leave our website. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. For a donation received, PayPal passes on to us your name, your e-mail address and the amount. PayPal’s own privacy policy applies to your use of PayPal.

We record donations received in our own administration with the date, the amount, the source (bank transfer or PayPal) and, where applicable, the name of the donor. The legal bases are Art. 6(1)(b) GDPR (handling the donation) and Art. 6(1)(c) GDPR (compliance with our accounting obligations). These records are kept for ten years pursuant to Section 147 AO (German Fiscal Code).

None of this becomes public by itself: a name appears on the donation page only where the donor has expressly agreed to it (Art. 6(1)(a) GDPR). Individual donation amounts are never published.

13. Retention periods

• Account data: until the account is deleted
• Telephone number: until the account is deleted (on a change, the previous number is replaced by the new one)
• Sign-in logs: for a short period, in order to detect misuse
• Live positions: per member only the last position, which is overwritten by every new report; display in the live views only for 60 minutes, on the map marked as “offline / last seen” after 10 minutes; complete deletion by an hourly clean-up run as soon as the last report is more than 24 hours old — and immediately when tracking is switched off or the account is deleted. Positions within the 5 km home zone are not stored in the first place.
• Support tickets including messages and image attachments: until deleted by the administration, at the latest until the account is deleted
• Dispatch log of the system e-mails: for a short period for troubleshooting and as evidence of dispatch, at the latest until the account is deleted
• Rating of the portal (stars, voluntary text, usage time, page, time) as well as the dismissals of the rating window (number of dismissals, usage time and time of the dismissal): until the account is deleted
• Page counter: pure aggregate totals with no personal reference — no erasable personal data arises
• Raw lightning data: 3 hours (contains no personal references)
• Photos: until deleted by the member or the administration
• “Like” entries: until taken back by the member or until the account is deleted
• Friendships: until ended by one of the two members or until the account is deleted
• Activity points and badges: not stored, calculated from existing data when required
• Time of the last activity (presence): continuously overwritten
• Comments: until deleted by the member, the photographer or the moderation team
• Chat messages: 12 months from dispatch, then automatic deletion; your own messages can be deleted by you within 15 minutes; when the account is deleted, your own messages are removed in full and direct conversations are deleted
• Image attachments and shared locations in the chat: together with the message they belong to — on its withdrawal, after 12 months at the latest, and in any case when the account is deleted
• Block list in the chat: until lifted by the member or until the account is deleted
• Reports: permanently, as evidence of the moderation decision (without the reported content)

14. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise them, contact info@weatherhunters.de informally. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

15. Data security

Transmission takes place in encrypted form via HTTPS/TLS. Passwords are stored exclusively as modern cryptographic hashes.

16. Changes to this policy

We adapt this privacy policy when the functions of the portal or the legal situation change. The version published here at the time applies.