This Privacy Policy explains how Hail Magic LLC (“Hail Magic”, “we”, “us”) collects, uses, shares, and protects information when you use hailmagic.com, the Hail Magic app, or buy a meteorologist-reviewed storm report. We do not sell your personal information.

Account. Email, password (stored only as an Argon2 hash), name or company name, time zone, primary state, the states on your plan, team membership, and timestamps for sign-up, last sign-in, and Terms acceptance. We keep an active-session identifier so only one sign-in per seat is active.

Billing. Stripe handles card details. We store Stripe customer and subscription IDs, plan, seats, add-ons, and payment status — never your full card number.

Meteorologist-reviewed storm report orders. Name, email, phone (optional), property address, event date(s), notes, payment status, and the delivered report PDF. Orders can be placed without an account.

Addresses and locations. Addresses you search or enter for damage reports, roof measurements, alert zones, verification requests, and exports, plus map locations you tap. Generated PDFs and roof measurements are stored with your account.

Alerts. Your alert address, radius or counties, alert preferences (including email alerts), and browser push-subscription tokens.

Messages and uploads. Contact-form messages (name, email, topic, subject, message), images you attach, and the IP address of the sender (used for spam rate-limiting).

CRM connections. API keys you save for JobNimbus, Projul, SPOTIO, or SalesRabbit, stored encrypted and used only to send leads you export.

Skip-tracing results. If you use the skip-trace option on an export, we send the exported property addresses to Tracerfy and return owner names, phone numbers, and emails to you in that export.

Property records and homeowner contact data. When you open a hail swath we send the swath area to Realie and store the matching residential property records (address, parcel boundary, building details, values, sales, owner of record) for up to 30 days to show impacted-house counts. When you spend a credit to unlock a home, we send that property address to Tracerfy and store the returned owner names, phone numbers, emails, and DNC/litigator flags for up to 30 days, plus a record of which homes your account unlocked. This information is about homeowners, not about you; it comes from third-party public and commercial records, may be inaccurate, and is shown only to the subscriber who unlocks it.

Compliance acceptance logs. Each time you accept the TCPA & Telemarketing Compliance Agreement we record your account, the date and time, IP address, device/browser, the action (unlock or export), and the agreement version. We keep these logs permanently as a legal audit trail and may share them with courts, regulators, or in response to legal claims.

Credits. Your home-credit balance and credit purchases (processed by Stripe).

Device sign-in (mobile app). If you turn on biometric sign-in, your sign-in details are kept in your device’s secure storage, unlocked by your device biometrics. Biometric data never leaves your device and is never sent to us.

Usage and logs. Server logs of requests (endpoint, time, response code, IP address, user ID when signed in) and aggregate feature usage counts. We do not use advertising networks or third-party behavioral tracking.

We share only what each provider needs to do its job:

We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a sale or transfer of the business.

Account data, PDFs, roof measurements, uploaded images, messages, and report orders are kept while your account is active and deleted on request. After an account is closed we may keep billing and transaction records as needed for tax, accounting, and dispute purposes. Realie property records and Tracerfy contact results are cached for up to 30 days. TCPA/DNC compliance acceptance logs are kept permanently. Server logs are kept for a limited time for security and debugging.

Hail Magic is intended for U.S. businesses and is not directed at users outside the United States.

Hail Magic is a business tool. We do not knowingly collect information from anyone under 16.

Passwords are hashed with Argon2, CRM keys are encrypted, and all traffic uses HTTPS. Stripe handles card data under PCI DSS. No system is perfectly secure, so please use a strong, unique password and keep it private.

If we update this policy, we change the date at the top and ask you to acknowledge the new version the next time you sign in.

Privacy questions or data requests: jacobroost@hailmagic.com, or Profile → Contact Us in the App.