PRIVACY POLICY
Privacy Policy
Last updated: October 10, 2026
This Privacy Policy explains how Hail Magic (“we”, “us”) collects, uses, shares, and protects information when you use hailmagic.com, the Hail Magic app, or buy a verified storm report. We do not sell your personal information.
1. Information we collect
Account. Email, password (stored only as an Argon2 hash), name or company name, time zone, primary state, the states on your plan, team membership, and timestamps for sign-up, last sign-in, and Terms acceptance. We keep an active-session identifier so only one sign-in per seat is active.
Billing. Stripe handles card details. We store Stripe customer and subscription IDs, plan, seats, add-ons, and payment status — never your full card number.
Verified storm report orders. Name, email, phone (optional), property address, event date(s), notes, payment status, and the delivered report PDF. Orders can be placed without an account.
Addresses and locations. Addresses you search or enter for damage reports, roof measurements, alert zones, verification requests, and exports, plus map locations you tap. Generated PDFs and roof measurements are stored with your account.
Alerts. Your alert address, radius or counties, alert preferences (including email alerts), and browser push-subscription tokens.
Messages and uploads. Contact-form messages (name, email, topic, subject, message), images you attach, and the IP address of the sender (used for spam rate-limiting).
CRM connections. API keys you save for JobNimbus, Projul, SPOTIO, or SalesRabbit, stored encrypted and used only to send leads you export.
Skip-tracing results. If you use the skip-trace option on an export, we send the exported property addresses to Tracerfy and return owner names, phone numbers, and emails to you in that export.
Device sign-in (mobile app). If you turn on biometric sign-in, your sign-in details are kept in your device’s secure storage, unlocked by your device biometrics. Biometric data never leaves your device and is never sent to us.
Usage and logs. Server logs of requests (endpoint, time, response code, IP address, user ID when signed in) and aggregate feature usage counts. We do not use advertising networks or third-party behavioral tracking.
2. How we use it
• Provide maps, swaths, tracks, alerts, PDFs, roof measurements, exports, and verified reports.
• Bill subscriptions, add-ons, seats, and one-time purchases through Stripe.
• Send emails you’d expect: account and teammate invitations, password resets, receipts, alerts you opt into, report delivery, and replies to your messages.
• Enforce state coverage, single-session sign-in, and rate limits; prevent fraud and abuse; fix bugs.
• Improve the service using aggregate usage.
3. Who we share it with
We share only what each provider needs to do its job:
• Stripe — payments, subscriptions, billing portal.
• Bird — email delivery (recipient address and message content).
• Emergent — app hosting, database, file storage, and welcome-email delivery.
• Mapbox — map tiles and address lookup (addresses you search).
• Vaisala Xweather — hail forecast (map areas and points, no account details).
• Tracerfy — skip-tracing, only when you request it (property addresses).
• Your CRM — leads you choose to export (JobNimbus, Projul, and others).
• Public weather sources — NOAA/NWS, Iowa Environmental Mesonet, CoCoRaHS, Open-Meteo, U.S. Census county boundaries. We request public data from them; we do not send them your account details.
We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a sale or transfer of the business.
4. Retention
Account data, PDFs, roof measurements, uploaded images, messages, and report orders are kept while your account is active and deleted on request. After an account is closed we may keep billing and transaction records as needed for tax, accounting, and dispute purposes. Server logs are kept for a limited time for security and debugging.
5. Your choices and rights
• Update your profile, alert settings, email alerts, and CRM keys in Profile.
• Turn off browser notifications or email alerts at any time.
• Request a copy or deletion of your data by emailing meteorologist@hailmagic.com. We respond within 30 days, and honor U.S. state privacy rights (such as California’s CCPA) where they apply.
Hail Magic is intended for U.S. businesses and is not directed at users outside the United States.
6. Children
Hail Magic is a business tool. We do not knowingly collect information from anyone under 16.
7. Security
Passwords are hashed with Argon2, CRM keys are encrypted, and all traffic uses HTTPS. Stripe handles card data under PCI DSS. No system is perfectly secure, so please use a strong, unique password and keep it private.
8. Changes
If we update this policy, we change the date at the top and ask you to acknowledge the new version the next time you sign in.
9. Contact
Privacy questions or data requests: meteorologist@hailmagic.com, or Profile → Contact Us in the App.