Privacy policy

What we collect

• Account details: your email address, the name on your account (from your email address unless you give one), the accounts you belong to and your role in each, and your plan.
• Sign-in: a session cookie (`hc_session`, HttpOnly, 30 days), and with each session the IP address and browser user agent it was created from. Sign-in links and invitations are stored only as one-way hashes and expire (sign-in links after 30 minutes). A password, if you set one, is stored only as a bcrypt hash. We also keep the IP address a sign-in link was requested from.
• Use of the service: how many requests you and your account make each day (kept 90 days), the reports you create (files kept 7 days), API keys (stored only as hashes), custom report requests, and a log of administrative actions (invitations, role and plan changes, API key changes) with the IP address they came from.
• Public data API: each address that calls the anonymous API is counted per day under a keyed hash of the IP address (90 days). Responses carry a reference code that we store with the caller’s network prefix (the first three parts of an IPv4 address, or an IPv6 /48), never the full address, for 90 days, so that republished copies of the public data can be traced.
• Orders and correspondence: what you send to [email protected], including order forms (company, billing contact and address).

The venue data HeatCheck measures is public booking availability and posted prices of businesses. We do not collect the personal data of the people who book them.

How we use it

• To run your account: sign-in, plan access, usage limits, reports and API keys.
• To keep the service secure and to detect abuse and bulk copying of data.
• To take and fulfil orders and to answer you.
• To send the emails the service needs (sign-in links and invitations). We do not send marketing email without your consent.

We do not sell personal data, we show no advertising, and we use no analytics or advertising cookies. The only cookie the app sets is the session cookie; the public pages set none. Cloudflare, which serves the site, may set strictly necessary security cookies.

Who processes it

• Amazon Web Services (United States): the application server, database and backups.
• Cloudflare: domain, content delivery, the public site and the routing of email to [email protected].
• Google Workspace: the mailbox that receives that email, and the delivery of the sign-in and invitation emails the service sends from [email protected].
• OpenFreeMap: the map tiles in the app are loaded by your browser directly from OpenFreeMap, which sees your IP address.

Your data is stored in the United States. Payments are not taken in the app: paid plans are ordered by email.

How long we keep it

Account data is kept while the account exists. Daily usage counts, public API counters and reference codes are deleted after 90 days, sign-in links after 7 days, sessions when they expire, and report files after 7 days. Order and billing records are kept as long as the law requires. Backups are overwritten on a rolling schedule.

Your choices and rights

Write to [email protected] from the email address on your account to get a copy of your data, correct it, or delete your account. We answer within 30 days. Deleting an account removes its personal data except records we must keep by law. HeatCheck is a business service and is not meant for children under 16.

If this policy changes we update the date above; a material change is announced by email to account holders before it applies.