Calorbis

Account data. If you create an account, our authentication provider (Clerk) stores your email address and authentication credentials. We don't handle your password directly.

Saved locations. Places you save (label, coordinates, and an optional home/work/family role) are stored against your account so we can match them against hazard data and send you warnings.

Community reports. If you submit a report, we store its location, category, description, and submission time.

Push subscriptions. If you enable push notifications, your browser's push endpoint and encryption keys are stored so we can deliver them.

We do not collectyour device's real-time location unless you explicitly use a "use my location" feature, and we don't track you across other websites.

Saved locations and account data exist to run the core feature: matching your chosen places against live hazard data and warning you. Community reports exist so you can share what you're observing with other users. Push subscriptions exist only to deliver the warnings you asked for.

We use a small number of processors to run the service, each only for what their name implies:

• Clerk - authentication and account management.
• Supabase - database hosting for saved locations, reports, and cached hazard data.
• Resend - delivering warning emails.
• Vercel - application hosting.

We do not sell your data, and we do not share saved locations or community reports with advertisers. Community report content you submit is visible to other Calorbis users by design - don't include anything in a report you wouldn't want public.

Saved locations and account data persist until you delete them or close your account. Community reports currently have no automatic expiry (tracked as a gap - see the community-report trust system on our public roadmap). Cached hazard data (not personal data) is refreshed continuously and old snapshots aren't retained long-term today.

You can delete a saved location at any time from the Locations page. For account deletion or a full data export, contact us using the details below - we don't yet have a fully self-service deletion flow for community reports, which is tracked as a real gap, not an oversight.

We use the minimum cookies/local storage needed for authentication (via Clerk) and to remember your language/theme preference. We don't use third-party advertising or tracking cookies.

Questions about this policy or a data request: contact address not yet set - placeholder pending a real support address being decided (CAL-80 follow-up).