Anvilhead

Privacy Policy

Last updated October 31, 2026

Anvilhead is a weather app for iPhone and Apple Watch, made by Retroteq in Paris, France. This policy explains what personal data the app and this website handle, why, for how long, who helps us, and how you stay in control.

1. Who is responsible

Retroteq SARL, a French single-member limited liability company (société à responsabilité limitée à associé unique) with share capital of €100, registered in the Paris Trade and Companies Register under number 947 816 344, with its registered office at 25 rue de Ponthieu, 75008 Paris, France, is the controller of your personal data (“Retroteq”, “we”, “us”).

For any privacy question, email support@anvilhead.app, call +33 6 87 16 32 66 or write to the address above. We have not appointed a data protection officer.

2. What we collect and why

Your random account ID

When the app first needs an account, for example to send you alerts, our sign-in provider, Supabase, creates an anonymous one identified by a random ID. It holds no name, email address or phone number. We use it to deliver your alerts, sync your saved places and keep Premium linked to you, and our subscription provider, RevenueCat, uses the same ID for your purchases. With each sign-in session, Supabase stores the IP address and the app’s technical identification string (user agent) it saw, to protect accounts from abuse.

Your email address, if you sign in

Signing in is optional: it keeps your places and Premium on more than one iPhone. If you sign in, we use your email address to send you a one-time code and to recognize your account. Our email provider, Brevo, sends the code.

Location

With your permission, the app uses your device’s location to show where you are on the radar and to work out rain timing and storm distances. Those calculations happen on your iPhone or Apple Watch.

When the app needs weather for where you are, it first reduces your position to a coarse area cell on your device and sends only that cell. The smallest cell is at most about 1.2 × 0.6 km (0.75 × 0.4 miles); many requests use larger ones. Your exact coordinates never leave your device. The app explains this and asks for your consent before it shares your area.

Saved places

Place names stay on your device. When your places sync with our servers, they receive only each place’s area cell, a random place ID, its position in your list and its alert settings, so alerts work and your list stays in sync.

Searching for a place

What you type goes to our servers, which look it up with our geocoding provider, Open-Meteo, and return matching places. We don’t keep your searches in our databases or application logs, and we never link them to your account. Open-Meteo receives only the search text from our servers, never your IP address or identity.

Notifications and your device

If you allow notifications, the app registers your device with our servers. The registration holds a random device ID made by the app; the tokens Apple issues so we can send notifications and update Live Activities and widgets; your app and iOS versions; your language and region setting, time zone and units; whether Time Sensitive notifications are allowed; and, if you consented, the area cell of My Location, with the time of your consent and the version of the text you saw. Each update replaces the previous cell, so our database never holds a history of where you’ve been. We also keep alert preferences you set, such as quiet hours. Notifications are delivered by Apple’s Push Notification service. Nothing is registered until you allow notifications.

While a rain Live Activity is running (Premium), we also keep its update token and the place ID it follows, and delete both when it ends.

Purchases

Premium is sold by Apple through the App Store, and Apple handles payment: we never see your card or billing details. RevenueCat receives the App Store’s transaction information with your random account ID, to confirm what you bought and to help us measure how our purchase screens perform. Our servers keep a copy of your subscription status (plan, renewal or expiry date, store) so Premium alerts work.

Usage statistics

If Help Improve the App is on (it is by default), the app sends usage events, such as which screens you open, which features you use and which purchase options you see, with the app and iOS versions, whether you have Premium, and which version of a screen you saw when we test alternatives. The events carry a separate random analytics ID, never your account ID, and never include your location, places or searches. We don’t store IP addresses with them. They show us what works and what to fix.

To stop, turn off Settings › Privacy › Help Improve the App: the app stops sending events and erases its analytics ID. The analytics ID is also replaced every 13 months.

Answers to “Did it rain?” are only counted. To avoid counting an answer twice, our servers keep a pseudonymous key, a one-way hash rather than your account ID, for 30 days.

If you chose in iOS to share analytics with app developers, Apple may also give us crash reports and aggregate usage figures. Apple controls that choice, in iOS Settings › Privacy & Security › Analytics & Improvements.

Support

If you contact us, we receive your email address or phone number, your message and anything you choose to include, and use them only to help you.

Technical data and logs

Any connection reveals your device’s IP address to the server it reaches. Our own servers don’t store it. Our providers keep short-lived security and request logs that can include IP addresses and request details: Railway for our servers, Cloudflare for radar images and this website, and Supabase for sign-in. They’re used only to keep the service secure and working.

This website

anvilhead.app has no cookies, analytics, scripts, external fonts or forms. Cloudflare hosts it and processes your IP address to deliver and protect it. If Cloudflare needs to check that a visitor isn’t a bot, it may set a short-lived, strictly necessary security cookie.

3. What we don’t do

• No advertising and no data brokers. We never sell your personal data or share it for targeted advertising.
• No tracking across other companies’ apps or websites, and no use of Apple’s advertising identifier.
• No cookies in the app.
• No location history, and no access to your contacts, photos, microphone or health data.

4. Legal bases

The EU General Data Protection Regulation (GDPR) applies because Retroteq is established in France. We rely on:

• Contract (Art. 6(1)(b)): your account, device registration, notifications, synced places, purchases and support.
• Consent (Art. 6(1)(a)): sharing your area for weather and alerts where you are, and notifications. You can withdraw consent at any time in iOS Settings; this doesn’t affect what happened before.
• Legitimate interests (Art. 6(1)(f)): usage statistics, which you can turn off; counting “Did it rain?” answers to measure forecast quality; measuring how purchase screens perform; and security logs.
• Legal obligation (Art. 6(1)(c)): when the law requires us to keep or disclose data.

You never have to give us personal data. Without location you can still search for places; without notifications you won’t receive alerts.

5. Who helps us

We share personal data only with the providers below. They process it for us, on our instructions, under data processing agreements that require them to protect it at least as well as this policy and Apple’s App Store rules require. We disclose data to anyone else only when the law requires it.

Supabase

Database and sign-in, in the United States (Northern Virginia): account ID, email address if you sign in, session records, device registrations, places, preferences, subscription status and usage events.

Railway

Runs our servers and alert workers, in the United States (Virginia): the data above while it’s processed, short-lived working copies used to deliver alerts, and request logs.

Cloudflare

Delivers radar images, hosts this website, runs our domain’s DNS and forwards email sent to our support address, on its global network: IP addresses, request details and support emails in transit.

RevenueCat

Manages subscriptions, in the United States: random account ID and App Store transaction information.

Apple

Delivers notifications through the Apple Push Notification service: push tokens and notification content. App Store purchases are made with Apple under Apple’s own privacy policy.

Brevo

Sends sign-in code emails, in the European Union: your email address.

Google

Hosts our company email (Google Workspace), where support requests arrive: your messages and contact details.

These receive no personal data about you: Better Stack (uptime monitoring), Open-Meteo (weather data and place search; it receives only area centers and search text from our servers), and the US National Weather Service and NOAA (public weather data).

6. Data stored in the United States

Most of the data above is stored and processed in the United States, mainly in Supabase’s and Railway’s US East regions. Transfers from the European Union rely on the EU–U.S. Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in our agreements with them. You can ask us for a copy of these safeguards.

7. How long we keep it

Account ID and email

Until you delete your data in the app or ask us to.

Session record

While the sign-in session lasts; deleted with your account.

Device registration

Replaced at each update. Deleted when you delete your data, or when Apple tells us the device can no longer receive notifications, for example after the app is removed.

Places and preferences

Until you remove them or delete your data.

Live Activity tokens

Until the Live Activity ends.

Subscription status

Until you delete your data. Apple keeps its own purchase records as the seller.

Usage events

13 months, then deleted. Daily totals with no ID are kept.

Analytics ID

On your device only. Replaced every 13 months; erased when you turn off Help Improve the App or delete your data.

“Did it rain?” key

30 days.

Support messages

Up to 3 years after our last exchange.

Provider logs

Short-lived, generally no more than 30 days.

Backups

Our database backups roll over within 7 days, so deleted data leaves them within 7 days.

8. Delete your data or change your mind

• Delete everything: in the app, open Settings (the gear on Now) › Privacy › Delete My Data (Delete Account if you signed in) and confirm. We delete your account, saved places, alerts, preferences, device registrations, Live Activities and our record of your subscription from our servers, and ask RevenueCat to delete its record of you. The app then starts fresh. If you use the same sign-in for another Retroteq app, only Anvilhead’s data is deleted and your sign-in stays for that app.
• A subscription doesn’t stop by itself. Deleting your data doesn’t cancel Premium: cancel it in iPhone Settings › your name › Subscriptions.
• Already deleted the app? Reinstall it on the same iPhone: it reconnects to your anonymous account, and you can use Delete My Data. Or email us.
• Usage statistics carry only a random analytics ID that we can’t connect to you, so Delete My Data erases that ID from your device and the events expire after 13 months.
• Withdraw consent by turning off location or notifications for Anvilhead in iOS Settings, or Help Improve the App in the app’s Privacy settings.
• By email: write to support@anvilhead.app. If you signed in, we can find your account from your email address. An anonymous account can only be reached from the app, so use Delete My Data there.

9. Your rights

Under the GDPR you can ask to access your data, receive a copy in a portable format, correct it, delete it, restrict its use or object to it, and withdraw consent at any time. Under French law you can also give instructions about what happens to your data after your death. Write to support@anvilhead.app; we answer within one month. To confirm that an account is yours, we may ask for information from the app.

You can also complain to the French data protection authority, the CNIL, at cnil.fr or 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

10. US residents

Depending on your state, you may have the right to know what personal data we hold, to access, correct and delete it, to receive a portable copy, and to opt out of its sale, of targeted advertising and of profiling. We don’t sell personal data, share it for cross-context behavioral advertising, use it for targeted advertising or use it for profiling with legal or similarly significant effects, so there is nothing to opt out of.

The categories we collect are identifiers (random account and device IDs, push tokens, email address if you sign in, IP address), commercial information (subscription status), internet activity (usage events) and coarse geolocation (area cells, never exact coordinates). Because some state laws may treat even an area as sensitive, we ask for your consent before your area leaves your device. This data comes from you and your device, with purchase status from Apple and RevenueCat, and we disclose it only to the providers in section 5, for the purposes in section 2.

To use a right, email support@anvilhead.app; we answer within 45 days. If we decline, you can appeal by replying with “Appeal” in the subject line; we answer within 60 days, and you can then contact your state attorney general. We won’t treat you differently for using your rights.

11. Children

Anvilhead is a general-audience app, not directed to children under 13. If you believe a child under 13 has given us personal information, such as an email address, contact us and we will delete it.

12. Security

Data travels encrypted over HTTPS. Our database enforces row-level access rules, access to our systems is restricted to what each part needs, and secret keys never ship in the app. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

13. Changes

We’ll post any change on this page with a new date. If a change significantly affects how we use your data, we’ll tell you before it applies, for example in the app.

Contact

Retroteq SARL, 25 rue de Ponthieu, 75008 Paris, France
support@anvilhead.app · +33 6 87 16 32 66