← Back to Home

Privacy Policy

Last updated: October 2026

Overview

Beyond WX is designed with privacy in mind. We collect minimal data necessary to provide the weather service and improve user experience. This policy explains what information we collect and how we use it.

Information We Collect

Account Information

If you choose to sign in using Replit authentication:

  • Your Replit user ID and username are stored to identify your account
  • Your profile picture URL (if you have one) is displayed in the app but not stored
  • We do not have access to your Replit password or other Replit account details

Location Data

When you search for weather or use the "Use my location" feature:

  • Your coordinates are sent to our server to fetch weather data from the NWS API
  • Location data is used only for the immediate weather request
  • For signed-in users: Tracked locations you save are stored in our database so they sync across your devices
  • For guests: Saved locations are stored only in your browser's local storage

Cookieless Pageview Analytics

We send a minimal pageview event to our analytics endpoint containing only the site name, page path without query strings, the referring site's hostname when available, and the browser user agent when available. The same endpoint also receives cookieless MCP usage events (tool or route name with unregistered names recorded as unknown, success or error/rate-limit outcome, latency, and MCP client name/version when available) for public MCP tools, /radar PNGs, and /og/storm storm cards. When initialize has not provided a client name, analytics falls back to a sanitized browser User-Agent string as the client name. Those events do not include tool arguments, coordinates, city names, or IP addresses. The analytics record does not include cookies, IP addresses, user IDs, or query strings. We do not use Google Analytics or PostHog.

Server Logs

Like most web services, our servers automatically log IP addresses, request timestamps, pages requested, and browser user agent strings. These logs are used for security, debugging, and service improvement.

MCP Server Logging and Rate Limits

Each MCP tool call creates a server log entry containing the timestamp, tool name, client name, and a masked IP address. Separately, the MCP server temporarily keeps the client name associated with the full request IP address in process memory for about 24 hours after the latest request. This lets the server recognize the client and prevent abuse. MCP rate-limit counters also use the full request IP address and client name and normally expire after about one hour. MCP usage events sent to the analytics endpoint are separate from these rate-limit counters and do not include IP addresses.

Requests to the public radar image URLs (/radar/{citySlug}.png and /radar.png?lat=&lon=) count against the same in-memory, per-IP radar counter, which uses the full request IP address and normally expires after about one hour. Coordinates in these URLs are rounded to 0.1° before use. A separate site-wide counter of newly rendered radar images stores no IP address or client information. Storm card images (/og/storm/{citySlug}.png) use the same per-IP radar counter and site-wide render ceiling.

Information We Do NOT Collect

  • Your email address or phone number
  • Passwords
  • Payment information
  • Precise location history
  • Health or financial data

How We Use Information

  • To fetch and display weather data for your requested locations
  • To understand usage patterns and improve the service
  • To monitor for abuse and ensure service availability
  • To fix bugs and technical issues

Data Sharing

We share data only with the National Weather Service (your coordinates for weather data), CARTO or the OpenStreetMap fallback (standard request information such as your IP address and browser user agent when your browser requests basemap tiles), Iowa State Mesonet and CARTO for MCP radar and the public /radar image URLs (Beyond WX requests their tiles, and the Iowa State Mesonet NEXRAD storm-attribute feed nexrad_attr.py, server-side without forwarding the MCP caller's IP address, X-Forwarded-For, or other caller-derived forwarding headers; OpenStreetMap is not used by the server-side renderer), and our analytics endpoint (the minimal cookieless pageview and MCP usage data described above). We do not sell, rent, or share your data with advertisers or data brokers.

Cookies

Beyond WX uses cookies for authentication and theme preference. Pageview analytics does not use cookies. You can disable cookies in your browser settings.

Your Rights

You have the right to delete your data, clear local data, and access your data. Contact us if you have questions.

Children's Privacy

Beyond WX is a general audience service. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.

Contact

For questions about this Privacy Policy, please contact us through the Beyond WX website.

Terms of Service