Privacy

What we collect: nothing you would call data

There is no account system, app telemetry, ad network or analytics product that follows you between sites. We count a few website button clicks in aggregate. This page is the specific version of that claim, because the vague version is worth nothing.

The app

HookEcho runs on your own machine and talks straight to the public weather feeds — NOAA's NEXRAD archive and MRMS, the National Weather Service API, and the model buckets. Those servers see the requests, exactly as they would if you loaded a weather page. Nothing is routed through us, because there is no us to route it through: we run no server that the app contacts.

Your settings, bookmarks and chase logs are files on your disk. API keys you enter — for a basemap provider or a mesonet network — stay in your own settings file and are sent only to the service that issued them.

Location is used only if you turn it on, and only to pick your nearest radar. It is not sent anywhere.

This website

Loading a page here contacts, and only ever contacts:

• api.weather.gov — warnings and forecasts on radar and reference pages. Public data, no key, requested by your browser directly.
• radar.weather.gov — the live radar loops. Images, hotlinked from the NWS's own server.
• raw.githubusercontent.com — the screenshots, served from our repository on feature and comparison pages at a fixed tag so later changes cannot replace them.
• api.github.com — release information and the live roadmap. Public, unauthenticated requests made by your browser; GitHub sees them the same way it sees you browsing the repository.
• giscus.app — the comments on blog posts and storm pages, and only on those pages. It renders GitHub Discussions in an iframe; if you sign in to comment, you sign in to GitHub, not to us. It sets no cookie of ours and we receive nothing from it.
• static.cloudflareinsights.com — Cloudflare Web Analytics, when it is enabled. It is cookieless, records no personal data and does not fingerprint or track you across sites. It exists so we know which pages people read.

The site also answers a request to its own /geo.json, which returns the rough city and coordinates our host already derived from your IP address, so the page can say which radar is nearest without asking your browser for location permission. It is computed per request and never stored, logged or associated with anything.

Product buttons pass through a same-site /go/ redirect. We record only the destination product, the button's placement and a count, plus Cloudflare's automatic event timestamp. The aggregate events are retained for three months. We do not store an IP address, location, referrer, user agent, cookie or identifier with them.

We set no cookies. There is no login, no newsletter, no form and no comment box, so there is nothing here for you to hand us.

YouTube publishing

Our owner-operated promotion tool uses the YouTube Data API to upload HookEcho and StormDesk videos and the YouTube Analytics API to read aggregate channel statistics. It is not available to site visitors and does not provide a public Google sign-in. Only the owners of the two project channels authorize it.

The tool stores OAuth refresh tokens as encrypted GitHub Actions secrets. It does not request or store Google passwords, viewer identities, comments, watch histories or other per-viewer data. Uploaded media and metadata are created by us. Aggregate views, average watch duration, shares and subscribers gained may appear in a private workflow log and our weekly project report; they are not sold or used for advertising.

This use of YouTube API Services is subject to the YouTube Terms of Service and Google Privacy Policy. A channel owner can revoke access from Google Security settings. They can also request deletion by emailing hookecho.io@gmail.com. We delete stored tokens and retained YouTube API data as soon as possible and within seven calendar days of a revocation or deletion request. Deleting our stored data does not delete content or data held by YouTube; that must be managed through YouTube.

If you would rather check than trust

The site and the app are both in the same public repository. Every network call either makes is in that source, and the desktop app's allowed-host list is compiled in and checked by CI.