When you create an account, we store:

• Email address — used for login, account recovery, and low-frequency service notices (billing receipts, critical incident notifications).
• Password hash — salted + hashed via Werkzeug’s scrypt. We never store or see your plaintext password.
• Account tier + Stripe customer ID — if you subscribe to Monitor or Sentinel, we store your Stripe customer + subscription references so we can render the correct tier gate and honor cancellations. We do not store your card number; that lives entirely at Stripe.
• Phone number (optional) — only if you choose to opt in to SMS alerts. See section 03.
• API keys (Sentinel only) — if you generate a personal API key, we store its hash (not the raw key) so requests can be authenticated.
• Timestamps — account created_at, last login. That’s it.

Explicitly not collected:

• No tracking cookies for advertising. No behavioral profiling. No cross-site tracking pixels.
• No third-party analytics. Page views are not sent to Google Analytics, Segment, Amplitude, Mixpanel, or any similar service.
• No device fingerprinting.
• No location tracking. Even for regional earthquake alerts, we use country-scoped opt-in preferences you set explicitly — not IP geolocation or device GPS.
• No sale of any data. There is no data-broker relationship; there is no data to broker.

If you opt in to SMS alerts on the /account page, we collect your phone number and use Twilio Verify to send you a 6-digit code. You enter that code to prove ownership of the number. Only after successful verification do we mark your account as SMS-enabled.

TerraSignal shares only what is strictly necessary with a small set of vendors:

• Stripe (payment processor) — receives your email + payment method + subscription events. We store only Stripe’s customer and subscription IDs on our side. Stripe’s privacy policy applies to their handling.
• Twilio (SMS carrier + phone verification) — receives your phone number + message body + verification codes. Twilio’s privacy policy applies to their handling.
• Anthropic (Claude, for daily AI bulletin) — receives a numeric data snapshot only: threat index, coherence percentage, z-scores per stream, component subscores. This is identical to what is shown publicly on /monitor and /analysis. No user email, no phone, no account ID, no user-identifying information of any kind is sent to Anthropic.
• Railway (application hosting) — runs the database and backend. Data at rest is encrypted per Railway defaults.
• Vercel (frontend hosting) — serves the website. Standard access logs (IP + user agent + path) are retained per Vercel defaults.

Account data is retained for the lifetime of your account. When you delete your account from /account, the following happens:

• Your users row is deleted immediately.
• Your phone number and SMS opt-in state are deleted with the account row.
• Any API keys tied to the account are invalidated immediately.
• Stripe retains subscription and payment records per its own retention policy (typically 7 years for financial-record compliance). We cannot delete those on Stripe’s side.
• Access logs at Vercel and Railway follow those providers’ retention windows (typically 30–90 days).

You have the right to:

• Access the data we hold on you — the account page shows every field we store.
• Correct your email or phone number — editable from /account.
• Delete your account and all associated data — also from /account. No email confirmation, no waiting period.
• Export your data — Sentinel-tier users have API + CSV/JSON export. Any user can request a personal data export by email.
• Opt out of SMS at any time by replying STOP, or by toggling SMS off on the account page.

Note: TerraSignal is currently operated from the United States and serves US-based users. If you are in the EU, UK, or another jurisdiction with specific data-protection rights (GDPR, CCPA beyond baseline, PIPEDA, etc.), we honor the substance of these rights — access, correction, deletion, portability — but the formal legal frameworks are not separately documented here yet. Reach out if you need something specific.

Baseline safeguards in place:

• Passwords stored as salted scrypt hashes, never plaintext.
• All traffic between your browser and TerraSignal is served over HTTPS (TLS 1.2+).
• JWT tokens include a version counter that invalidates on password change — changing your password logs out every other session immediately.
• Database sits behind a private network; only the application layer has direct access.
• No system is perfectly secure. If we ever suffer a breach that exposes user data, we will notify affected users by email within 72 hours of confirming the breach, alongside a public incident report.

When this policy changes materially, we will update the effective date at the top and notify active users by email at least 14 days before the change takes effect. Non-material changes (wording, typo fixes, added examples) may go in without notice.

You can always find the current version at terrasignal.io/privacy.

Privacy questions, data requests, or breach notifications:

terrasignal.contact@gmail.com

TerraSignal is operated by Gabriel Robinson, a sole proprietor based in Utah, USA. There is no corporate entity or DPO to route around — you are emailing the person who wrote the code that stores your data.