Privacy Policy

Effective date: September 19, 2026 Last updated: September 19, 2026

Stratocheck is operated by Domisomi LLC ("Domisomi," "we," "us"). This policy explains what the Stratocheck app and its backend collect, why, how long it is kept, and what you can do about it.

We have tried to make this document match what the software actually does rather than describe the widest set of things we might one day want to do. Where this policy says we do not collect something, that is a description of the system as built.

Contact: [email protected]

1. The short version

• Stratocheck answers one question: will the sky above a point stay clear over the next three hours. To answer it we need a latitude and longitude.
• You can use the core forecast without an account. Signing in is only required to save sites, sync preferences, hold a subscription, or mint an API token.
• We do not use advertising identifiers, ad networks, third-party analytics SDKs, or attribution SDKs. There are none in the app.
• We do not sell or share your personal information, as those terms are defined by the California Consumer Privacy Act. We never have.
• We do not track you in the background. Coordinates reach us when you ask for a forecast or save a site — not continuously.
• Our service-health analytics are genuinely anonymous: they record a coarse grid cell roughly 39 km by 20 km, with no account, device, session, IP, or correlation identifier attached, and they expire after 30 days.
• Deleting your account performs a real deletion, not a flag.

2. Information we collect

2.1 Location you provide

What. A latitude and longitude, either from your device's location services (with your permission, granted through iOS) or from a place you search for, drop on the map, or save.

How it is used. Coordinates accompany each forecast request as request parameters. The backend matches the point to our published forecast grid, returns the probability curve, and discards the coordinates. Exact coordinates from a one-off forecast request are not written to a database, not attached to your account, and not written to our request logs.

Saved sites. If you sign in and save a site, we store the name you type and the exact coordinates you chose, plus its display order, whether it is your primary site, and whether standing alerts are on for it. This is the most precise personal information we hold, and it exists because the feature does not work without it. Saved sites persist if your subscription lapses so that resubscribing restores them intact; what the tier controls is how many of them remain usable, not whether the rows survive.

Background and continuous location. Stratocheck does not collect a continuous location history. iOS controls this: you may revoke location permission at any time in Settings, and the app will fall back to searched and saved sites.

2.2 Device integrity (Apple App Attest)

Before serving forecasts, we verify that the request comes from a genuine, unmodified copy of Stratocheck running on genuine Apple hardware. This uses Apple's App Attest.

We store, per installation: an installation identifier we generate, the Apple attestation key identifier, the associated public key, the app identifier, the attestation environment, a monotonic assertion counter, and first-seen, attested, and last-seen timestamps. We also briefly store outstanding cryptographic challenges and a record that a registration completed.

This data exists to stop forecast-API abuse and quota evasion. It contains no name, no email, no device name, no advertising identifier, and no persisted IDFA or IDFV. It is not linked to your identity unless you separately sign in.

2.3 Account information (only if you sign in)

Stratocheck uses Sign in with Apple and no other sign-in method. We never see or handle an Apple password.

We store:

• The opaque Apple subject identifier for your account. This is specific to Stratocheck and cannot be used to identify you to another developer.
• An email address, if Apple releases one. At sign-in Apple lets you choose whether to share your real address or a private relay address (…@privaterelay.appleid.com). We store whichever we receive, and the choice is yours to make at the Apple prompt. This field may be empty.
• An Apple refresh token, encrypted at rest with AES-GCM under a versioned key. We hold it for one purpose: so that deleting your account can also tell Apple to revoke Stratocheck's access, as Apple requires.
• Session records. Refresh tokens are stored only as SHA-256 hashes; the plaintext token never touches our database. Sign-in nonces and Apple authorization codes are likewise stored only as hashes.
• The link between your account and your device installations, with the time each was linked and last seen.

• A small account audit trail — sign-in, sign-out, account deletion, and failed Apple revocations, with timestamps. This exists for security investigation and to demonstrate that deletions were honored.

• A record of which legal documents you accepted, and when. We store the document, its published version, the time you accepted, and the installation you accepted from. We keep this because our Terms give you 30 days from your first acceptance to opt out of the arbitration agreement, and that window cannot be honored — or audited — if nothing records when it started. Only the first acceptance of a given version is stored; re-opening the app does not create new records.

2.4 Preferences

If you sign in, we store your unit preference (metric or imperial), whether notifications are enabled, and your quiet-hours window.

2.5 Subscription and purchase records

Stratocheck Pro is an auto-renewing subscription sold through the Apple App Store.

We never receive your payment card, bank details, billing address, or any financial account information. Apple processes all payments. We could not see that data if we wanted to.

What Apple does send us, and what we store, is entitlement bookkeeping: the Apple transaction identifier and original transaction identifier, the product identifier, the store environment, the app account token, purchase and original purchase dates, expiration and revocation dates, the signing timestamps, and the resulting state (active, expired, refunded, or revoked). We also record App Store Server Notifications so that renewals, refunds, and revocations take effect without you having to reopen the app.

This exists solely to decide whether your account gets Pro features.

2.6 API access tokens (Model Context Protocol)

If you mint a personal access token so your own AI agent can query Stratocheck, we store a SHA-256 hash of the token, a short non-secret prefix so you can tell tokens apart in a list, the label you type, and the created, expiry, last-used, and revoked timestamps.

The token itself is displayed once at creation and never stored in recoverable form. We cannot show it to you again, and we cannot recover it if you lose it. Tokens expire after one year and you can revoke any of them at any time.

When a token is used, the request carries whatever place name or coordinates your agent asked about, handled the same way as §2.1.

2.7 Service-health analytics

We record an anonymous event for forecast and map-tile requests so we can see where demand is, whether the service is fast, and whether it is failing.

Each event holds: a four-character geohash — a grid cell of roughly 39 km by 20 km, not your coordinates; the endpoint; an origin category drawn from a fixed list (current_location, saved_location, search, map, widget, background, or unknown); metadata about which forecast cycle answered and how fresh it was; the HTTP status; a result code; the duration in milliseconds; and the backend version.

What these events deliberately do not contain: any user, account, installation, session, saved-location, request, IP, user-agent, pseudonymous, hashed, or client correlation identifier. There is no join key of any kind. As a direct result, this data cannot be used — by us or by anyone who obtained it — to count unique users, measure retention, or reconstruct one person's sequence of requests, and we do not attempt to.

The origin category is read from a request header that accepts only the fixed values listed above; anything unrecognized is recorded as unknown. Arbitrary header content is never stored.

Retention: 30 days. A scheduled job deletes expired rows daily.

2.8 Operational logs

Our API gateway writes an access log line per request containing the HTTP method, the request path, the response status, the latency, a request identifier, and the matched route.

These logs deliberately omit the source IP address. Coordinates travel as query parameters and are not part of the logged path.

Application logs record operational events and errors. Retention is 90 days in production and 30 days in other environments, after which log data is deleted automatically.

2.9 IP address

Your IP address is visible to our infrastructure in the ordinary course of serving an HTTPS request, as it is for any internet service.

We use it in one narrow place: the rate-limit counter for device-attestation endpoints is keyed partly on the requesting IP address, inside a short rolling window (60 seconds by default). This is abuse prevention — it stops one source from exhausting attestation capacity. The counter is not linked to an account or to forecast activity, and it is not retained as a history.

We do not store IP addresses in our access logs, our analytics, or your account record.

3. What we do not collect

To be concrete, Stratocheck does not collect, and the software contains no code to collect:

• Advertising identifiers (IDFA), or any ad network or attribution SDK
• Third-party analytics SDKs
• Contacts, photos, camera, microphone, calendar, or health data
• Biometric data
• Browsing or search history outside the app
• Financial account or payment card data
• A continuous background location history
• Any data used for cross-app or cross-site tracking

4. Why we process this information

We do not use your information to build advertising profiles, and we do not use it to train models on your behavior. Our forecasting model is trained on satellite imagery from NOAA, not on user data.

5. Who we share with

We do not sell your information and we do not share it for cross-context behavioral advertising.

We disclose information only to the following service providers, for the purposes described:

• Apple Inc. — Sign in with Apple, App Attest, App Store purchases and server notifications, and push notification delivery. Apple's handling of your data is governed by Apple's own privacy policy.
• Amazon Web Services — hosting, in the AWS us-east-1 region in the United States. AWS stores the data described above on our behalf and does not use it for its own purposes.

Two further parties are worth naming for transparency, though no personal information reaches either:

• NOAA / NESDIS GOES satellite imagery, accessed through AWS Open Data. This is our model's input. Nothing about you is sent there. Fetching imagery is not triggered by, and does not reveal, any individual request.
• GeoNames, whose US place-name dataset we load into our own database in bulk. Place search runs entirely inside our infrastructure; your search text is not sent to an external geocoding service.

We also operate an internal alerting channel that pings a phone when a device registers, a token is minted, or a subscription starts. By design these notifications carry only a category and, for tokens, the label you typed — no user, account, device, or transaction identifier travels with them.

We may disclose information if required by law, valid legal process, or to protect the rights, safety, or property of Domisomi, our users, or the public. If we are compelled to disclose your information, we will give you notice unless legally prohibited.

If Domisomi is acquired or merges with another entity, account information may transfer as part of that transaction. You will be notified before your information becomes subject to a different privacy policy.

6. Retention

7. Your choices and rights

7.1 Controls available to everyone

• Use Stratocheck without an account. The forecast works without signing in.
• Withhold your location. Revoke location permission in iOS Settings and use searched or saved sites instead.
• Choose a private relay email at the Apple sign-in prompt.
• Turn off notifications, or set quiet hours, in the app or iOS Settings.
• Revoke any API token from the app at any time.
• Delete any saved site individually.

7.2 Deleting your account

Deleting your account in the app performs a hard deletion, not a soft flag. The account row is removed and the deletion cascades to your Apple credentials, all sessions, all device links, all saved sites, your preferences, your entitlements, and all API tokens. We also call Apple to revoke Stratocheck's refresh token for your Apple ID.

Two honest caveats:

1. Anonymous service-health events cannot be deleted on request, because nothing in them identifies you or connects them to your account. There is no query that could find "your" rows. They age out within 30 days.
2. Purchase records held by Apple are Apple's, and Apple's own retention applies to them. We may retain a minimal record of a transaction where we are required to for tax, accounting, or fraud-prevention purposes; such a record is not linked to a deleted account.

7.3 California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, the purposes, and the categories of recipients — set out in §2, §4, and §5 above.
• Access a copy of the personal information we hold about you.
• Delete your personal information, subject to §7.2.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of and we provide no "Do Not Sell or Share My Personal Information" link. We have not sold or shared personal information in the preceding twelve months.
• Limit use of sensitive personal information. Precise geolocation is sensitive personal information under California law. We use it only to perform the service you requested and for the purposes listed in §4 — never to infer characteristics about you. That use falls within the exemptions to the right to limit, but the practical control remains in your hands: withhold location permission, or delete the saved site.
• Non-discrimination. Exercising any of these rights will not get you worse service or a different price. Feature differences between Free and Pro reflect the subscription you chose, nothing else.

Categories collected in the preceding twelve months, in the statute's terms: identifiers (an opaque Apple subject identifier, an installation identifier, and an email address if Apple released one); commercial information (subscription and transaction records); internet or network activity (service-health events and operational logs); and geolocation data, including precise geolocation where you provide it.

To exercise a right, email [email protected] from the address associated with your account, or use the in-app deletion control, which is the fastest path. We will verify your request by confirming control of the account — for an account created through Sign in with Apple with a private relay address, that normally means making the request from inside the app. We respond within 45 days, and will tell you if we need the 45-day extension the statute permits.

An authorized agent may submit a request on your behalf with written proof of authorization; we may still ask you to verify your identity directly.

7.4 Other states

If you live in a US state with a comprehensive privacy law, you likely have rights comparable to those in §7.3. We apply the same process to every request regardless of where you live, so write to us and we will handle it.

8. Security

• All traffic between the app and our servers uses TLS. Data is encrypted at rest.
• Session refresh tokens, sign-in nonces, Apple authorization codes, and API tokens are stored only as SHA-256 hashes. Plaintext is never persisted.
• The Apple refresh token is encrypted with AES-GCM under a versioned key, held in a managed secret store.
• Device attestation is required at the forecast boundary in production, and assertion counters are checked to reject replayed requests.
• Rate limits apply to attestation, forecast, and API-token traffic.
• Production runs from immutable, digest-pinned container images inside a private network.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your personal information, we will notify you and any required regulator as the law requires.

9. Children

Stratocheck is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us personal information, email [email protected] and we will delete it.

10. International users

Stratocheck's forecast coverage is the continental United States, and our infrastructure is in the United States. If you use Stratocheck from outside the US, your information will be processed in the US, where privacy laws may differ from those of your country.

11. Changes to this policy

We will post any change here and update the "Last updated" date. If a change materially reduces your privacy — for example, if we began collecting something this policy says we do not collect — we will give notice in the app before it takes effect, and where the law requires consent, we will ask for it.

12. Contact

Domisomi LLC [email protected]

If you are unsatisfied with our response, California residents may contact the California Privacy Protection Agency or the California Attorney General.