Privacy Policy

Last updated 28 August 2026

This policy explains what personal data the Geronimo IoT platform (“the Service”) holds about you, why, for how long, who else sees it, and what you can do about it. Geronimo Engineering is the data controller. It is written to match how the software actually behaves; the fuller engineering document behind it is DATA_HANDLING.md in the source repository of the open-source platform the Service is built on.

1. What we collect

Sensor readings themselves are environmental measurements, not personal data, though a sensor's coordinates and name may identify a property.

2. What we do not do

We do not sell personal data, run advertising, use third-party analytics or tracking cookies, or profile you. We collect no more than the table above. Some pages do, however, ask your browser to fetch maps, weather and public gauge data straight from the organisations that publish them, and those organisations see your IP address when it does — §4 names every one of them.

3. Who can see what

• Other members of your groups see the sensors, rules and pages shared into those groups, and your username on things you created.
• Anyone on the internet can read the Community board without an account: your posts, comments and pictures, with your username, are public pages, may be cached by intermediaries and may be indexed by search engines. Writing needs an account (an invited one, or a community account created with a phone number we can text a code to). When you delete your account your own posts, comments, pictures and votes are deleted with it, but copies a search engine or another visitor already took are outside our control.
• Anyone on the internet sees a sensor you marked public — its name, coordinates, notes and readings — through the open map, the public analytics page, group sites, shared links and the open data API. Recipients' addresses and your account details are never public.
• Operators of this deployment (superusers) can see account details and the audit log in order to run and secure the Service.

4. Where data goes outside the Service

4a. Providers we send data to

We use a small number of providers to run the Service. Each receives only what its job needs:

Some of these providers are outside your country. We do not control what they retain; their own policies apply.

4b. Sites your browser contacts directly

Several pages do not fetch maps, weather or public gauge data through our servers: they tell your browser to ask the organisation that publishes it. That is a deliberate choice — it means those readings are never stored here, and never pass through here — but it has a privacy cost you should know about, because we cannot stand between you and them. Each of the sites below receives your IP address, the address of the page you were on, and whatever the request itself contains (a station identifier, map coordinates, or the ZIP code you typed into the weather panel). None of them is sent your name, your email address, your account or any of our cookies. We have no agreement with any of them and no control over what they log or retain; their own policies apply.

If you would rather not contact any of them, do not open a map, a chart or an external station: the rest of the Service works without those requests.

5. How long we keep it

6. Your rights and controls

• Access and export. Your profile page has a “Download my data” button that returns everything we hold about you as a file.
• Correction. Edit your details on your profile; edit sensors, rules and posts where you have rights.
• Deletion. Your profile page has a “Delete my account” control. It removes your name, email, username, phone number and all second-factor material, and deletes your assistant sessions. Sensors, rules, QC decisions and notes you created are kept as part of the record but re-attributed to an anonymous placeholder; readings are never deleted.
• What deletion does not remove. The security audit log keeps the username as it was at the time and the IP address of each action, because a security record that its subject could rewrite would not be one. This is retained under our legitimate interest in the security of the Service.
• Objection and complaints. Contact us at the address below. If you are in the EU/EEA or UK you may also complain to your supervisory authority; California residents have the rights set out in the CCPA, and the export and deletion controls above are how we honour them.

7. Security

Traffic is encrypted in transit. Passwords are hashed; second-factor secrets, phone numbers and API keys are encrypted at rest; per-sensor credentials are stored as digests. Access is by explicit permission grant, all privileged actions are logged to a tamper-evident audit chain, and backups are encrypted and tested. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

8. Children

The Service is not directed at children and we do not knowingly hold accounts for anyone under 16.

9. Changes

We will update this policy when the Service changes what it does with data. The date at the top is the current version; material changes are announced to account holders.

10. Contact

Geronimo Engineering — [email protected].