Privacy Policy

Last updated: July 12, 2026

Our guiding principle: collect only what is needed to understand how the app is used. We do not collect personal information and we never sell data.

1. Data Controller

2. Legal Basis for Processing

• Analytics and session recordings (PostHog): Article 6(1)(a) GDPR — your consent, given via the cookie banner on first visit. Both anonymous usage events and session recordings only begin after you accept; if you decline, neither is collected. You may withdraw consent at any time by clearing your browser's localStorage or enabling Do Not Track.
• App preferences (localStorage): Article 6(1)(f) GDPR — legitimate interest, as storing your saved cities, language, and timezone on your own device is necessary for the app to function between visits. This data never leaves your device.
• Widget location (browser widget only): Article 6(1)(a) GDPR — your consent, given by pressing “Use my location” in the widget’s settings and by granting your browser’s location permission. Withdraw it by choosing a different place in the widget, or by revoking the permission in your browser.
• Feedback form (Tally): Article 6(1)(a) GDPR — your explicit, voluntary action of submitting the feedback form. You choose what to write and whether to include your email address.

3. What we collect

No account is ever created or required. Email is only collected if you voluntarily provide it in the feedback form.

4. What we do not collect

• Personal identity information (name, email, phone) — unless you voluntarily provide your email in the feedback form
• Your GPS coordinates — in the app they are used in-session to look up a city name and then discarded. We do not log or store them. The browser widget (section 7a) is the one exception: if you press “Use my location” there, it keeps that position on your own device, rounded to roughly 110 metres, so it knows where to point next time. It is never sent to us.
• The content of anything you type into the search box beyond what PostHog records as a city-loaded event
• Payment information (the app is free)

5. Location (GPS and map picker)

If you tap "Detect my location", your browser prompts you to share your GPS coordinates. We use those coordinates solely to reverse-geocode a city name via Nominatim / OpenStreetMap and load weather data. The coordinates are not sent to our servers, not logged, and not stored. (The browser widget described in section 7a stores a rounded position on your device instead — see there.)

If you use "Pick on map" to choose a point, the map imagery (tiles) for the area you view is loaded directly from OpenStreetMap's tile servers. This means the area you pan and zoom to is disclosed to OpenStreetMap as part of loading those images — separate from the weather request. The map only loads when you open it. When you confirm a point, its coordinates are reverse-geocoded to a place name via Nominatim / OpenStreetMap, exactly as with GPS above; the coordinates are not sent to our servers, not logged, and not stored.

Granting location access is optional. You can search for any city manually instead.

5a. Shared location links

GribGrab writes the place you are currently viewing (its name and approximate coordinates, rounded to about 10 m) into the page address, so you can copy the address or use the Share button to send that exact view to someone else. Updating the address happens entirely in your browser — nothing is sent anywhere when it changes.

When you open a link that contains a location, that location is part of the web address your browser requests, so — like any web address — it is technically visible to our hosting provider as part of serving the page. It is not linked to your identity and we do not use or analyse it. The location in a shared link describes the place the sender was viewing, not where you or the sender are.

Location parameters in the address are removed from analytics data before anything is sent (see section 6).

6. Analytics — PostHog

We use PostHog (EU cloud, eu.i.posthog.com) to collect anonymous usage events. The events we send are:

• city_loaded — city name, country, approximate coordinates, and how the city was loaded (search, GPS, saved list, shared link, auto-refresh)
• location_detected — whether GPS detection succeeded or failed (no coordinates are sent)
• city_starred / city_unstarred — city name
• language_changed — PL or EN
• units_changed — Metric or Imperial
• timezone_changed — selected timezone
• city_removed — city name (when a saved city is removed)
• cities_reordered — triggered when you reorder your saved cities (no city names sent)
• consent_shown / consent_given — whether the consent banner appeared and what choice you made
• feedback_opened / feedback_submitted — that the feedback form was opened or submitted, and which trigger was used (icon, menu, or footer). No form content is sent to PostHog.
• share_clicked — that the Share button was used and how (system share sheet or copy link). The shared location is not sent with this event.
• $pageview — page URL and referrer (standard PostHog event). Any location parameters are removed from the URL before it is sent.

Each event also carries session-level context properties: app version, interface language, timezone setting, unit system (metric/imperial), whether the app is installed as a PWA, and aggregate counts of saved and recently viewed cities (e.g. "2 saved cities"). None of these identify you personally.

When you accept analytics, GribGrab generates a random anonymous identifier (gg_uid) on your device and uses it to create a person profile in PostHog. This enables cross-session analytics such as returning user counts and per-user usage patterns. The identifier is a random string — it contains no personal information. No name or email is attached to any event. PostHog's EU infrastructure is GDPR-compliant. See PostHog's Privacy Policy.

6a. Session recordings (Session Replay)

If — and only if — you accept analytics, GribGrab also records anonymised replays of your session using PostHog Session Replay (EU cloud). A session recording lets us watch how the interface is used — where people tap, scroll, hesitate, or hit a dead end — so we can find and fix usability problems we cannot see from event counts alone.

Everything sensitive is masked on your device before anything is sent:

• All text is masked — city names, forecast values, and every other piece of on-screen text appear as blocked-out placeholders in the replay, never as readable content.
• All form inputs are masked — anything you type, including into the search box, is never captured.

What remains is the page layout and your interactions with it (taps, clicks, scrolls, navigation). Recording does not start until you accept the consent banner — if you decline, or before you choose, no recording is ever made. Recordings are stored on PostHog's EU infrastructure and are linked to the same anonymous gg_uid person profile described above. They contain no name, email, or readable text.

7. Cookies and local storage

On your first visit to the GribGrab website, GribGrab shows a consent banner (the browser widget described in section 7a shows no banner, because it loads no analytics). Your choice is stored in localStorage as gg_consent.

• If you accept: PostHog sets a first-party cookie (ph_*) to maintain an anonymous session identifier between visits. A stable anonymous identifier (gg_uid) is also stored in localStorage and used to link your sessions in PostHog as a person profile.
• If you decline: PostHog runs in cookieless mode — no cookies are set and nothing is written to localStorage by PostHog. Anonymous aggregate events (e.g. which cities are viewed) are still sent without any device-linked identifier.

No other cookies are set by GribGrab itself. When you open the feedback form, Tally.so may store temporary form state in your browser. GribGrab uses localStorage to remember your saved cities, language preference, timezone, and unit system (metric/imperial). This data never leaves your device.

7a. Browser widget (Vivaldi Dashboard)

GribGrab offers a small widget page that can be added to Vivaldi’s Dashboard as a “Webpage widget”. It is served from gribgrab.com, so it reads the same on-device preferences the app already stores — your saved locations, language, unit system, and cached forecasts — in order to show the weather without asking you to configure anything. It writes only its own forecast cache and its own location choice.

The widget loads no analytics: no PostHog, no session recording, no cookies, and therefore no consent banner. It makes one kind of external request, to Open-Meteo, for the forecast itself. It does not use IP-based location, map tiles, reverse geocoding, or the feedback form.

The widget’s own settings let you pin it to one of your saved places, change units, or change language. Units and language are the same preferences the app uses, so changing them there changes them in GribGrab too. You can also press “Use my location”, which uses your device’s location — but only when you press it, and only if you have already allowed location access for GribGrab in a normal browser tab, because a widget cannot ask for that permission itself. That position is rounded to roughly 110 metres, stored on your device, and sent only to Open-Meteo to fetch a forecast; it is never reverse-geocoded and never sent anywhere else.

Removing the widget from your Dashboard stops all of this; clearing your browser’s site data for gribgrab.com clears what it stored.

8. Third-party data sources

Weather data and geocoding are fetched directly from third-party APIs. Their privacy policies apply:

This list covers the GribGrab website. The browser widget reaches Open-Meteo only — not OpenStreetMap/Nominatim, ipapi.co, or Tally.so.

• Open-Meteo — weather forecast data
• OpenStreetMap / Nominatim — reverse geocoding for GPS and map-picked locations, and map tiles for the "pick on map" feature (loading tiles discloses the area you view to OpenStreetMap)
• ipapi.co — IP-based country detection, used only on first visit (no saved cities) to show a default weather location. Your IP address is disclosed to ipapi.co as part of this request. No query is made on subsequent visits.
• Tally.so — feedback form service. Used only when you open and submit the feedback form. Your feedback text and optional email are stored by Tally on EU infrastructure.

9. Data Retention

• Anonymous PostHog events: retained by PostHog for 24 months
• Session recordings: retained by PostHog for 30 days, then automatically deleted
• Consent choice (gg_consent): stored in your browser's localStorage until you clear it
• Anonymous person profile identifier (gg_uid): stored in your browser's localStorage until you clear it; the corresponding PostHog person profile is retained for 24 months
• Saved cities, language, timezone: stored in your browser's localStorage until you clear it
• GPS coordinates: in the app, discarded immediately after geocoding — never stored. If you use “Use my location” in the browser widget, the widget stores that position on your device, rounded to about 110 metres, until you change it or clear your browser’s site data
• Widget location choice (gg_w_pin) and widget forecast cache (gg_wfc_*): stored in your browser's localStorage until you change them or clear it
• Feedback submissions: stored by Tally.so according to their retention policy

10. Your rights (GDPR)

You have the right to:

• Access — obtain information about data processed about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — request deletion of your data
• Restriction of processing — in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Objection — to processing based on legitimate interest
• Withdrawal of consent — at any time, without affecting the lawfulness of prior processing
• Lodge a complaint — with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl

Because we do not collect personal data linked to your identity, most rights apply in a limited way. To exercise any right, or to have PostHog session data associated with your browser removed, contact us by email.

You can also opt out of PostHog tracking at any time by enabling "Do Not Track" in your browser settings — PostHog honours the DNT header.

11. Children

GribGrab is not directed at children under 13 and does not knowingly collect any information from them.

12. Changes

We may update this policy to reflect changes in the app or applicable law. The "last updated" date at the top of this page will change accordingly. We will not retroactively use your data in ways that contradict a prior version of this policy.

13. Contact

Questions or requests: gribgrabapp@icloud.com