Privacy

How ProbeHarbor handles your data (web and Android), who processes it, retention, and account deletion. Last updated October 9, 2026.

What we store

  • Account email and auth metadata (Supabase Auth)
  • Device and sensor configuration, temperature/humidity readings
  • Alert settings and delivery audit logs
  • Optional billing data via Stripe (we do not store card numbers)
  • Freeze alerts (no account needed): your email, the place name you picked, and its location rounded to about 1 km, used only to email you before freezing nights. Unsubscribing deletes the record.
  • On the Android app: session tokens on-device; optional Firebase Cloud Messaging device tokens when you enable push (used only to deliver your alerts)

We don't sell your data

We don't sell or rent your personal information or sensor readings, and we don't share them for advertising. We use the services below only to run ProbeHarbor.

Services that process data for us

  • Supabase: database, sign-in, and account emails
  • Cloudflare: hosting, alert and notice email delivery, bot checks (Turnstile), and file storage for history archives and shared chart images
  • Stripe: billing, for paid plans
  • Google Analytics and Ahrefs: traffic analytics on marketing pages only (see Analytics)
  • Sentry: error reports so we can fix bugs
  • Firebase Cloud Messaging: push notifications, if you turn them on
  • OpenWeather and the National Weather Service: the city or ZIP you search and the location you pick, to look up places and forecasts
  • Only if you set them up: the alert channels you choose (SMS through Twilio, Discord, Slack, Telegram, Microsoft Teams, ntfy, Pushover, WhatsApp, or your own webhook) receive the alert messages, and Google Nest or Ecobee when you connect a thermostat

Android app

The ProbeHarbor Android app (`dev.probeharbor.android`; early-access builds use `dev.thermaltrace.android`) is a client for this website. It does not read temperature from the phone. It signs in with your ProbeHarbor account and loads the same household readings and settings over HTTPS. Push notifications are optional and can be turned off in the app (Account) and under Alert settings on the web.

Retention

Raw sensor readings roll up and expire on a schedule (90 days default on Free; longer on paid plans). You can set a custom retention window under Dashboard → Settings. Archived snapshots may be stored in cold storage for Pro households and are deleted along with the household.

Export & deletion

Export JSON anytime from /api/user/export while signed in. Delete your account under Dashboard → Settings. This removes your sign-in, alert settings, push device tokens, and shared chart images, plus any household you own alone, with its devices, readings, and cold-storage archives. In a shared household, ownership passes to another member and the household stays. Account deletion on the website also applies to Android app access.

What stays elsewhere: Stripe keeps its own billing records for paid plans, as the law requires, and our hosting providers may hold encrypted backups for a limited time under their own policies. We don't restore deleted accounts from them.

Push notifications

Browser Web Push uses VAPID keys we control. The Android app may register an FCM device token when you enable push. Tokens are stored to deliver your household’s alerts and are removed when you disable push, sign out of push on that device, or delete your account. We do not sell push tokens.

Analytics

On public marketing pages (production), we load Google Analytics (GA4) and Ahrefs Web Analytics to understand traffic and referrals. Those scripts are not loaded on /dashboard or /api routes (except a few conversion thank-you paths). Product funnel events sent to GA are anonymized and never include live temperature readings. A short on-page notice appears the first time you visit a marketing page; dismissing it only hides the notice in this browser.

Contact

Privacy questions: Contact.