Privacy

This notice covers the metXplorer frontend and its enabled products, including the dashboard, weather and air-quality forecasts, meteograms, pressure diagrams, station data, Pandonia, radiosondes, nowcast, satellite imagery, webcams and map editor. Actual processing depends on the features you use and the enabled services identified below.

Controller and contact

Controller: [To be completed by the operator]
Address: [To be completed by the operator], [To be completed by the operator] [To be completed by the operator], [To be completed by the operator]
Contact: [To be completed by the operator]

Operation, security and communication

Website and API access involves connection data, including IP address, time, requested resource and HTTP status, and depending on the server configuration, browser/device details, referrer and transfer size. Purposes are delivery, operational security, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR, with the interest in a secure, functioning service; Article 6(1)(b) applies where needed to perform an account function you requested.

Hosting provider: [To be completed by the operator]
Address and processing location: [To be completed by the operator]
Server-log retention: [To be completed by the operator]
Email provider and processing location: [To be completed by the operator]

Email enquiries involve your sender address, message, supplied details and communication metadata. Contract-related enquiries rely on Article 6(1)(b) GDPR; other enquiries on our legitimate interest in responding (point f). Necessary security and legal records may rely on points c or f. Consent is requested separately where required.

Enquiry retention: [To be completed by the operator]

Data products and maps

Weather models, ensemble members, air-quality fields, station observations, Pandonia measurements, radiosonde profiles, satellite and nowcast products are mainly fetched, cached and processed by our server. In such server-to-server requests the provider receives our server’s connection data. Your selection of location, station, parameter, model, date and time may be sent to our server to provide the requested view. Exported PNG, SVG or CSV files contain selected data, attribution and possibly your drawings; you control their subsequent sharing.

Maps may also fetch tiles, terrain or other resources directly from a mapping provider. Some images, such as external archived webcam images or editorial media, may be embedded directly. Such requests disclose your IP address and the requested resource to that provider; map tiles can indicate the area being viewed. Sources used in the suite include OpenFreeMap/OpenMapTiles, OpenStreetMap-based maps, terrain sources and foto-webcam.eu. Bundled maps, symbols and flags do not cause these external requests. The recipients configured for this installation are listed below.

Accounts, favourites and personal content

Optional registration processes first name, last name, country, email address, password hash and any optional address or profile picture. The purpose and legal basis are provision of the requested account under Article 6(1)(b) GDPR. An account cannot be created without required registration details; public data views remain available. Passwords are stored as salted hashes. Uploaded avatars retain the selected crop without original image metadata.

Stored account content includes dashboard widgets, locations and time zones, tile ordering and pins, favourites including webcams, display styles and privately saved map drawings with their title, geometry and modification time. These are assigned to the account to synchronise its functions. Profile pictures or drawings that you publish or export can be copied by recipients. Profile pictures have random file addresses; anyone who knows an address can retrieve that image.

Signed-in WordPress accounts can use the same personal frontend features. Association uses the WordPress user ID; matching email addresses alone do not merge accounts. WordPress passwords, email addresses and accounts are managed through WordPress. Access is restricted to authorised people who require it for operation and administration.

Verification and reset links expire after 15 minutes; visitor sessions after 30 days. For account security, up to ten successful sign-ins record time, device/browser category and method. Short-lived rate limits use one-way pseudonymous email/IP identifiers; these do not replace separate server logs. Scheduled cleanup removes unverified accounts after 30 days. Profiles, preferences and drawings remain until account deletion or individual removal. Visitor accounts can be deleted in the profile; WordPress accounts are managed through WordPress or by contacting the operator.

Region and location

Automatic IP country lookup is disabled on this installation. Regional views use a default, your manual choice or your profile country.

A precise device location is requested only after you use a location function and grant browser permission. It supports the requested map position or location selection. You may revoke that browser permission. Astronomy widgets use the selected coordinates and time zones; solar and lunar data are calculated in the browser. Locations saved in a personal dashboard form part of the account preferences.

Webcams and imagery

The webcam catalogue contains camera name, geographic location, region, provider, attribution and technical fetch information. Cameras are operated by their identified providers. Landscape or weather images may occasionally contain identifiable people, vehicles or private areas; please report rights concerns with the camera and time to our contact. metXplorer does not perform facial recognition or person tracking. Selection and republication by metXplorer are distinct from the provider’s original recording.

The webcam add-on fetches approved images and HLS streams through our server. Browsers receive internal media addresses. For these requests the original media provider receives our server’s connection data, not the viewer’s IP address. A provider link is requested only when opened. iframe source pages are not embedded by the add-on. HLS media are briefly cached without creating a permanent video archive. Viewer favourites are stored in their own account.

Automatic thumbnail storage: Disabled

The purpose is to provide requested weather and landscape information. Where imagery contains personal data, publication requires a lawful source and documented balancing of interests (Article 6(1)(f) GDPR); any necessary consent or other legal basis must be addressed separately. General attribution does not replace assessment of the rights of depicted people.

Cookies, local storage and app

The browser locally stores display choices such as light/dark mode, interface density, sidebar width and animation speed. Session storage avoids repeated startup animations. These entries support your selected controls and are not sent to an advertising service. Depending on the storage type they remain until the browser session ends or until you change or delete website data. Data and map caches store public resources with bounded sizes and lifetimes; they do not contain account passwords.

Name	Purpose	Category	Duration
`apc_consent`	Stores the selected consent choices and the consent-configuration version.	Strictly necessary	180 days
`metx_member`	Session after explicit visitor sign-in; HttpOnly, Secure and SameSite=Lax.	Sign-in function	30 days

The installable PWA uses a service worker. Its app cache holds at most 70 entries or 32 MiB of public page structure and static assets; account responses, administration pages and sign-in links are excluded. Installation grants no push, camera or microphone permission. The suite does not provide push notifications. Browser settings can remove cookies, local storage and the service worker; personal server data must be deleted separately in the account.

Statistics and optional services

Optional first-party audience measurement starts after consent to Statistics. It records visited sections, language, approximate country, times, session identifier, approximate active duration and sign-in status. Association uses one-way pseudonymous identifiers; raw IP addresses, complete URLs and search parameters are not stored in these statistics. Data remain on our server. The legal basis is Article 6(1)(a) GDPR. You can withdraw consent through Cookie settings; weather products remain usable without consent.

Statistics retention: 90 days

Enabled non-essential services load after consent (Article 6(1)(a) GDPR; terminal storage under section 165(3) TKG 2021). Reject, accept and later changes are available through the shared consent dialog. Withdrawal does not affect the lawfulness of processing before withdrawal. Necessary functions are separate.

AI and automated decisions

Published AI-assisted or AI-generated content is labelled on the affected product. The suite does not automatically send profile, location or drawing data to an AI service. If the operator enables such additional processing, its provider, purpose, data categories, legal basis, transfers and retention must be identified before it starts. The supplied account features do not make solely automated decisions about people with legal or similarly significant effects. Automated weather computation is distinct from such decisions.

Recipients, transfers and retention

Directly embedded recipients and processing locations: [To be completed by the operator]
Processors and safeguards for third-country transfers: [To be completed by the operator]
Backups: location and deletion cycle: [To be completed by the operator]

Personal data are retained only as long as needed for their purpose. Applicable legal retention duties or the necessary defence or exercise of specific claims may require longer restricted retention. Account deletion removes active account records and associated personal content; copies may remain in protected backups until the stated deletion cycle. Technical connection data are necessary for delivery. Other details are required only for the relevant optional feature.

Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You may object to processing based on legitimate interests on grounds relating to your particular situation. Consent can be withdrawn at any time for the future. Send requests to the privacy contact above; proportionate identity verification may be needed to protect your data. You may also complain to a competent data protection authority.

Austrian Data Protection Authority: Barichgasse 40–42, 1030 Wien · dsb@dsb.gv.at

dsb.gv.at

This notice is updated when features or services change. Text version: 12 September 2026.