What we collect, what we don’t, and why.

Who we are

RainWillCome is operated by RainWillCome BV, a company being registered in the Netherlands. [Placeholder, the legal entity does not exist yet; “RainWillCome BV” is the intended name, in registration. KvK number, registered address, and VAT number to be inserted on incorporation, before public launch.] We are the "data controller" under the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), and the Israeli Privacy Protection Law (PPL). RainWillCome is not currently launched in the United Kingdom; the UK GDPR does not apply to us because we do not target UK consumers.

What we collect

Account data. Email address, password (hashed and salted with bcrypt by Supabase Auth), and the date you signed up. If you choose to provide a name during signup, that name is encrypted into your vault and we do not hold it in plaintext.

Your encrypted vault. A single ciphertext blob holding everything sensitive: questionnaire answers, household roster, plans, medications, inventory, drills, resilience responses. Encrypted on your device with a key derived from your password using Argon2id. The key never leaves your device, so the blob we store is ciphertext we cannot decrypt.

Team data. For every team you join: the team’s UUID, a membership row recording your role and status (active or pending), and timestamps. The team’s shared notes, roster, and chat messages are encrypted under a team key that lives in your vault, we hold ciphertext only.

Skill directory profile (optional). If you choose to publish a profile, the fields you enter on the form (display name, country, city, skills, additional skills, wishes, preferences) are stored in a server-readable table. They are visible to other authenticated RainWillCome users when you set the findable toggle to on.

Technical data. IP address at signup and at each login (used for security and abuse-detection purposes), browser user-agent, and timestamps of key actions. We do not run third-party analytics or advertising trackers.

Payment data. Handled by our payment provider, Paddle (as Merchant of Record) for customers outside the Netherlands, and Mollie for customers in the Netherlands. RainWillCome receives transaction metadata (subscription tier, status, date) but not your card number.

Abuse-report data. If you report a message via the in-app button or via abuse@rainwillcome.com, we keep the plaintext of the reported message (which you have consented to share), the reporter and reported user IDs, the team ID, and your context notes.

What we do not collect

• The plaintext of any message, note, or roster entry.
• The plaintext of your vault.
• Analytics or advertising tracker data, we run none.
• Phone numbers, real names (unless you put them in your vault), or biometrics.
• Behavioural profiles for advertising. We do not sell or share personal information for cross-context behavioural advertising, ever.

Precise location (GPS)

For tailoring the readiness plan we use only coarse location, the country and (in the US) the state you pick in the questionnaire. We do not silently read your IP location and we do not store GPS coordinates as part of your profile.

Three specific features ask the browser for your precise location, only when you trigger them, and only for the specific action you started:

• Accompany Me (family channel): when you choose to share your location with your household, your current coordinates are added to that one share, end-to-end encrypted to your family.
• SOS button: tapping it shares your current coordinates with your family channel, end-to-end encrypted. So they can follow you if you are moving, your location is then updated up to six times over the following hour while the app is open. You can stop the updates at any time, and your coordinates are never stored on our servers.
• Map planner: a “use my location” button centres the map on you. If you choose Save this map, that view, the map image and its centre coordinates, is stored on your device only (up to five, deletable any time) and printed into the household binder you generate. It is never sent to our servers.

None of these features run in the background, the SOS location updates run only while the app is open in a tab. You can decline the browser permission at any time.

Medical information, general advice by default

In most launch territories, the European Union, Switzerland, Israel, and the US states of Washington, Nevada, and Connecticut, RainWillCome does not collect personal medical information on our servers. The questionnaire skips the questions that would otherwise ask about medications, conditions, or medical equipment, and the medication ledger (a Tier 2+ tool) stores its rows only on your device, never sent to our servers. The printable household binder is the backup.

In the rest of the United States the medication ledger works as a full, cross-device feature stored encrypted in your vault, because no consumer-health-data law in those states applies to it. You can also choose to keep meds device-only at any time.

Why we use it (legal bases)

For users in the EU / EEA / Switzerland:

• Performance of contract (GDPR Art. 6(1) (b)): account data, vault storage, team membership rows, payment data, technical data necessary to operate the platform.
• Legitimate interest (GDPR Art. 6(1) (f)): abuse-detection logs, rate-limit logs, IP logging at signup and login, moderation audit log. Balancing test favours these because they protect the platform and other users without involving advertising or profiling.
• Consent (GDPR Art. 6(1)(a)): skill directory publication (you toggle findable on), abuse-report submission (you consent per report).
• Legal obligation (GDPR Art. 6(1)(c)): cooperation with valid legal process; CSAM-related record preservation under the US REPORT Act when US users are involved.

Who we share it with (sub-processors)

We use the following service providers. Each is bound by a data-processing agreement that meets the GDPR requirements; none has any right to use your data for its own purposes. Every transfer outside the EU/EEA relies on the EU-US Data Privacy Framework where the vendor is certified, with Standard Contractual Clauses as a fallback.

• Supabase , Postgres database + authentication. Data hosted in the EU (Frankfurt). DPA in force.
• Vercel , application hosting. EU-US DPF certified; SCCs in DPA.
• Cloudflare , Turnstile anti-bot (security only, no user profiling). EU-US DPF certified.
• Proton , staff mailbox at rainwillcome.com. Switzerland; EU adequacy applies.
• Brevo , the sender behind signup-confirmation and password-reset emails. France; data stays in the EU. Open and click tracking are switched off, so these emails carry no pixel and no rewritten links.
• Postmark , the sender behind contract confirmations and receipts. United States; SCCs in the DPA. Open and click tracking are refused in every request we send, not merely disabled in a setting, so these emails carry no pixel and no rewritten links either.
• Maps: OpenStreetMap / OpenFreeMap (basemap tiles) and OpenRouteService (search and directions). No tracking; tiles served under the OpenStreetMap Open Database License. Loading map tiles exposes your IP address to the tile server, as with any web map.
• Public-data lookups (US risk features): when you request address-level US risk information, your address is sent once to the US Census Geocoder to turn it into coordinates (we do not log or store it), and your coordinates or state are sent to public hazard feeds (FEMA flood maps, NOAA/NWS alerts, USGS) and to Open-Meteo for weather. These return public data; no account identifiers are ever sent.
• Payments: Paddle as Merchant of Record for customers outside the Netherlands, and Mollie for customers in the Netherlands. These are independent data controllers for payment data; they never receive your vault and we never see your card number.

Law enforcement. Only under valid legal process. See the Law Enforcement Cooperation page for the exact data we can and cannot produce.

Other users. If you publish a skill directory profile, other authenticated RainWillCome users see the fields you chose to publish. Members of a team you join see your team membership row and the encrypted data you put into the shared blob.

International transfers

Supabase processes data on our behalf in EU regions. Where transfers outside the EU/EEA occur (for example, to US vendors), we rely on the European Commission’s standard contractual clauses (SCCs) and supplementary measures.

How long we keep it

• Account & vault. While the account is active. On deletion, removed within 30 days.
• Rate-limit log. Garbage-collected at read time; rows older than the relevant window are deleted automatically.
• Moderation audit log. 12 months.
• Abuse reports. 12 months unless tied to a CSAM-related preservation duty (see below).
• CSAM-related records. At least 12 months following report to NCMEC, per the US REPORT Act of 2024 (18 USC §2258A(h)).
• Billing records. 7 years, as required by Dutch tax law.
• Server access logs. 30 days unless tied to an active investigation.

Security

Sensitive data is encrypted on your device before it leaves: master key derived from your password via Argon2id (m=19MB, t=2, p=1, OWASP 2023 first-tier recommendation), payloads encrypted with AES-256-GCM, fresh 12-byte IV per encryption. Recovery is via a long random recovery key generated at signup and shown to you once. Lose both the password and the recovery key and the vault is gone, we cannot recover it. See the /security page for the threat model and the source files (lib/crypto.ts, lib/vault.ts) for the implementation.

One honest limit, named plainly because that is part of doing this right: the vault we store, we cannot read. Your key is made on your device and never sent to us, so what sits on our servers is ciphertext with nothing to open it. That is the design, not a matter of our goodwill. Like every encrypted service where the provider delivers the code, on the web or in an app, it rests on one thing: the code that does the encrypting, which your device receives from us, has to be genuine. If that code were tampered with, data could be read before it is encrypted. Keeping that from happening, against both outside attack and our own mistakes, is a core security responsibility; the /security page lists the concrete safeguards.

If you enable fingerprint unlock in the app, your biometric is handled entirely by your device’s operating system, we never receive, store, or transmit it. It only unlocks a copy of your vault key held in your phone’s secure hardware; that key never leaves your device or reaches us.

In the event of a personal-data breach, we notify the Dutch Autoriteit Persoonsgegevens within 72 hours where required by GDPR Art. 33, and we notify affected users promptly when there is a high risk to their rights and freedoms.

Your rights, EU / EEA

Under the GDPR, you have the rights to: access, rectify, erase ("right to be forgotten"), restrict processing, data portability, object, and not be subject to solely automated decisions. To exercise any of these, email privacy@rainwillcome.com. We respond within one month. If you are unsatisfied, you can lodge a complaint with the Autoriteit Persoonsgegevens (Netherlands), or your local supervisory authority.

Local authorities for launch territories:

• Netherlands · Autoriteit Persoonsgegevens (AP)
• Germany · BfDI and your state DPA
• Belgium · Gegevensbeschermingsautoriteit (GBA / APD)
• Italy · Garante per la protezione dei dati personali
• France · CNIL
• Austria · Datenschutzbehörde (DSB)
• Spain · Agencia Española de Protección de Datos (AEPD)
• Portugal · CNPD
• Denmark · Datatilsynet
• Sweden · Integritetsskyddsmyndigheten (IMY)
• Finland · Tietosuojavaltuutettu (Data Protection Ombudsman)

Your rights, Switzerland

The Swiss FADP gives you rights of access, rectification, deletion, and objection. Contact privacy@rainwillcome.com. The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC). At our current scale, processing is neither regular nor large-scale and we are not required to appoint a Swiss Article 14 representative; we will reassess as we grow.

Your rights, United States

RainWillCome does not currently meet the user-volume thresholds of most US state privacy laws (CCPA / CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, etc.). Even so, we apply the following rights to all US residents who ask:

• Right to know what personal information we hold.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information, see the "Do Not Sell or Share My Personal Information" statement below.
• Right to non-discrimination for exercising these rights.

Do Not Sell or Share. We do not sell or share personal information for cross-context behavioural advertising or for monetary or other valuable consideration. This link is provided in line with the California CPRA convention. Email privacy@rainwillcome.com with the subject "Do Not Sell or Share" for the record, if you wish.

Global Privacy Control (GPC). RainWillCome honours GPC signals as a valid opt-out under California law. Because we do not sell or share personal information in the first place, GPC is honoured by default.

Maryland MODPA (effective Oct 1, 2025). Maryland residents have additional rights against the sale of sensitive personal information; we do not sell any personal information.

COPPA. RainWillCome is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe we have, email privacy@rainwillcome.com and we will delete it promptly.

Take It Down Act (NCII). If non-consensual intimate imagery of you appears on RainWillCome, submit a removal request via the Notice & Action form. We aim to act within 48 hours.

Your rights, Israel

Under the Privacy Protection Law 1981 as amended by Amendment 13 (effective 14 August 2025), Israeli residents have rights of notice, access, correction, and deletion. Contact privacy@rainwillcome.com. The Israeli supervisory authority is the Privacy Protection Authority (PPA).

Children

You must be at least 16 to use RainWillCome. Several launch territories set the digital-consent age lower than 16 (Belgium, Portugal, Denmark, Sweden, Finland at 13; Austria, Italy, Spain at 14; France at 15) and the US COPPA bar is 13. We apply 16 across the board to keep the policy simple, defensible, and protective. If you believe a child under 16 has created an account, email privacy@rainwillcome.com.

Cookies and browser storage

RainWillCome sets no tracking cookies, no analytics cookies and no advertising cookies. There is no tracking pixel and no third-party script that sets one, and there never will be.

We set no cookies at all, of any kind.

What we do use is your browser’s local storage, on your device, under the rainwillcome.* namespace: your Supabase sign-in token (so you stay logged in, or in session storage only if you untick “keep me signed in”), your theme and language preference, your encrypted vault and the working state of the tools you use. Local storage is not sent to our servers with each request the way a cookie would be, and it is not readable by other sites.

Storing information on your device requires consent under the EU ePrivacy Directive (Art. 5(3)) and the German TDDDG (§ 25) unless it is strictly necessary to provide the service you asked for. That exemption is about the purpose, not the technology, so it covers local storage exactly as it covers a cookie. Everything we store is strictly necessary in that sense, the access cookie above included, so no consent banner is required. You can clear it at any time through your browser settings; clearing it signs you out and removes the local copy of your vault.

Push notifications

If you turn on a notification in the app, your browser gives us a push subscription: a delivery address at your browser vendor’s push service plus two encryption keys. We store exactly that, with the time it was created, in a table that is not linked to your account, so a subscription row on its own does not say who you are. There are three kinds:

• Family alerts (the SOS button, the Accompany Me timer): filed under a code derived from your family code, which we never see in clear.
• Readiness nudges: one shared channel for every device that opted in; the message is the same fixed text for everyone.
• Fire alerts: filed under a coarse region code, a roughly 50 km grid cell worked out on your device from the city you named, never from an address. The server learns only that some device wants fire alerts for that region.

One honest consequence: a device that turns on more than one of these uses the same delivery address for each, so on our side those rows can be seen to belong to the same device, and a family channel could be placed in a region at that coarse, city-level grain. Nothing finer than that exists anywhere in our systems. Turning a notification off removes its row.

Automated decision-making

RainWillCome does not subject you to decisions based solely on automated processing with legal or similarly significant effects. Rate-limit triggers, abuse signals, and account suspensions are reviewable by a human and can be appealed via legal@rainwillcome.com.

Changes

We will update this policy when we add features, change vendors, or in response to changes in law. Material changes will be announced at least 30 days before they take effect.

Contact

Data Protection Officer (interim, until appointed): privacy@rainwillcome.com. Postal address in the imprint.