Privacy Policy

What this covers

Omniscience is a small applied research group in New York City. This policy covers Meridian Weather for Android, this website, and any email you send us. A future app gets its own policy before it ships.

It doesn't cover Google Play itself — see Google's privacy policy for that. Play tells us nothing about you beyond anonymous install counts.

What leaves your phone

We're being careful here, because plenty of weather apps say "we collect nothing" and can't back it up. A weather app can't give you a forecast without telling someone which place. In Meridian that someone is a public weather agency, and the request goes from your phone to them directly.

A request carries the coordinates, the app's version number, and nothing else we add — no account, no advertising ID, no device fingerprint, nothing linking one request to another or to you. Your IP address is visible to whoever answers, as with any web request.

None of this exists in the app at all: analytics, crash reporting, ad SDKs, telemetry. Released builds strip out logging, so the app doesn't even write to your phone's own system log.

Where your location goes

Meridian reads from roughly 58 sources, nearly all government or public-sector weather, ocean, and hazard services. The app's Data sources screen lists them all and shows which are working right now. The main ones:

• US — NOAA and the National Weather Service (forecasts, tides, river levels, space weather, buoys), NASA (satellite imagery, fire detection), USGS.
• Europe — MET Norway, Germany's DWD, MeteoAlarm, EUMETSAT, the UK Environment Agency and SEPA, EMSC for earthquakes.
• Asia-Pacific — Japan Meteorological Agency, Hong Kong Observatory, Singapore's NEA.
• Canada — Environment and Climate Change Canada.
• Global — Open-Meteo (including the search that turns a place name into coordinates), RainViewer, GDACS.

Each is a third party with its own privacy policy. We have no arrangement with any of them and can't see what they log. Coordinates only go to sources covering the place you're looking at — a US river gauge service isn't asked about Japan.

How exact is the position?

That depends on a setting you control. The app only ever asks for approximate location, and when Android gives it a rough fix — the normal case — the app rounds that to about 5.5 km before using, storing, or sending it.

Android also lets you grant precise location yourself, in system settings. Do that and the app gets a fix accurate to metres and uses it as-is, with no rounding — so street-level coordinates go out to the sources covering that place. We'd rather tell you than have you find out.

Either way, requests carry no more than about 11 metres of precision, and how accurate the fix was stays on your phone.

Two addresses that are ours

The AirNow and FIRMS sources can point at a small relay we run, so an API key doesn't have to be buried in the app where anyone could dig it out. Both are off by default and unset in the shipping app — nothing reaches them unless you turn one on. If you do, we don't log it.

Permissions

The full list, as the app ships.

There's no storage permission — the app can't reach your files, photos, contacts, calendar, messages, or call history. No Bluetooth or USB either.

What stays on your phone

In the app's private storage, which Android walls off from other apps:

• your saved and recent places;
• your settings and units;
• cached responses and map tiles;
• any API key you've added yourself.

We can't see any of it — there's no mechanism by which we could.

The Data sources screen shows which sources are working, but only from memory. Close the app and it's gone. Nothing is written to disk, so there's no diagnostic file to find or leak.

Clearing it

Both controls live in the overflow menu on the Data sources screen:

• Clear saved places — removes recent and favourite places. It deliberately leaves your unit preferences alone.
• Clear cache — drops cached responses and map tiles.

There's no single button that erases everything. For that, clear the app's storage in Android settings, or uninstall.

Backups, and your own API keys

Backup is switched off for the app, and its settings are kept out of both cloud backup and phone-to-phone transfer. Saved places contain coordinates, so they stay on the phone that recorded them.

A couple of sources let you add your own API key. It's stored on your phone, shown masked and never filled back into the field, and sent only to that one provider in the header that needs it. It never comes to us.

Google Play Data safety

Play requires a Data safety form that matches this policy. Here's what we declare.

The website, and emailing us

omniomniomni.com is a static site: no cookies, no analytics, no third-party scripts or fonts, no forms. It's hosted on Cloudflare Pages, which sees what any host sees — IP address, time, page requested, browser — to serve the site and block attacks, under its own privacy policy. We don't try to identify visitors.

Email is the only way to reach us, and we use what you send only to reply. No mailing list, no marketing, and we don't pass your address on. We clear out threads older than about two years, or sooner if you ask. Email isn't secure, so don't send anything you'd hate to have exposed.

Keeping it safe

Most of this is structural: there's no account database to breach and no record of your requests, because neither exists. Beyond that —

• Everything goes over HTTPS.
• Released builds strip out logging, so the app writes nothing to the system log where another tool might read it. We test that this stays true.
• A rough fix is rounded before it's used, not after, so nothing more exact is left sitting around. (Granting precise location bypasses this, as above.)
• Settings are excluded from backup and phone transfer, so saved coordinates don't travel.
• On-device data sits in private app storage, covered by your phone's encryption if you have a lock screen. Setting one is the most useful thing you can do here.

Nothing is perfectly secure. If we learn of a breach involving anything we hold, we'll investigate and tell the people affected.

Kids

Meridian isn't aimed at children or designed to appeal to them, and we don't knowingly collect anything from anyone under 13. If you think a child emailed us personal information, tell us and we'll delete it.

Your rights

Wherever you are, you can ask what we hold about you, ask us to fix it, or ask us to delete it. The answer is nearly always "only the email you sent us" — there's no server, no account, and no record of your use of the app.

In California you can also opt out of your information being sold or shared for advertising. We do neither and never have — nobody pays us for anything, and no advertiser gets anything. (Play's Data safety form uses "shared" in a wider sense, which is why section 6 says location is shared: it means the weather agencies, not advertisers.) We won't treat you differently for asking. In Europe and the UK you can additionally object, get a portable copy, withdraw consent, and complain to your data protection authority. We do no profiling.

Just email and say what you want. We may ask something to check we're talking to the right person. It's free, and we aim to sort it within 30 days.

Changes

When the app changes, we update this page and the date above. If something significant changes — a new kind of data leaving your phone, or anything reaching us for the first time — we'll say so in the app first and ask you to agree. Carrying on using the app won't count as agreeing.

Reaching us

Questions about this policy, or about what a particular source receives — a person reads these.