Privacy Policy

Effective date: August 31, 2026

Climateshed Action (“we,” “us,” or “our”) operates the Climateshed Action web app (the “Service”). This Privacy Policy explains what personal data we collect, how we use it, how long we keep it, and your rights under applicable law including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Much of the Service needs no account at all: the city VMT tool is public, and browsing it creates no account record. The data below is collected only when you sign in to the sensitivity-analysis tool.

1. Information we collect

• Email address — used to create your account and send one-time login codes (OTP). One account works across the Climateshed suite, so your sign-in record is shared with our other Climateshed products; your Climateshed Action access grants are not.
• Access grants and role — which jurisdictions your account may view, and your account role, used to enforce access.
• Authentication and operational logs — standard sign-in session records and server logs (such as IP address and request metadata) used to operate and secure the Service. Requests for the free per-jurisdiction VMT data are rate-limited per IP address, which requires the server to read the requesting IP; this applies whether or not you have an account.

2. What we do not collect

• Your scenario inputs. The levers you move and the results you generate are computed entirely in your browser. They are not transmitted to or stored by us.
• Exported files. CSV and notebook (.mnote) exports are assembled in your browser and downloaded directly to your device.
• Shared scenario links. A copied scenario link stores your inputs in the URL fragment (after the #), which browsers do not send to the server. We never receive it; anyone you send the link to can read the scenario from it.
• Payment card data. We do not collect or store card numbers.
• Advertising or cross-site tracking cookies. The Service uses no third-party advertising or analytics cookies, and runs no analytics product of any kind.

3. Cookies and browser storage

We use no tracking or advertising cookies. When you sign in, our authentication provider stores a session token in your browser’s local storage so you stay signed in and your session can refresh; it is essential to the sign-in feature and is cleared when you sign out. Signing in also means our authentication provider and host can see which jurisdiction pages your account requests, as part of enforcing access.

4. How we use your data

• To authenticate you and provide access to entitled jurisdictions.
• To operate, secure, debug, and maintain the Service.
• To communicate with you about your account or a request you submit.

We do not sell your personal data, and we do not use your data to train AI models. The Service is a deterministic calculator and does not send your inputs to any AI provider.

5. Data retention

We retain your account record (email, role, and access grants) for as long as your account is active. Operational logs held by our hosting provider are retained on a rolling short-term basis for security and troubleshooting, then rotated out. To request deletion of your account and associated data, email us at feedback@climateshed.app and we will process your request within 30 days. A newsletter subscription is held by Substack rather than by us; unsubscribe through the link in any issue, which is separate from deleting your account.

6. Your rights (CCPA / CPRA)

• Right to know — request a summary of the personal data we hold about you.
• Right to delete — request deletion of your personal data.
• Right to non-discrimination — we will not discriminate against you for exercising these rights.

To exercise these rights, contact us at feedback@climateshed.app.

7. Third-party services

We rely on the following providers to operate the Service:

• Supabase — authentication and database infrastructure. Your account data and access grants are stored in Supabase, protected by row-level security. See Supabase’s Privacy Policy.
• Fly.io — hosting for the web app, which is served from a region in the United States. Fly.io processes the request metadata described in Section 1 (including IP address) on our behalf. See Fly.io’s Privacy Policy.
• Cloudflare — DNS for our domains, and a standby copy of the site used if the primary host is unavailable. See Cloudflare’s Privacy Policy.
• Substack — our newsletter, California Climate Briefs. Subscribing is optional and separate from your account: we link you to Substack’s own subscribe page with your email address filled in, and nothing reaches Substack unless you submit that form there. If you do subscribe, Substack holds your subscription and you can unsubscribe with them at any time. See Substack’s Privacy Policy.

8. Data security

We use industry-standard practices including HTTPS encryption in transit, row-level security in the database, and token-based authentication. No system is completely secure, and we cannot guarantee the absolute security of your data.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy at this URL with a revised effective date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact

For privacy questions or data requests, contact us at feedback@climateshed.app.