Privacy policy

Last updated: 25 June 2026

This policy covers the Cascade Hydro website and account service. The Cascade Hydro desktop application is covered too, with one point worth stating up front: your precipitation data, project locations, and analysis files stay on your own computer. They are never sent to us.

What we collect

• Your email address, when you sign in. It identifies your account and is where we send your one-time sign-in link.
• A display name, only if you choose to set one. It is optional and you can change or clear it at any time.
• Account timestamps (when the account was created and last used) to operate the service.
• Sign-in and session tokens, stored only as one-way hashes. We cannot read the original values, and a database leak would not reveal anything usable to sign in as you.
• Your IP address, seen transiently with each request and used only for security and abuse prevention (for example, rate-limiting sign-in attempts). We do not use it to build a profile of you.

What we do not collect

• No passwords. Sign-in is passwordless (a one-time link), so there is no password to store, breach, or reset.
• No precipitation data, project locations, or analysis files. These never leave your computer.
• No hardware identifiers.
• No advertising or cross-site tracking.
• No payment card details. We do not process payments today. If we add them, a payment processor (Stripe) will handle card information and we will never store or see your card number.

How we use what we collect

Only to run the service: to sign you in, keep you signed in, operate your account, and protect the service from abuse. We do not sell your data, and we do not share it for advertising.

Cookies

After you sign in, we set a single essential session cookie so the site knows you are signed in. It is HttpOnly, Secure, and SameSite=Lax, and it is not used for tracking. Our marketing site uses a privacy-friendly, cookieless analytics measure that does not identify individual visitors.

Service providers

We keep the list short and use them only to deliver the service:

• Cloudflare hosts the site and database and serves your requests. Account data is stored in Cloudflare's infrastructure and encrypted at rest.
• Resend delivers your sign-in emails. It receives your email address for the purpose of sending the link.

How long we keep it

We keep your account information for as long as your account exists. One-time sign-in links expire within 15 minutes and can be used once. Browser sessions expire automatically. When you delete your account, we remove your account data.

Your choices

You can view your account details, change your display name, and sign out at any time from your account page. To access, correct, or delete your account and its data, email us and we will action it.

Account access and recovery

Because the only credential is control of your email address, signing in again with the same email always returns you to the same account. We deliberately store no secondary secret (no security questions, phone number, or backup codes). If you lose access to the email address itself, contact us and we will verify ownership before changing the address on the account.

Changes to this policy

If we make a material change, we will update the date above and, where appropriate, notify account holders by email.

Contact

Questions or requests: support@cascadehydro.ca.