Privacy

Last updated 6 September 2026. HuntPulse is operated by HuntPulse. Questions: nova.x.framework@gmail.com.

HuntPulse scores hunting conditions for places you tell it about and puts the result on a calendar. The location of somebody’s hunting ground is genuinely sensitive information, so this page tries to be specific about what happens to it — including the parts that are not reassuring.

What we collect

Your account — email address and a password hash (PBKDF2-SHA256; the password itself is never stored).
Your locations — the name you give a place, its coordinates, any property boundary you draw, any stand positions you mark, and which species you score it for.
Your journal — hunts you log, hunting pressure, food conditions, observations and free-text notes.
Billing records — invoices and payment status. We never see or store card numbers or Venmo credentials.
Operational logs — request records and the results of the daily forecast run, used to keep the service working.
What you send us — anything you write in the feedback form, and any email you send us.

We collect this from you directly. We do not buy personal information, do not build profiles from third-party sources, and do not infer anything about you beyond what the forecast needs.

No advertising, no trackers, no analytics that follow you elsewhere. We do not sell or rent personal information, and we do not share it with anyone except the service providers listed below.

Why we use it

To produce the forecast — the coordinates, terrain and species are what the score is computed from. Without them there is no product.
To deliver it — writing events to a calendar and sharing it with the address you nominate.
To bill you — issuing invoices, recording payment, chasing an unpaid one.
To keep the service working and secure — logs, rate limiting, debugging a failed run.
To answer you — support mail and feedback.

We do not use your information for any purpose materially different from these without telling you first.

How your locations are stored

A location marked private is split in two before it is written to the database. Its coordinates, property boundary, stand positions and resolved place name are encrypted with AES-256-GCM and stored as ciphertext. Only the name you chose, the timezone and derived terrain figures (elevation, slope, aspect) are stored in the clear — none of which identify where the ground is. Private locations are hidden from the administrative interface entirely, and no other user can see them.

The honest limit. Scoring your ground means decrypting it on our server every morning, so whoever operates HuntPulse holds the key and could recover any location. This design defeats database browsing, the admin interface and every other user — it does not defeat the operator. We claim exactly that much and no more.

Where your coordinates go

Encrypted at rest does not mean never transmitted. To produce a forecast we have to ask other services about your coordinates, and those requests necessarily contain them in the clear:

Open-Meteo — weather forecast, historical climate and elevation. Receives coordinates.
USGS (PAD-US) and BLM — public-land boundaries and the survey grid. Receive coordinates when you drop a pin.
Photon / OpenStreetMap Nominatim — place-name lookup. Receive coordinates when you drop a pin or search.
Esri — map tiles. Your browser requests these directly, so Esri sees the map area you are looking at.
State and county parcel services — only if you ask us to look up a parcel.

These requests carry a coordinate and nothing else — no account, no name, no label. None of these providers is told whose ground it is or that a person is hunting it. Each one is listed, with its terms, on the credits and data sources page.

Infrastructure

Neon — the database, encrypted at rest and in transit.
Vercel — hosting and the daily scheduled run.
Google — see below.

These providers process your information on our instructions only, under their own security commitments, and are not permitted to use it for their own purposes. All of them are located in the United States, which is where your information is stored and processed.

Google user data

HuntPulse uses Google APIs to deliver forecasts as calendars and to send billing email. It requests these permissions and uses them only as described:

Google Calendar — to create the calendars HuntPulse writes forecasts to, to add and update events on those calendars, and to share them read-only with an address you nominate. HuntPulse does not read, modify or store the contents of calendars it did not create.
Gmail send — to send you invoices and service notices. HuntPulse cannot read your mail; this permission only sends.

HuntPulse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold, and never used to train machine-learning models.

You can revoke HuntPulse’s access at any time at myaccount.google.com/permissions. Doing so stops calendar delivery; it does not delete your HuntPulse account.

Cookies and local storage

HuntPulse uses one cookie and a little browser storage. There are no advertising cookies, no third-party analytics tags, and nothing that tracks you across other sites — which is why you are not being asked to dismiss a consent banner.

hp_session — a signed, HTTP-only, same-site session cookie that keeps you logged in. Strictly necessary: without it there is no way to know the page is yours. Cleared when you sign out or when it expires.
Local storage — small display preferences, such as which basemap you last had selected. It stays in your browser and is never sent to us.
Map tiles — requested by your browser directly from the tile provider, which may set its own cookies under its own policy. See the credits page for who they are.

Blocking the session cookie will stop you being able to sign in. Clearing local storage only resets your map preferences.

Email you get from us

Invoices, calendar invitations, payment reminders and service notices are transactional — they are part of the service you are paying for, and you cannot opt out of them while your account is open, short of closing it. We do not send marketing email. If we ever start, it will have a working unsubscribe link and unsubscribing will not affect your invoices.

Security

Everything travels over TLS. Private locations are encrypted with AES-256-GCM at rest.
Passwords are stored only as PBKDF2-SHA256 hashes with a per-account salt. Nobody can look up your password, including us.
Session cookies are HTTP-only, same-site and signed, and every route that touches data re-checks that the record is yours rather than trusting the cookie’s say-so.
Access to production data is limited to the operator and used only to run and fix the service.

No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal information we will notify you and any regulator that requires it, without unreasonable delay and as required by applicable state law. If you have found a vulnerability, please tell us at nova.x.framework@gmail.com rather than testing it further — see our disclosure note.

How long we keep things

Account and location records are kept while your account is open. Most records are soft-deleted — marked deleted and hidden — so billing history stays auditable. There is one deliberate exception: deleting a private location destroys it outright, because its row holds the only copy of those encrypted coordinates and destroying them is the point. That cannot be undone.

Account, locations, journal — while the account is open, then removed on deletion apart from what is listed below.
Billing records — retained after account closure for as long as tax and accounting law requires, typically seven years.
Operational logs — short-lived, kept only as long as they are useful for debugging and abuse prevention.
Backups — deleted data may persist in backups until they age out on their ordinary cycle.

Your choices

Every location is private by default. You choose if one is listed publicly.
Only public-land locations may be listed publicly. Private ground never can be.
You can delete a location, which for a private one is irreversible.
You can delete your account and everything attached to it yourself, from your account page.
You can ask us to export or correct your information, or to delete it, by emailing nova.x.framework@gmail.com.

Your privacy rights

Several states — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others — give residents rights over their personal information. Rather than work out which statute covers you, we extend all of the following to everybody who uses HuntPulse, wherever you live:

Know and access — what we hold about you, where it came from, why we have it and who we share it with.
Get a copy — a portable export of the information you gave us.
Correct — fix anything inaccurate.
Delete — remove your information, subject to records we are legally required to keep, such as invoices.
Opt out of sale, sharing, targeted advertising and profiling — there is nothing to opt out of, because we do none of these. We have never sold or shared personal information for cross-context behavioural advertising, and we do not profile anyone for decisions with legal or significant effects.
Limit use of sensitive information — the coordinates of your ground are treated as sensitive and used only to produce the forecast you asked for. We use precise geolocation for nothing else.
No retaliation — exercising any of these rights will not get your service degraded, your price raised, or your account closed.

To make a request, email nova.x.framework@gmail.com from the address on your account, or tell us the address on the account so we can verify it is yours — we will not hand over somebody’s hunting locations to whoever asks. We reply within 45 days, and will tell you if we need longer. An authorised agent may act for you with written permission we can verify. If we refuse a request we will say why, and if you are in a state with an appeal right you may ask us to reconsider at the same address.

We do not respond to Global Privacy Control or Do Not Track signals differently from any other request, because we do not do the tracking those signals are designed to stop.

Children

HuntPulse is not directed at children under 13 and we do not knowingly collect their data. Accounts require you to be at least 18. If you believe a child has given us personal information, email nova.x.framework@gmail.com and we will delete it.

Changes

If this policy changes in a way that affects how your data is handled, we will say so here and update the date at the top. Where the change is material we will email the address on your account before it takes effect.

Contact

HuntPulse
[POSTAL ADDRESS — FILL IN BEFORE LAUNCH]
nova.x.framework@gmail.com