Privacy Policy

Effective 18 August 2026 · Last updated 18 August 2026

Indra is a satellite text-message weather service operated by Fin Taylor, a sole proprietor doing business as Indra ("Indra", "we", "us"). This policy explains what we collect, why, who else sees it, and how long we keep it.

Two things about Indra make privacy unusually concrete, and we want them stated at the top rather than buried:

• We hold your location plans. To send you a forecast for a place, we must store where you plan to be and when.
• We keep a full log of the messages we exchange with you. If a forecast we sent contributed to a decision in the field, we need to be able to reconstruct exactly what we said and when. That log includes message text and phone numbers.

1. Information we collect

All of it comes from you, or is generated by your use of the service. We do not buy personal information, and we do not collect it from data brokers or social networks.

We do not collect: your device's GPS position (Indra never reads your location automatically — see section 2), contacts, photos, health data, or advertising identifiers. We do not use third-party analytics or advertising trackers on our website or in our app.

2. Location information, specifically

Location is the most sensitive thing we hold, so here is precisely how it works.

We only ever have the locations you give us

Indra does not track you. It does not read your device's GPS, and it does not receive your position in the background. We hold location information in exactly three ways:

• Waypoints you save. Coordinates you type, drop on a map, or import from a GPX route file in the web app.
• Coordinates you put in a message. If you text us coordinates, we use them to answer that message.
• Your trip plan. Because a scheduled message pairs a date with a waypoint, your schedule amounts to a statement of where you intend to be, and when.

What that means honestly

Taken together, your waypoints, your schedule, and the message log constitute a record of your planned route and the last place you asked us about. Treat that as we do: as sensitive personal information. It is stored with your account, it is never sold, it is never used for advertising, and it is not shared with anyone except as described in section 5.

Coordinates leave our systems to fetch a forecast

We do not run our own weather model. To produce a forecast, we send the coordinates of the relevant point to our weather data providers (Open-Meteo and the United States National Weather Service). These requests contain the coordinates and nothing that identifies you — no name, no email address, no phone number, and no account identifier.

3. Text messages and the message log

Indra records every message it exchanges with your device — both directions — including the full text of the message, the phone number, and the time. This log is deliberate, not incidental.

The reason is safety accountability. People use these forecasts to decide whether to cross a pass, go for a summit, or stay in the tent. If a forecast we sent is ever questioned — by you, or in any investigation of an incident — we must be able to say exactly what we sent, when we sent it, and whether it was delivered. A service that could not answer that question would not deserve the trust the forecasts ask for.

Access to this log is limited to the operator of the service, and it is used only for the purposes in section 4. Because the log contains the location questions you asked and the forecasts we returned, it is treated as sensitive.

4. How we use information

• To deliver the forecasts and replies you asked for.
• To operate your account: signing in, pairing devices, and account notices.
• To fetch weather data for the locations in your plan.
• To diagnose delivery failures — late, missing, or duplicated satellite messages.
• To detect and prevent abuse, spam, and fraud, and to enforce our Terms of Service.
• To reconstruct what we sent, if a forecast is ever questioned after an incident.
• To bill you accurately, if you are on a paid plan.
• To comply with law, including lawful requests from public authorities.

We do not use your information for advertising, and we do not profile you for any purpose unrelated to delivering weather forecasts.

5. Who else receives information

We do not sell your personal information, and we never have. We do not share it for anyone else's marketing. We disclose it only to the service providers that make Indra work, and only what each one needs:

We may also disclose information:

• When the law requires it — in response to a valid subpoena, court order, or other lawful request. Where we are permitted to tell you about such a request, we will.
• In a life-threatening emergency — if search and rescue, law enforcement, or another emergency authority asks us for your last known planned location because you are the subject of an active rescue, we may provide it. Please note this is not a service we offer and not a capability you should rely on: Indra does not monitor you, will not notice that you are overdue, and cannot initiate a rescue. See our Terms of Service.
• In a business transfer — if Indra is ever sold or transferred, your information may transfer with it, subject to this policy. We would notify you first.

6. Mobile information and text messaging consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, and are excluded from all other use-case categories. Information sharing with subcontractors in support services, such as our messaging provider, is permitted solely to deliver the messages you requested.

You opt in to messages by adding your number to your own Indra account and then confirming possession of that device by texting a one-time pairing code back to us. You can stop all messages at any time by replying STOP, or get help by replying HELP. Message frequency varies and is determined by the schedule you create. Message and data rates may apply.

7. How long we keep it

The message log is kept longer than the rest for the reason given in section 3: it is the record of what we told you, and that is precisely the thing that may need to be checked long after a trip.

8. Your choices and rights

You can, at any time:

• See and correct your account, waypoints, and schedules directly in the web app.
• Remove a phone number from your account, which stops all messages to it.
• Stop messages by replying STOP from the device, or pause scheduled sends with SKED OFF.
• Request a copy of your data, including your message log, in a machine-readable format.
• Delete your account and the data associated with it.

To request an export or deletion, email [email protected]. We will respond within 30 days and will not charge you or degrade your service for exercising any of these rights.

Depending on where you live — including California, and the United Kingdom and European Economic Area — you may have additional rights to access, correct, delete, port, or restrict processing of your information, to object to processing, and to complain to your data protection authority. We honour these requests regardless of where you live. If you are in the UK or EEA, our lawful bases are performance of our contract with you (to deliver the service you signed up for), our legitimate interests (security, abuse prevention, and the safety accountability described in section 3), and compliance with legal obligations.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we do not process it for cross-context behavioural advertising.

9. Security

Practical measures, described plainly:

• Passwords are stored as salted hashes using scrypt, or PBKDF2-HMAC-SHA256 where scrypt is unavailable. We cannot read your password.
• Session tokens are stored hashed, so a copy of our session store cannot be turned into a working login.
• Session cookies are HttpOnly and SameSite=Lax, and are served over HTTPS.
• A device must prove possession of a phone number by texting back a single-use pairing code before we will send anything to it. This is what stops someone typing your number into their account and receiving your forecasts — or you receiving their location plan.
• Inbound messages from our messaging provider are cryptographically verified before we act on them.
• Sign-in, sign-up, and pairing attempts are rate-limited.

No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your personal information, we will notify you and the relevant authorities as the law requires.

10. Cookies

The Indra web app sets one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to function, and it is not used for tracking or advertising. We do not use analytics cookies, advertising cookies, or third-party trackers, which is why you are not being asked to dismiss a consent banner.

11. Children

Indra is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

12. Where your data is processed

Indra is operated from the United States, and your information is stored and processed there. If you use Indra from outside the United States, you are sending your information to the United States, where privacy laws may differ from your own. Where we transfer personal data out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses or another approved transfer mechanism.

13. Changes to this policy

If we change this policy we will update the date at the top. For any change that materially affects your rights or how we use your information, we will notify account holders by email before it takes effect.

14. Contact

Privacy: [email protected]
Support: [email protected]

Fin Taylor, doing business as Indra
San Francisco, California, United States
A postal address for formal notices is available on request by email.