1) Location (browser / device)
If you enable location access in iWind, your browser or device may provide location data so iWind can show wind spots near you.
We do not store a location history and we do not create a movement/profile of your location.
2) Location without access (IP geolocation)
If you do not allow location access, iWind may estimate an approximate position using your IP address (IP geolocation).
This method is less accurate and often only at city/region level. We also do not store any location history in this case.
3) Local storage in your browser
To avoid having to set everything again on every visit, technical information such as your choices (for example “Use my location”
or “Allow analytics”) or a last used approximate position may be stored locally in your browser (cookies / website data).
You can delete this data at any time in your browser settings.
4) Analytics (e.g., Google Analytics)
If you allow analytics, Google Analytics may process usage data (for example page views, interactions, and technical information such as device/browser).
This helps us understand how iWind is used and improve it.
Internal iWind measurement
If you allow analytics, iWind also stores a random, pseudonymous visitor key for up to 180 days. It is used only in the protected admin area to recognise repeat visits in aggregate. It is not your IP address, name or login and is not used for advertising. If you reject analytics, this visitor key is not created.
Your choice: “Allow necessary cookies only” keeps analytics off. You can change your choice anytime under Privacy.
5) Server security and abuse prevention
To protect the service from overload, automated misuse and technical errors, iWind starts a pseudonymous security session when an HTML page is opened. The browser receives a random, technically necessary session identifier; iWind stores only its HMAC hash, never the raw identifier. The record can include the entry page and navigation, IP/ASN/provider, browser/device data, cookie decision, selected API requests, response metrics and WebSocket connection events. It is used for server security and troubleshooting, not for advertising. Security event details and inactive security session summaries are retained for seven days. The protected admin area also shows aggregated first-party usage statistics separately from optional Google Analytics. Normal page visits, map opening and a WebSocket connection remain permitted.
