Privacy Policy

Effective Date: June 25, 2026

Operator: Whisker Tech LLC

1. Overview

This Privacy Policy describes how Whisker Tech LLC ("we," "us," or "our") collects, uses, and protects your information when you use Groundwave ("the Service"). We are committed to protecting your privacy and being transparent about our data practices.

2. Information We Collect

Information You Provide

Account information: Email address, name, amateur radio callsign
Profile information: License class, grid square, city, state (populated from FCC ULS data when you claim your callsign)
Club content: Messages, documents, event details, net check-in logs, and club page content that you create or upload
Election ballots: Your votes in club elections. Individual ballots are confidential. Only aggregated results are disclosed to club members. Club administrators cannot see how individual members voted.
Payment information: Processed by Stripe. We do not store credit card numbers. We receive transaction confirmations and subscription status from Stripe.

Information Collected Automatically

Usage data: Pages visited, features used, timestamps
Device information: Browser type, operating system, screen resolution
IP address: Used for security, rate limiting, and approximate geolocation for the marketing site map background

Information from Third Parties

FCC ULS: When you claim your callsign, we look up your FCC license data (name, callsign, license class, grid square, city, state) from the FCC Universal Licensing System public database. This data is stored in your profile.
QRZ.com: During net check-ins, we look up operator information (name, location, license class) from the QRZ XML API to auto-populate check-in records.
Stripe: Subscription and payment status for club billing and dues collection.

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

Contractual necessity: Processing required to provide the Service you signed up for (account management, club features, notifications)
Legitimate interest: Processing for security, fraud prevention, service improvement, and abuse prevention
Consent: Processing based on your explicit consent (e.g., callsign verification, optional email notifications)
Legal obligation: Processing required to comply with applicable laws (e.g., financial record retention)

4. How We Use Your Information

To provide and maintain the Service
To authenticate your identity via magic link email login
To verify your amateur radio callsign
To display your profile information to other club members (name, callsign, verified status)
To send notifications about club activity (messages, events, membership changes)
To process subscription payments and dues collection
To enforce our Terms of Service and protect against abuse
To improve the Service based on aggregated, anonymized usage patterns

5. Club Data and Member Rosters

Clubs entrust Groundwave with sensitive organizational data. We take this responsibility seriously and make the following commitments:

Member Roster Privacy

Rosters are private. Club member lists are never publicly accessible. Only authenticated members of a club can see that club's roster.
We will not sell, license, or share member rosters with third parties, advertisers, data brokers, or any entity outside of Groundwave for as long as Whisker Tech LLC operates the Service. This applies to individual member records and to rosters in aggregate. In the event of a business transfer (see Section 6), the acquiring entity will be bound by this Privacy Policy until a new policy is communicated to you with at least 30 days' notice.
Visibility within a club is role-based. Club administrators and officers can see member email addresses for club communication purposes. Regular members can see names, callsigns, and verified status, but not email addresses.
Leaving a club removes you from that roster. When you leave a club or are removed by an administrator, your personal information is removed from that club's active member list. Content you contributed (messages, check-ins) may persist in anonymized form.

Club Operational Data

Club data belongs to the club. Documents, net logs, meeting minutes, event records, dues history, election results, and other club operational data are accessible only to club members with appropriate roles.
No data mining. We do not analyze, mine, or profile club operational data for advertising, marketing, or any purpose beyond providing and improving the Service.
No third-party access. We do not provide third parties with access to club data, except as required by law (see Section 6) or through service providers who process data solely on our behalf to operate the Service (see Section 6).
Aggregated statistics only. We may use anonymized, aggregated data (e.g., total number of events created across all clubs) to improve the Service. This data cannot be used to identify individual clubs or members.

We do not sell, rent, or trade your personal information. We share information only in these circumstances:

Within clubs: Your name, callsign, and verified status are visible to other members of clubs you join. Your email is visible to club administrators and officers for club communication purposes only.
Public club directory: Club names, callsigns, cities, and states are publicly visible in the club directory. Individual member information is not publicly listed.
Service providers: We share data with the following processors who handle data on our behalf to operate the Service:
- DigitalOcean (hosting and file storage)
- Stripe (payment processing)
- Resend (transactional email delivery)
Third-party APIs: The Service connects to the following third-party APIs, which are accessed under their own terms of service and privacy policies:
- QRZ.com (net check-in auto-lookup; callsign and session data transmitted)
- ipapi.co (IP-based approximate geolocation for marketing site map; IP address transmitted, no personal data stored)
- CartoDB/Stamen/Fastly (map tile delivery; IP address transmitted with tile requests)
- Google (web fonts via Google Fonts; IP address and browser User-Agent transmitted with font requests)
- unpkg.com/Cloudflare (JavaScript library CDN for marketing pages; IP address transmitted with asset requests)
Legal requirements: We may disclose information if required by law, court order, or government request. We will notify you of such requests where legally permitted.
Business transfers: If Whisker Tech LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

7. Data Storage and Security

Your data is stored on DigitalOcean infrastructure in the United States. Documents are stored on DigitalOcean Spaces (S3-compatible object storage) with encryption at rest. We use HTTPS/TLS encryption for all data in transit and follow industry-standard security practices.

Authentication uses JWT tokens with magic link email verification. We do not store passwords.

While we implement reasonable security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

8. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

Notify affected users via email within 72 hours of confirming the breach
Describe the nature of the breach and the types of data involved
Describe the measures taken to address the breach and mitigate harm
Provide guidance on steps you can take to protect yourself
Notify relevant regulatory authorities as required by applicable law

9. Data Retention

Account data: Retained as long as your account is active. Deleted within 30 days of account deletion.
Club content: Retained as long as the club exists. Messages, documents, and net logs persist even if the author deletes their account (content is disassociated from the deleted account).
Magic links: Login and callsign verification links expire after 15 minutes. Club invitation links expire after 7 days. All magic links are marked as used after a single use and cannot be reused.
Payment records: Retained for 7 years for accounting and tax purposes as required by IRS regulations.
Backups: System backups are purged within 30 days. Deleted data may persist in backups during this period.
Inactive accounts: Accounts with no login to the Service for more than 12 consecutive months may be deleted after 30 days' email notice, per our Terms of Service.

10. Your Rights

You have the right to:

Access your personal data via your Account page
Update your profile information at any time
Delete your account and associated personal data from the Account page
Export your data by contacting us at hello@groundwavehq.com. We will provide your data in a machine-readable format within 30 days.
Opt out of email notifications via your account settings. Note: transactional emails required to operate the Service (magic link login, callsign verification, club invitations, and account-related notices such as deletion warnings) cannot be opted out of while your account is active, as they are essential to authentication and service delivery.

11. For California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
Right to correct: You may request correction of inaccurate personal information we hold about you.
Right to delete: You may request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, legal obligations).
Right to opt-out of sale: We do not sell your personal information to third parties. We have not sold personal information in the preceding 12 months.
Right to limit use of sensitive personal information: You may request that we limit our use of sensitive personal information (such as your email address or precise geolocation) to only what is necessary to provide the Service.
Right to non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise these rights, contact us at hello@groundwavehq.com. We will verify your identity before processing your request and respond within 45 days.

12. For European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Right to access: Request a copy of your personal data
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your personal data ("right to be forgotten")
Right to restrict processing: Request that we limit how we use your data
Right to data portability: Request your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interest
Right to withdraw consent: Withdraw consent at any time for processing based on consent
Right to lodge a complaint: File a complaint with your local data protection supervisory authority

The data controller is Whisker Tech LLC. To exercise these rights, contact us at hello@groundwavehq.com. We will respond within 30 days.

The Service is hosted in the United States. By using the Service, your data is transferred to the US. We rely on Standard Contractual Clauses (SCCs) as the legal mechanism for such transfers where applicable.

13. Cookies and Tracking

Groundwave uses minimal cookies and local storage:

Authentication token: Stored in localStorage to maintain your login session
Theme preference: Stored in localStorage (light/dark mode)
View preferences: Stored in localStorage (grid/list view)

We use Umami, a privacy-focused, self-hosted analytics tool, on groundwavehq.com to collect anonymous pageview and event data (pages visited, browser type, screen size, referring site). This data is stored on our own infrastructure, is not shared with or sold to any third party, and cannot be used to identify individual users. We do not use third-party analytics services, advertising cookies, or tracking pixels.

14. Children's Privacy

The Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect information from children under these ages. If you believe a child has created an account, please contact us and we will promptly delete it.

15. International Users

The Service is hosted in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States. For EEA/UK users, please see Section 12 regarding GDPR rights and transfer mechanisms.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes at least 30 days in advance via email or in-app notification. The effective date at the top of this page indicates when the policy was last updated.

17. Contact

For privacy-related questions, data requests, or complaints, contact us at:

Whisker Tech LLC
Data Protection Inquiries
hello@groundwavehq.com