duoTemp Weather Privacy
duoTemp has no accounts, analytics, ads, tracking or third-party SDKs. It sends only what it needs to fetch a forecast, nothing is sold or shared, and nothing it handles identifies you.
Your location
If you allow location access, duoTemp uses it only to fetch the forecast for where you are and to name the place. Before any request leaves your iPhone, the coordinates are rounded to 2 decimal places, about 1 km. Your exact location is never sent anywhere. You can turn location access off at any time in the iOS Settings app and still use saved places.
Where requests go
- MET Norway forecasts. Requests go through duoTemp's own caching proxy at api.trough.dev, which runs on Cloudflare. The proxy passes on only the rounded coordinates, plus the date and UTC offset for sunrise and sunset times, to MET Norway. It writes no logs. Answers are cached by request, so people nearby share the same cached forecast. As with any website, Cloudflare handles your IP address to deliver the request.
- Apple Weather. When you open a place's detail screen, duoTemp asks Apple Weather for the chance of rain, wind gusts and visibility, and iOS sends that place's rounded coordinates directly to Apple. If you choose Apple Weather as your forecast source in Settings, all forecasts come from Apple the same way.
- Place names and search. The name of your current location comes from Apple's geocoder, and searching for a place sends the text you type to Apple Maps.
- Northern lights. The aurora forecast is a single global file from GFZ Potsdam, with NOAA SWPC as a fallback, fetched through the same proxy. No location is sent for it; your iPhone decides whether to show the card.
Apple's services are covered by Apple's privacy policy, and Cloudflare's handling of request data by Cloudflare's privacy policy.
What stays on your iPhone
duoTemp keeps your saved places, settings, your last known location and recent forecasts in the app's own storage on your iPhone, so it and its widgets open quickly. The last known location is kept at full precision only to name the place without asking Apple again. This data never leaves the device, nothing is synced to a server, and widgets use the same on-device data and forecast providers. Deleting the app deletes all of it.
Who is responsible
duoTemp is made by David McPhearson, who is responsible for the data described here (the data controller under the GDPR). Contact: privacy@trough.dev.
- Legal basis. Rounded coordinates and request data are processed to give you the forecast you asked for, and under a legitimate interest in keeping the proxy secure.
- Cloudflare. Cloudflare runs the proxy on my behalf under its data processing agreement. It may handle data outside your country, including in the United States; transfers from the EU, UK and Switzerland are covered by the Data Privacy Framework and standard contractual clauses.
- Retention. The proxy keeps no logs. To keep the forecast service for duoTemp only, the app proves to it that it's the genuine app using Apple's App Attest. This identifies the app install, not you, and the service doesn't store it. Its cache holds only rounded coordinates and keeps each forecast no longer than its expiry time, at most 6 hours. Cloudflare keeps request data only for the periods set out in its policy.
- Children. duoTemp collects nothing that identifies anyone, including children.
Your rights
Depending on where you live, you can ask for access to, correction or deletion of your personal data, or object to how it is used. Email privacy@trough.dev. duoTemp holds nothing that identifies you, so there may be nothing to return, but I will answer every request. If you are in the EU or UK, you can also complain to your data protection authority.
Changes
If this policy changes, the date at the top of this page changes with it. The policy for the trough.dev website itself is at trough.dev/privacy.