HailHawk privacy policy
Updated September 28, 2026
This policy explains what information TCoates LLC, doing business as HailHawk ("HailHawk", "we", "us"), collects when you use the HailHawk website and software services (the "Services"), how we use it, who we share it with, and the choices you have. It is part of the HailHawk terms and conditions.
We hold the information you give us and the customer records you import. We use them only to run the Services for you. We do not sell them, and we do not use them for advertising. Storm data is public federal data and is not personal information.
1. Information you give us
- Account information. Your name, email address, company name, and role when you create an account or are invited to one, plus the password you choose (stored only as a one-way hash by our authentication provider).
- Customer records. The contact, job, and lead reports you import from your CRM, and any customers you add by hand. These typically include your customers' names, property addresses, phone numbers, email addresses, job identifiers, lead status, and the sales representative assigned to them.
- Work you do in the app. Which customers your team has called, the outcome recorded for each call, notes, and which storms you have viewed. This is what makes the call list and the "who to call first" order work.
- Messages to us. Anything you send to support@hailhawk.app.
2. Information collected automatically
- Sign-in session. A cookie that keeps you signed in. It is required for the Services to work and is removed when you sign out.
- Preferences in your browser. Your text size, light or dark theme, and which panels you last had open are stored in your browser's local storage. They never leave your device.
- Technical logs. Our hosting providers keep ordinary server logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting. We do not run advertising trackers, third-party analytics, or social-media pixels on the Services.
3. How we use information
We use the information above to:
- match public storm records against your customers' addresses and tell you who was likely hit;
- send storm alerts and account emails (sign-in links, password resets, invitations) to you and the users you invite;
- build the call list, lead scores, storm history, swath maps, and distance reports you see in the app;
- keep the Services secure, diagnose problems, and prevent abuse;
- respond when you contact us; and
- bill you for the Services, where applicable.
We do not sell personal information, we do not share it with data brokers, and we do not use your customer records to market to your customers or to build anything for anyone other than you. Your customer records are yours; as set out in the Terms, we process them only as your service provider.
4. Who we share information with
We share information only with the providers that run the Services on our behalf, each bound to use it only for that purpose:
- Supabase hosts our database and handles sign-in. All account and customer data is stored there, in the United States.
- Vercel serves the website and application.
- Resend delivers our email. It receives the recipient address and the content of each alert or account email we send.
- GitHub runs the scheduled job that fetches storm data and matches it against your customers. Customer addresses pass through that job in memory while it runs.
- The US Census Bureau geocoder receives each customer's street address, and nothing else, so we can place it on a map. No names, phone numbers, or account details are sent.
- OpenFreeMap serves the base map tiles in the swath map. Like any web map, your browser requests tiles directly from it, which reveals your IP address and the map area you are viewing, but none of your customer data.
Storm data itself comes from NOAA (the Storm Prediction Center, the Severe Weather Data Inventory, and the Multi-Radar Multi-Sensor system). Nothing about you or your customers is sent to NOAA; we only download public records.
We may also disclose information if required by law or legal process, to protect the rights, safety, or property of HailHawk or others, or as part of a merger, sale, or transfer of our business, in which case this policy continues to apply to the transferred information.
5. Within your company
Everyone with a user account under your company sees the same customer records, storms, and call history. Owners and managers can invite and remove users and change their roles. Account owners are responsible for who they let in.
6. How long we keep information
We keep your account and customer records for as long as your account is active. Radar replay frames for the storm map are kept for two weeks and then deleted; storm summaries and matches are kept so your storm history remains available. When an account is closed, we delete its users, customer records, matches, and call history from our live systems; copies may persist in encrypted backups for a limited period before they are overwritten. We may keep records we need for billing, legal, or security purposes for as long as the law requires.
7. Your choices and rights
- Access and correction. You can view and edit your customer records and your own account details in the app at any time.
- Export. On request we will provide your customer data in a reasonable format.
- Deletion. You can delete individual customers in the app, and you can ask us to close your account and delete everything associated with it.
- Email. Storm alerts and account emails are part of the Services rather than marketing; you can change who receives alerts in your settings. We will not send you marketing email without your consent, and any we send will include an unsubscribe link.
Depending on where you live, you may have additional rights under laws such as the Colorado Privacy Act or the California Consumer Privacy Act, including the right to know what personal information we hold, to have it deleted, and not to be discriminated against for exercising those rights. We do not sell personal information or use it for targeted advertising, so there is nothing to opt out of in that respect. To exercise any right, email support@hailhawk.app from the address on your account; we will verify the request and respond within the time the applicable law allows.
If you are a customer of a roofing company that uses HailHawk, that company controls your information and decides how it is used. Please direct requests to them. We will help them respond.
8. Security
Data is encrypted in transit and at rest. Each company's records are isolated at the database level so that no account can read another's. Access to production systems is limited to the people who operate the Services. No system is perfectly secure, and you are responsible for keeping your credentials confidential and for the people you invite to your account.
9. Children
The Services are a business tool for roofing companies and are not directed to anyone under 18. We do not knowingly collect information from children.
10. Where data is processed
HailHawk operates from Colorado and stores data in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States.
11. Changes to this policy
When we change this policy we will post the new version here with a new date. If a change materially reduces your rights, we will tell account owners by email before it takes effect.
12. Contact
Questions or requests about privacy: support@hailhawk.app. TCoates LLC, Colorado, United States.