Privacy
Privacy notice
Stormy Fans keeps as little about you as it can: only what your card needs. This notice explains what is stored, why, who helps run the site, and how to have your data corrected or deleted.
Last updated 1 October 2026.
Who is responsible
Stormy Fans is run by REFLECTOPIA LLC.
Write to [email protected] with any question about this notice or your data.
Visiting the site
Reading the site needs no account, sets no cookies, and runs no analytics or advertising. Fonts and images come from this site itself. Like any web host, Cloudflare processes your IP address and browser details to deliver each page and to protect the site from attacks; the club does not see or keep them.
What the club stores about members
| What | Why | How long |
|---|---|---|
| Your email address | To send sign-in links, and to know which card is yours | Until you leave |
| The name on your card | It is printed on your card | Until you leave |
| Your card number and the date you joined | Both are shown on your card | Until you leave |
| Your stamps, and when you earned each one | Your collection, your tier, and the back of your card | Until you leave |
| The stamps you pinned, and whether you asked for the newsletter | Your card's back, and sending the newsletter if you asked for it | Until you change them or leave |
| Letters you send to Stormy, and whether each may be shown on the fan wall | So Stormy can read them, and feature the ones you allowed | Until you leave |
| Your vote in each forecast | One vote per member; only totals are ever shown | Until you leave |
| How many wrong codes you entered in the last hour | To stop codes from being guessed | Until you leave |
| A fingerprint of each sign-in link, with the address it went to and, for a join link, the name you chose | To check a link when you open it | A link works for 30 minutes and is deleted a day later |
| A fingerprint of your sign-in cookie | To keep you signed in | 30 days, or until you sign out |
A fingerprint here is a one-way hash: it lets the club recognize a link or a cookie when it comes back, but it cannot be turned back into either. The club does not store passwords, IP addresses, or anything about how you use the rest of the site.
If someone asks for a sign-in link for an address that has no card, that address is kept the same way as a sign-in link, only to limit how many emails it receives, and is deleted a day later.
Letters, the wall, and the newsletter
A letter you send goes to Stormy, and its first lines are emailed to the club's admin address so it gets read. A letter appears on the fan wall only if you ticked the box that allows it, and then only with the name on your card, your card number, and the date. Your email address is never shown on the site. The club's admins can see members' addresses, card names, stamps, and letters, because running the club needs them.
The newsletter is off until you turn it on in Your card, and you can turn it off there at any time. If you turn it on, your address is used to send the newsletter and for nothing else.
Codes, check-ins, and card downloads
When you enter a code, the club records which code gave your stamp, never the code itself. A "Stamp my card" link on one of Stormy's sites tells the club only which site sent you and when, and that site learns nothing about you from it. When you save or print your card, it is drawn in your own browser, and nothing about it is sent anywhere.
The one cookie
When you sign in, the site sets a single cookie named __Host-sf_session. It holds a random code that keeps you signed in for 30 days, and it is deleted when you sign out or leave. It is strictly necessary for the membership you asked for, so it does not need your consent. Visitors who never sign in receive no cookies at all.
The bot check
The join and sign-in forms use Cloudflare Turnstile to tell people from automated programs, which keeps the club's emails from being misused. It loads only when you start filling in one of those forms. Cloudflare then processes your IP address, details of your browser, and the address of the page, to detect bots and, as a controller in its own right, to improve that detection. Turnstile does not see what you type into the form. Cloudflare describes this in its Turnstile privacy addendum.
Who helps run the site
Cloudflare, Inc. hosts the site, keeps the club's database in its Western Europe region, sends the club's emails, and runs the bot check. Cloudflare processes this data on the club's behalf under its data processing addendum. When data reaches the United States, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework. Its own practices are in the Cloudflare privacy policy.
Leaving the club deletes your data from the database at once. Cloudflare keeps restore points of the database for 30 days, so deleted data is gone from those within 30 days as well.
The legal basis
Storing what your card needs is part of providing the membership you asked for (Article 6(1)(b) of the General Data Protection Regulation). Delivering the site securely, running the bot check, and limiting how many emails an address receives rest on the club's legitimate interest in keeping the site available and protected from abuse (Article 6(1)(f)).
Your rights
Your card page shows what the club stores about you, the fan wall page shows your letters, and you can change your card name, your address, and the newsletter yourself. You can leave from Your card at any time, which deletes your membership, your letters, and your votes at once. You also have the right to ask for a copy of your data, to have it corrected, to restrict or object to its use, and to receive it in a portable form. Write to [email protected]. You can also complain to a data protection supervisory authority, for example the one where you live.
Changes
When this notice changes, the date at the top changes with it.