Privacy

Last updated 28 September 2026. HuntPulse is operated by Cameron Gillum d/b/a HuntPulse. Questions: info@huntpulse.club.

HuntPulse scores hunting conditions for places you tell it about and puts the result on a calendar. The location of somebody’s hunting ground is genuinely sensitive information, so this page tries to be specific about what happens to it — including the parts that are not reassuring.

What we collect

Your account — email address and a password hash (PBKDF2-SHA256; the password itself is never stored).
Your locations — the name you give a place, its coordinates, any property boundary you draw, any stand positions you mark, and which species you score it for — and, if you set one, your own date for the rut on that ground. Stands you import from a GPX or KML file are read on your device; only the points you choose are sent to us, and they are stored exactly like stands you place by hand.
Forecast history — the grade and score each morning’s run gave each upcoming day, so we can tell you when a day changes and how settled it is. Grades and scores only; no coordinates are stored with them.
Sit outcomes — when you tap how a sit went (saw nothing, some, or a lot), that answer and the grade the forecast gave the sit. Used, pooled with every other hunter’s and with no location attached, for the figures on how accurate the grades are. They never change your score.
Hunting preferences — the weekdays you usually hunt, and the weapon you hunt each calendar with, if you set them.
Alert preferences — which hunt alerts you want and the grade that counts as worth going, plus a record of which alerts we sent you and when.
Your journal — hunts you log, hunting pressure, food conditions, observations and free-text notes.
Billing records — invoices and payment status. We never see or store card numbers or Venmo credentials.
Operational logs — request records and the results of the daily forecast run, used to keep the service working.
What you send us — anything you write in the feedback form, and any email you send us.

We collect this from you directly. We do not buy personal information, do not build profiles from third-party sources, and do not infer anything about you beyond what the forecast needs.

No advertising, no trackers, no analytics that follow you elsewhere. We do not sell or rent personal information, and we do not share it with anyone except the service providers listed below.

Why we use it

To produce the forecast — the coordinates, terrain and species are what the score is computed from. Without them there is no product.
To deliver it — building the calendar feed you subscribe to, at a private address you nominate.
To alert you — emailing you the best day of the coming week, and when a day in your forecast crosses your grade, if you have those alerts switched on.
To bill you — issuing invoices, recording payment, chasing an unpaid one.
To keep the service working and secure — logs, rate limiting, debugging a failed run.
To answer you — support mail and feedback.

We do not use your information for any purpose materially different from these without telling you first.

How your locations are stored

A location marked private is split in two before it is written to the database. Its coordinates, property boundary, stand positions and resolved place name are encrypted with AES-256-GCM and stored as ciphertext. Only the name you chose, the timezone and derived terrain figures (elevation, slope, aspect) are stored in the clear — none of which identify where the ground is. Private locations are hidden from the administrative interface entirely, and no other user can see them.

The honest limit. Scoring your ground means decrypting it on our server every morning, so whoever operates HuntPulse holds the key and could recover any location. This design defeats database browsing, the admin interface and every other user — it does not defeat the operator. We claim exactly that much and no more.

Where your coordinates go

Encrypted at rest does not mean never transmitted. To produce a forecast we have to ask other services about your coordinates, and those requests necessarily contain them in the clear:

Open-Meteo — weather forecast, historical climate and elevation. Receives coordinates.
USGS (PAD-US) and BLM — public-land boundaries and the survey grid. Receive coordinates when you drop a pin.
LocationIQ — place-name lookup. Receives coordinates when you drop a pin or search. Its data is derived from OpenStreetMap.
Esri — map tiles. Your browser requests these directly, so Esri sees the map area you are looking at.
US Census Bureau — which county your ground is in, so your state’s season dates can be filled in. Receives coordinates once, when the ground is added. We keep the season dates and the two-letter state; the county is not stored.
USDA NASS — your state’s weekly crop harvest figures. Receives the two-letter state and the year, never coordinates.
State and county parcel services — only if you ask us to look up a parcel.

These requests carry a coordinate and nothing else — no account, no name, no label. None of these providers is told whose ground it is or that a person is hunting it. Each one is listed, with its terms, on the credits and data sources page.

Infrastructure

Neon — the database, encrypted at rest and in transit.
Vercel — hosting and the daily scheduled run.
Amazon Web Services (SES) — sends our outgoing email. Receives your email address, your name and the contents of the message, which for an invoice includes the labels you gave your ground and what you owe.
Google — see below.

These providers process your information on our instructions only, under their own security commitments, and are not permitted to use it for their own purposes. All of them are located in the United States, which is where your information is stored and processed.

How your calendars are delivered

Forecasts reach you as a calendar feed you subscribe to once, at a private address unique to you. Any calendar app reads it — Google Calendar, Apple Calendar, Outlook, or whatever is on your phone. Subscribing happens entirely in your own app: HuntPulse is not connected to your calendar account, holds no permission on it, and cannot see anything in it.

Anyone who has the feed address can read that calendar, which is what makes sharing it with a hunting partner work. Treat it like a password, and if it gets out, ask us to reissue it.

Google user data

HuntPulse is not currently using any Google API and holds no permission on your Google account. Calendars are delivered by the subscription feed described above, and our email is sent through Amazon SES.

The integration below exists in the product and may be switched on again. If it is, this page will say so before it happens, and it would request only these permissions:

Google Calendar — to create the calendars HuntPulse writes forecasts to, to add and update events on those calendars, and to share them read-only with an address you nominate. HuntPulse does not read, modify or store the contents of calendars it did not create.
Gmail send — to send invoices and service notices. HuntPulse cannot read your mail; this permission only sends.

HuntPulse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold, and never used to train machine-learning models.

You can revoke HuntPulse’s access at any time at myaccount.google.com/permissions. Doing so stops calendar delivery; it does not delete your HuntPulse account.

Cookies and local storage

HuntPulse uses one cookie and a little browser storage. There are no advertising cookies, no third-party analytics tags, and nothing that tracks you across other sites — which is why you are not being asked to dismiss a consent banner.

hp_session — a signed, HTTP-only, same-site session cookie that keeps you logged in. Strictly necessary: without it there is no way to know the page is yours. Cleared when you sign out or when it expires.
Local storage — small display preferences, such as which basemap you last had selected. It stays in your browser and is never sent to us.
Map tiles — requested by your browser directly from the tile provider, which may set its own cookies under its own policy. See the credits page for who they are.

Blocking the session cookie will stop you being able to sign in. Clearing local storage only resets your map preferences.

Email you get from us

Invoices, calendar invitations, payment reminders and service notices are transactional — they are part of the service you are paying for, and you cannot opt out of them while your account is open, short of closing it. We do not send marketing email. If we ever start, it will have a working unsubscribe link and unsubscribing will not affect your invoices.

Hunt alerts are different: they are optional emails about the ground you asked us to score — a weekly note of the best day ahead, and on Pro and Club a note when a day crosses the grade you chose. They name your ground by the label you gave it and never carry coordinates. Every alert has a one-click link that turns them off without signing in, and you can change or stop them any time from your account page. Turning them off changes nothing else about your account.

Security

Everything travels over TLS. Private locations are encrypted with AES-256-GCM at rest.
Passwords are stored only as PBKDF2-SHA256 hashes with a per-account salt. Nobody can look up your password, including us.
Session cookies are HTTP-only, same-site and signed, and every route that touches data re-checks that the record is yours rather than trusting the cookie’s say-so.
Access to production data is limited to the operator and used only to run and fix the service.

No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal information we will notify you and any regulator that requires it, without unreasonable delay and as required by applicable state law. If you have found a vulnerability, please tell us at info@huntpulse.club rather than testing it further — see our disclosure note.

How long we keep things

Account and location records are kept while your account is open. Most records are soft-deleted — marked deleted and hidden — so billing history stays auditable. There is one deliberate exception: deleting a private location destroys it outright, because its row holds the only copy of those encrypted coordinates and destroying them is the point. That cannot be undone.

Account, locations, journal — while the account is open, then removed on deletion apart from what is listed below.
Forecast history — kept while the location it belongs to exists, and deleted with it.
Alert records — kept while the account is open, and deleted with it.
Sit outcomes — kept while the account is open, and deleted with it, at which point they also leave the pooled accuracy figures.
Billing records — retained after account closure for as long as tax and accounting law requires, typically seven years.
Operational logs — short-lived, kept only as long as they are useful for debugging and abuse prevention.
Backups — deleted data may persist in backups until they age out on their ordinary cycle.

Your choices

Every location is private by default. You choose if one is listed publicly.
Only public-land locations may be listed publicly. Private ground never can be.
You can delete a location, which for a private one is irreversible.
You can delete your account and everything attached to it yourself, from your account page.
You can ask us to export or correct your information, or to delete it, by emailing info@huntpulse.club.

Your privacy rights

Several states — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others — give residents rights over their personal information. Rather than work out which statute covers you, we extend all of the following to everybody who uses HuntPulse, wherever you live:

Know and access — what we hold about you, where it came from, why we have it and who we share it with.
Get a copy — a portable export of the information you gave us.
Correct — fix anything inaccurate.
Delete — remove your information, subject to records we are legally required to keep, such as invoices.
Opt out of sale, sharing, targeted advertising and profiling — there is nothing to opt out of, because we do none of these. We have never sold or shared personal information for cross-context behavioural advertising, and we do not profile anyone for decisions with legal or significant effects.
Limit use of sensitive information — the coordinates of your ground are treated as sensitive and used only to produce the forecast you asked for. We use precise geolocation for nothing else.
No retaliation — exercising any of these rights will not get your service degraded, your price raised, or your account closed.

To make a request, email info@huntpulse.club from the address on your account, or tell us the address on the account so we can verify it is yours — we will not hand over somebody’s hunting locations to whoever asks. We reply within 45 days, and will tell you if we need longer. An authorised agent may act for you with written permission we can verify. If we refuse a request we will say why, and if you are in a state with an appeal right you may ask us to reconsider at the same address.

We do not respond to Global Privacy Control or Do Not Track signals differently from any other request, because we do not do the tracking those signals are designed to stop.

Children

HuntPulse is not directed at children under 13 and we do not knowingly collect their data. Accounts require you to be at least 18. If you believe a child has given us personal information, email info@huntpulse.club and we will delete it.

Changes

If this policy changes in a way that affects how your data is handled, we will say so here and update the date at the top. Where the change is material we will email the address on your account before it takes effect.

Contact

Cameron Gillum d/b/a HuntPulse
2135 Spring Grv E, Mobile, AL 36695
info@huntpulse.club