Last updated: October 9, 2026

Mast Cell Decoded (“we”, “us”) runs mastcell.net, which offers tools for people with mast cell activation syndrome (MCAS), starting with a 5-day environmental forecast, with more tools on the way. Some of what you may tell us is about your health, so we’ve tried to keep this policy short, plain, and strict about what we do with it.

The short version

  • We collect as little as we can: an email address, a password (stored scrambled), and the location you want a forecast for.
  • We never sell your information, and we don’t use it for advertising.
  • Health information you enter is yours. We never sell it or use it for advertising.
  • You can delete your account, and the data that comes with it, at any time.

What we collect

When you use the forecast without an account, you enter a location (a ZIP code or a city). We use it to build your forecast. We keep a list of places that have been looked up, with their map coordinates, so we don’t have to look them up again, but not who looked them up.

When you create an account, we store:

  • Your email address, to log you in and contact you about your account.
  • Your password, stored only as a one-way hash. We can’t see it.
  • Your location (a ZIP code or a city), if you choose to save one.
  • Two-factor authentication details, if you turn it on, stored encrypted.
  • Your settings, such as your preferred units and whether you want forecast emails.

When you subscribe, your payment is made through Link, a service of our payment provider Stripe, which acts as the seller of record for payments. You enter your payment details on Stripe’s secure checkout page, and Stripe and Link handle them under their own privacy policies; we never see or store your full card number. Link may offer you a Link account to manage your subscription. From Stripe we keep only what we need to run your subscription: a customer reference, a subscription reference, whether your subscription is active, and when it renews or ends.

When you sign up for updates, we store your email address to tell you about new features.

When you contact us through the contact form, we receive what you write, plus your name and email address if you choose to include them, by email. We use them only to read and reply to your message.

When you use tools that let you record information about your health (as they launch), we store what you choose to enter. This is health information, and we treat it that way. See “Your health information” below.

Automatically, like most websites, our servers record basic technical details with each visit: your IP address, browser type, the pages you visit, and when. We use these to keep the site running and secure.

How we use it

  • To build your forecast and run the features you use.
  • To log you in and keep your account secure.
  • To send account messages (like password resets) and, if you signed up, occasional updates about new features. Every update includes a way to unsubscribe.
  • To email you your forecast, if you’re a subscriber and turn that on. You can turn it off at any time on your account page.
  • To fix problems and protect the site from abuse.

We don’t use your information for advertising, and we don’t build profiles about you to sell or share.

Your health information

Any health information you enter is treated with extra care. We:

  • Use it only to provide the tools to you, such as your history and the patterns you see.
  • Never sell it, and never share it for advertising.
  • Will tell you without unreasonable delay if it is ever exposed in a security breach, as the FTC’s Health Breach Notification Rule requires.

We are not a healthcare provider, so health privacy laws like HIPAA generally don’t apply to us. We hold ourselves to the commitments above anyway.

Who we share it with

  • Service providers that help us run the site, such as our web host, our email delivery service, and Stripe (including Link), which handles payments. They may only use your information to provide their service to us.
  • Forecast data providers. To find a new location on the map, we send the ZIP code or place name to a mapping service. To build a forecast, we send the location’s map coordinates to our weather, air quality, and pollen data providers. We send them a location, not who you are. Geomagnetic data is the same everywhere, so it doesn’t need your location.
  • When the law requires it, such as a valid court order, or to protect someone’s safety.
  • If Mast Cell Decoded is ever sold or merged, your information may move to the new owner, who must keep this policy’s promises or ask for your consent first.

Cookies

We use only the cookies the site needs to work: a session cookie that keeps you logged in, a security token that protects forms from being misused, and, if you check “Keep me logged in”, one that keeps you logged in for up to 30 days. We don’t use advertising or tracking cookies. If that ever changes, we’ll update this policy first.

Keeping it safe

Passwords are hashed, two-factor authentication is available, and the site uses encryption (HTTPS) in transit. No system is perfectly secure, but we work to protect your information and limit who can access it.

Keeping and deleting it

We keep your information while your account is open. If you delete your account, we delete your personal information within 30 days, except where the law requires us to keep something, and except for backups, which are overwritten on a regular schedule.

Your choices and rights

You can:

  • See the information we hold about you.
  • Correct it.
  • Delete your account and its data.
  • Get a copy of your data.
  • Unsubscribe from updates at any time.

Depending on where you live, you may have more rights under state privacy laws. To use any of these, contact us below. We won’t treat you differently for using your rights.

Children

Mast Cell Decoded is for adults. We don’t knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll let account holders know by email before it takes effect.

Contact us

Questions or requests: [email protected]