Data Use Policy

Updated 12 October 2026

This page is for anyone who uses Heimdall Research data through the API, through an assistant connected to the MCP server, or from a downloaded file. It applies to people, companies, apps and automated agents.

It is a plain-words summary of the Terms. If this page and the Terms differ, the Terms apply.

Rules for everyone

Use your own key. An account belongs to one organization. Do not share a key outside it. Do not make extra accounts or keys to get more calls than one account allows.

Say what you are doing. Give a real name and a working email address when you sign up. If we ask what an app or an agent does with the data, tell us.

Stay inside the limits. A free key allows 60 requests a minute, a burst of 20 requests in 5 seconds, and 1,000 requests a day. Do not work around a limit.

Open data and account data

Open data is the set of files we publish under an open licence on Zenodo, Kaggle and Hugging Face. Today that is Arctic Open-Water Window (version 1.1, 15 gates), Western Terminal Lakes (version 1.1, 19 series on 18 lakes) and Storm Blackout and Restoration (version 1.2, 672 storms). The licence is Creative Commons Attribution 4.0 (CC BY 4.0) unless the dataset record names another one.

You may copy, share, change and sell work made from open data. You must give credit and say what you changed. Nothing on this page takes away a permission that licence gives. You do not need an account to download the open files.

Account data is everything else the API or the MCP server returns: any response or file that is not marked CC BY 4.0. Account data is for your organization's own use. The sections on selling and on people say what you may not do with it.

If a response says CC BY 4.0, that file is open data. If it does not, treat it as account data.

Early access and storm results

Early access runs to December 31, 2026 and ends at midnight US Eastern. Until then every account may use the API and the MCP server at no charge, inside the limits above. After it ends, county storm results for a storm that is not yet in a published release are free 180 days after landfall. Until then they need a later plan. Open data stays free to download.

Apps, bots and agents

You may build an app, a dashboard, a bot or an automated agent on the API.

Keep your key on a server. A key must not appear in a web page, a mobile app, a public repository, a ticket or a shared document. If a page needs the data, have your server call the API and send the page what it needs.

Ask only for what the app needs. Do not download a whole dataset through the API one call at a time. The complete open files are free to download.

An app or agent must not pretend to be a person or to be Heimdall Research. If someone asks what it is or who runs it, it must say.

When a page shows a number, a map, an image or a video from the API, show the credit and the dataset's disclaimer line next to it, where a reader can see it without clicking.

Assistants and MCP

You may connect an assistant you run to our MCP server with your key.

The assistant writes its own replies. We send it data and short instructions. We do not write or check what it says. A reply can add a claim, drop a limit or get a number wrong. Check a reply against the data before you rely on it or pass it on.

Do not put a person's name, email address, account number or other personal identifier in a prompt or a tool call. A place is fine: a city, county, state, ZIP code, address or coordinates.

MCP calls count against the same limits as API calls.

Selling, sharing and AI training

Open data. You may share it, sell work made from it, and train a model on it, with credit, as CC BY 4.0 allows.

Account data. Without a written order from us that says you may, do not:

sell it, license it, or give it to anyone outside your organization
offer a copy of it, or a feed of our API, as a product or a service
build a dataset or a product from it that competes with it
train, tune or test a machine learning model on it

Showing an open number or an open video on a page you run is not resale.

To ask for a written order, write to info@heimdallresearch.com and say what you want to build.

People and places

Our data is about counties, lakes, sea passages and storms. None of it is about a person.

Do not use it to make a decision about one named person, one household or one address. The storm numbers are county estimates. They do not say what happened at a single property.

Do not combine it with other records to identify a person, or to guess something private about a person or a household.

Uses the data is not fit for

Do not use the data, or an assistant reply that used it, for:

navigation
emergency response
safety of life
utility operations
a legal decision, a water-rights decision, or an engineering decision

Each dataset also carries its own line:

Arctic. Not for navigation. Use at your own risk. Provided as is, without warranty of any kind.
Lakes. Not for water-rights, legal or engineering decisions.
Storms. Not for real-time emergency response or for any decision about one address or property.

The same lines are on the Terms page.

Do not disrupt the service

Do not try to get access you were not given. Do not probe, overload or interfere with the site, the API or the MCP server. Do not scrape the API or the MCP server to get around a limit, a plan or an access control.

If you find a security problem, report it as described on the security page. Do not test it on other people's accounts.

Credit

When you share an open dataset or a large part of it, keep this credit with the dataset's name, version, and link or DOI:

Dataset name, version, by Heimdall Research, licensed under CC BY 4.0. Link or DOI.

Keep the third-party credits in the dataset's NOTICE file with the copy. Do not remove a licence notice or a source credit. Do not say or suggest that we endorse your product.

If a rule is broken

We may do any of these:

lower the limit on a key
revoke a key
suspend or close an account
refuse a new account from the same organization

Where we can do it without adding risk, we email the account first and give time to fix the problem. We may act without notice to protect the service or other customers.