We write down how wrong we were.

It grades itself, every night, in public.

Every night, Sunny writes down what each source predicted for the next 48 hours. Then it writes down what actually happened, taken from the nearest airport weather station. Then it scores them: mean absolute error and signed bias, per source, per lead time. The app shows you which source has been closest at your location — not in general, at your location.

Rain is scored as a contingency table — hits, misses, false alarms — with probability of detection and false-alarm ratio, rather than a single accuracy percentage. That's not pedantry. In a dry climate, an app that never forecasts rain scores about 90% accurate and is completely useless.

And it refuses to name a winner until it has 200 scored readings for your area. Before that, the standings still appear — stamped PROVISIONAL, with a meter counting up to the threshold. You can watch it fill. What's withheld early is the conclusion, not the data.

The disagreement is the forecast.

Nearly every weather app is built on the same handful of national models. It picks one, rounds it off, and hands you a confident number. When that number turns out wrong, you have no way of knowing whether it was a close call or a coin flip.

Sunny goes one layer down. It reads ten national models — GFS, ECMWF, ICON, HRRR, the UK Met Office, Canada's GEM, Météo-France, Japan's JMA and the rest — plus seven forecast services built on top of them, and it carries the disagreement out the other side. When they all sit on top of each other, that's a day you can stop thinking about. When they fan apart, that fan is the actual story of the day, and you get to see it rather than having it quietly averaged into a number that sounds just as certain as the other kind.

It will not invent a reading.

There's a document in this project listing features that were considered and then killed, each with the reason. Rain totals derived from radar: that would mean inventing a relationship between reflectivity and rainfall and then printing the result as if it were a measurement. Snow-day odds: fun, popular, and with no honest data underneath it. A live lightning-strike feed: real, but sold by networks whose terms we could not honestly meet.

That last one has since changed, and how it changed is the point. The ground-strike networks were still a no, so we built the layer on NOAA's Geostationary Lightning Mapper instead — a public instrument on a US weather satellite. It arrived with limits, and those limits now travel with it everywhere it appears: it detects total lightning, in-cloud flashes included, so a mark means a storm is electrically active rather than that a bolt hit that spot; it resolves kilometres, so we draw a soft cell about 11 km across instead of a point we cannot honestly place; and it watches the Americas, which means the continental US and Latin America but not Alaska, not Hawaii, and nowhere further afield. Where the satellite cannot see, the layer does not appear at all — an empty map would read as “no lightning here,” which is a different claim from “we cannot tell you.” A no in that document is a default rather than a verdict, but the thing that overturns one has to show up with its limits attached.

The same rule runs through the app itself. Where a number is modelled rather than measured, the screen says so, in the same place, every time:

A forecast frame is never drawn as radar. And when an instrument isn't there — no tide station nearby, no buoy, no pollen reading for your part of the world — the app goes quiet instead of substituting something that looks close enough. A missing reading produces silence, never a stand-in.

Warnings are free, permanently.

Severe weather alerts are not a paid feature and never will be. Any home-screen widget capable of carrying an alert is free too — which is most of them, and that was a deliberate decision rather than an oversight, because shipping a paywalled warning is the worst thing an app like this could do.

There is one published severity ladder, and every surface uses it — phone, widget, wall display. So the screen in the kitchen can never call something alarming that the phone in the same room calls routine.

Your precise location stays on your device.

To send you a warning, Sunny has to know roughly where you are. So it syncs a grid cell roughly 20 km across — not your coordinates. That's precise enough to know a tornado warning covers you, and far too coarse to know which building you're in.

Cards you share are city-granular, and never carry a dot marking where you were standing. Full detail is on the privacy page.

Some things only a person outside can tell you.

Radar can tell you a cell is passing over your neighbourhood. It can't tell you the underpass is flooded, or that it's already hailing two streets over. So there's a social layer: reports from people who are actually out in it, and places and people you can follow.

Official National Weather Service data and community reports are kept visually distinct, always, and are never blended together. One is an instrument and the other is a neighbour, and you should never have to work out which one you're looking at.

One small example of the whole approach.

Sunny works out when it's good to go outside for the things you do — running, cycling, walking the dog. Heat closes one of those windows when it reaches the Danger rung of the National Weather Service heat index. High UV never closes a window at all.

That looks inconsistent until you see the rule underneath it: a factor closes a window only when the hazard can't be removed by preparation. A hat and sunscreen fix UV. Nothing you can put on fixes a heat index in the Danger range. The rule is written down, which means you can disagree with it — and that's the point of writing it down.