Privacy Policy

Last updated: 10 March 2026 — This policy explains what personal data WaterWatch (“we”, “our”, “the service”) collects, how it is used, and the rights you have over it. WaterWatch is available at water-watch.co.uk.

1. What data we collect

We collect the minimum data necessary to run the service:

• Email address — when you subscribe to discharge alerts for one or more sites. We use this only to send the alerts you signed up for.
• Phone number — optionally, if you enable SMS alerts. Your number is passed to our SMS provider, solely to deliver those messages.
• Site preferences — which CSO sites you have subscribed to, stored against your account.
• Anonymous usage analytics — page-view data collected via Cloudflare Web Analytics and Vercel Analytics. These services do not use cookies or fingerprint your device; no personal identifiers are stored.

We do not collect location data, browsing history, or any information beyond what is listed above.

2. How we use your data

• Delivering alerts — your email or phone number is used solely to send you the discharge start/stop notifications you requested.
• Managing your account — storing your subscription preferences so you can review or cancel them at any time.
• Improving the service — aggregated, anonymous analytics help us understand which pages are most useful.

We will never sell, rent, or share your personal data with third parties for marketing purposes.

3. Legal basis for processing (UK GDPR)

• Consent — you provide your email or phone number voluntarily when subscribing to alerts. You may withdraw consent at any time by unsubscribing via the link in any alert email or by contacting us directly.
• Legitimate interests — anonymous analytics to maintain and improve the service, where these interests do not override your rights.

4. Data storage and security

Subscriber data is stored in Supabase (EU West region) and processed by the WaterWatch Cloudflare Worker (EU West). SMS delivery uses Vonage. All data is encrypted in transit (TLS 1.2+) and at rest.

We apply the principle of least privilege: only the parts of the system that need your data to function can access it. No personal data is stored in any third-party logging or error-monitoring service.

5. Data retention

• Your email and subscription preferences are retained for as long as you remain subscribed.
• On unsubscribing, your contact details are deleted within 30 days.
• Anonymous analytics data is retained by Cloudflare and Vercel according to their own retention policies (typically 30–90 days).

6. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Restriction — ask us to restrict processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — unsubscribe at any time via the link in any alert email or by emailing us.

To exercise any of these rights, email hello@water-watch.co.uk. We will respond within 30 days.

7. Cookies and tracking

WaterWatch does not use advertising cookies or tracking pixels. The service uses browser sessionStorage only to remember whether you have dismissed the beta notice banner, and localStorage for your alert subscription token. Neither is shared with any third party.

Cloudflare Web Analytics and Vercel Analytics use a cookieless approach that does not identify individual users.

8. Third-party services

WaterWatch integrates with the following third-party services. This is by no means an extensive list but represents some of the services we use:

• Environment Agency (EA) Open Data — all discharge and river-level data is sourced from publicly available EA APIs. No personal data is sent to the EA.
• Thames Water Open Data API — CSO alert status data. No personal data is sent.
• Supabase — subscriber database. Privacy policy.
• Cloudflare — DNS, CDN, Workers, and Web Analytics. Privacy policy.
• Vercel — hosting and Speed Insights. Privacy policy.
• Resend — email delivery. Privacy policy.
• Mapbox — map tiles and geocoding. Privacy policy.

9. Children

WaterWatch is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. Any material changes will be noted at the top of this page with an updated date. Continued use of the service after a change constitutes acceptance of the revised policy.

11. Contact and complaints

For any privacy queries, email hello@water-watch.co.uk.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO).