Privacy Policy
Last updated 9 September 2026
In short: FloodRadar uses personal information to provide the features you ask for, keep the service secure and understand whether it works. We do not sell personal information. You can delete your account and its associated data from My Account, or contact us about any privacy request.
1. Who is responsible for your information
FloodRadar is the data controller for the personal information described in this policy. Questions or requests can be sent to [email protected].
2. Information we collect
When you use the public website
Our web server and Cloudflare receive technical information needed to deliver and protect the site, including your IP address, browser and device information, requested pages, timestamps and security signals. Google Analytics records information about how pages and features are used.
Accounts, saved places and alerts
If you create an account, we store your email address, password hash, optional display name and postcode, verification and password-reset records, acceptance of our terms, login security information, saved gauges and the alerts you configure. We never store your password in readable form.
If you connect another alert channel, we also store the information needed to deliver it, such as a browser push endpoint, Telegram chat identifier or ntfy topic. Alert and notification logs record delivery attempts so failures can be diagnosed.
Property reports and purchases
When you request or buy a property report, we may store the postcode, selected address or building point, email address, report-access details, source page and Stripe session or payment identifiers. Stripe processes card and wallet details; FloodRadar does not receive or store your full card number.
Community flood reports
If you log a flood, we store the area you draw, event details, depths, notes, photographs and your sharing choice. A report may be linked to your account so that you can manage it. Public reports are shown without your name, postcode or private notes; modelling-only and private reports are not displayed as public shapes.
Flo, the site helper
If you use Flo, we store the question and answer, the page you were viewing, time, model usage and feedback, together with a random visitor identifier, a shortened hash of your IP address and your account identifier when signed in. Do not include personal or sensitive information in a Flo question.
Messages and subscriptions
We keep information you send to us, and the email address and preferences needed for requested alerts, reports or updates. Every optional email includes an unsubscribe route where applicable.
When you write to us through a contact or suggestion form we store your message, the email address you give us, your name if you provide one, the page you wrote from, a shortened hash of your IP address and your browser identification. The address is used to reply to you and is never added to a mailing list. The hashed IP address is only ever compared with other hashes, to limit how many messages one sender can submit.
3. Why we use this information
| Purpose | UK GDPR basis |
|---|---|
| Provide accounts, alerts, saved places, reports and purchases you request. | Performance of a contract or steps you ask us to take before entering one. |
| Send optional updates and alert messages you request. | Your consent; you can unsubscribe or disable them at any time. |
| Secure the service, prevent abuse, diagnose failures and improve usability. | Our legitimate interests in operating a reliable and safe service. |
| Keep payment and accounting records. | Our contract with you and applicable legal obligations. |
4. Cookies and browser storage
FloodRadar uses a session cookie to keep sign-in and form security working. If you stay signed in, a separate secure token can remember that device for up to 90 days. Flo may set a random visitor cookie to apply usage limits. Property-report experiments may use a short preference cookie so a visitor sees a consistent version.
Your browser's local storage may remember your theme, postcode, map layers, favourite gauges and alert-display bookkeeping. Session storage holds short-lived interface state. Anonymous browser storage stays on that device unless a feature explicitly synchronises it after you sign in.
Google Analytics may set analytics cookies. You can block or delete cookies and local storage using your browser controls, although blocking essential session storage will prevent sign-in and some forms from working.
5. Service providers
We share only the information needed for a provider to perform its role:
- Cloudflare for traffic delivery, security and abuse prevention.
- Google Analytics for website usage measurement.
- Stripe for payment processing.
- Brevo and SMTP2GO for email delivery.
- Telegram, ntfy and web-push services when you choose those alert channels.
- Anthropic to generate Flo answers when you use Flo.
- Geocoding and mapping providers when a feature needs to turn a place, postcode or address into map coordinates.
Some providers process information outside the UK. Where required, we rely on an adequacy decision or approved contractual safeguards for those transfers. We may also disclose information where the law requires it or to protect users and the service.
6. How long we keep information
- Account information, saved places, alert settings and user-created reports are kept until you remove them or delete your account, subject to records we must retain by law.
- Remember-me login tokens expire after 90 days; ordinary sessions end earlier when you log out or the session expires.
- In-app notifications and settled alert-queue records are normally removed after 30 days. Delivery logs are normally removed after 90 days, except the email that delivers a purchased report, which is kept with the purchase record.
- Identifiable property-report visitor records and incomplete pre-checkout leads are normally removed after 90 days. Aggregate, non-identifying usage totals may be retained.
- Purchase and accounting records are kept for the period required for tax, accounting, fraud prevention and dispute handling.
- Records of property-report checkouts and purchases are kept with those records, as are records of the steps people take on the report pages. After 90 days we remove the IP address and town from them.
- Security logs, support messages and Flo conversations are kept only while reasonably needed for their stated purpose, then deleted or anonymised.
7. Your rights
You can change saved places and alerts from your account, unsubscribe using the link in a message, clear browser storage in your browser, and permanently delete your account from My Account.
UK data-protection law may give you rights to access, correct, erase, restrict or receive a copy of your personal information, and to object to certain processing or withdraw consent. Email [email protected] to exercise a right. We may need to verify your identity first.
You can complain to the Information Commissioner's Office. Please contact us first if you can, so we have a chance to put things right.
8. Security and automated decisions
We use access controls, hashed passwords, secure tokens and transport encryption to protect information. No online service can guarantee absolute security, so please use a unique password and tell us if you suspect misuse.
FloodRadar's river predictions and risk summaries concern places and environmental conditions. We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you.
9. Changes to this policy
We may update this policy when features, providers or legal requirements change. The date at the top shows the latest revision. Material changes affecting registered users may also be communicated through the service or by email.
10. Contact
For privacy questions, requests or complaints, email [email protected]. For the service's safety limits and disclaimers, read the Terms of Use.