OpenWaterAtlas is operated by an EU-based independent publisher. We comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and Brazil's Lei Geral de Proteção de Dados (LGPD). This policy explains what we collect, why, and the rights you have.
TL;DR. We don't have user accounts, we don't sell data, and our analytics is cookie-less and anonymous. You can use the site without revealing anything about yourself.
Data we collect
Page views (Plausible Analytics). We use a self-hosted instance of Plausible, which is cookie-less and stores only aggregated, anonymous counts: which pages were viewed, referrers, country (derived from IP and immediately discarded), browser and device class. No personal identifiers, no cross-site tracking, no fingerprinting. Aggregates are retained for 24 months.
Google Tag Manager events. GTM is loaded but executes vendor tags only when you opt in via the cookie banner (rolling out shortly — see Cookies). Until you opt in, no third-party tags fire.
Affiliate click data. When you click an outbound partner link (/go/...), we record the destination, timestamp and a hashed session identifier so we can attribute commissions. No personal data is sent to the partner network beyond what your browser sends to any external site.
Saved spots and Compare. These lists live in your browser's localStorage. They are never transmitted to our servers, and clearing your browser storage wipes them.
Email. If you write to one of our inboxes (see Contact) we keep the email thread for as long as needed to handle the request, then archive it.
Third parties
- Pexels — image CDN. Anonymous requests for photo assets.
- Open-Meteo — climate and historical-weather API. Requests come from our server; your browser doesn't talk to them directly.
- Windy — embedded webcams. When you load a spot page with a webcam, your browser fetches the stream from Windy.
- YouTube — embedded videos load only after you click the play overlay (no-cookie mode).
- Google Tag Manager — loaded but inert until consent.
We do not knowingly share data with advertising networks. We do not allow GPTBot, CCBot or other commercial LLM scrapers (see robots.txt).
Your rights
Under GDPR, CCPA and LGPD you have the right to access, correct, delete, restrict processing of and port your personal data, and to object to processing. Because we hold almost no personal data, most requests will be answered with "we have nothing on file." If we do hold data about you (e.g., past correspondence), email [email protected] and we will respond within 30 days.
You also have the right to lodge a complaint with your supervisory authority (in the EU, your national data protection authority; in California, the California Privacy Protection Agency).
Legal basis (GDPR Art. 6)
- Anonymous analytics: legitimate interest (Art. 6(1)(f)) — operating and improving a public-interest atlas.
- Vendor tags via GTM: explicit consent (Art. 6(1)(a)).
- Email correspondence: legitimate interest and, where applicable, contractual necessity.
Data retention
- Plausible aggregates: 24 months.
- Email threads: until the matter is closed, then archived for legal/accounting reasons (max 6 years).
- Affiliate click logs: 24 months.
Cookies
See the Cookies Policy for details on what cookies are set and how to manage them.
Changes
Material changes to this policy will be announced at the top of this page and dated under "Last updated." Continued use of the site after a change indicates acceptance of the revised policy.
Contact
Questions about this policy or your data: [email protected].