Data protection & privacy
FloodSpots ("we", "us") publishes a public flood-risk map for Greater Accra and lets people report flooding they've witnessed. This page explains what personal data we collect, why, how long we keep it, and how you can exercise your rights over it - under the Ghana Data Protection Act, 2012 (Act 843) and, for visitors in the EU/UK, the GDPR.
What we collect
| Data | When | Why |
|---|---|---|
| Email address, display name, password (hashed, never stored in plain text) | Creating an account | To let you log in, submit reports, and message us |
| Location name, coordinates, severity, description, optional source link/date | Submitting a flood report | To build the public flood map |
| Photos you attach to a report | Submitting a flood report | To show visual evidence on the map |
| Message text | Using the message form on your dashboard | To respond to questions about your account or reports |
| Your feedback, and any name, email or phone you choose to add (all optional - you may send feedback anonymously) | Using the feedback form on the home page | To improve the site, and to reply to you if you asked us to. Feedback is private - it is read only by our team, never published on the site or shown to other users |
| Session cookie, CSRF token | Every visit | Strictly necessary - keeps you logged in and forms secure |
| Theme preference (light/dark) | Using the dark-mode toggle | Stored only in your browser (localStorage) - never sent to us |
| Standard web server logs (IP address, browser, page requested) | Every visit | Security and abuse prevention, as with any website |
| Analytics cookies and usage data (pages viewed, approximate location, device and browser, referring site) | Every visit | Google Analytics, so we can see which parts of the site people actually use and what to improve. Your IP address is anonymised before it reaches Google |
We do not run advertising trackers or sell any data to third parties, ever.
Analytics
We use Google Analytics to count visitors and see which pages are used - nothing more. It sets cookies in your browser and sends Google usage data about your visit, with IP anonymisation switched on, so Google receives a truncated address rather than your full one. We never link analytics data to your account, your reports or your feedback, and we do not use it for advertising or share it with advertisers.
If you would rather not be counted, any browser's "do not track"/tracking-protection setting, an ad blocker, or Google's own opt-out add-on will stop it. Nothing on this site stops working if you block it.
Photos can carry hidden location data. Phone cameras often embed GPS coordinates in a photo's metadata (EXIF). If you'd rather not share exactly where a photo was taken beyond the report's own pin, strip location metadata from an image before uploading it (most phones offer this when sharing a photo).
What becomes public
FloodSpots is a public information map - once a moderator approves a flood report, its location, severity, description, event date, source link and any photos become visible to every visitor, logged in or not. We show your display name as the source only where you've chosen to add it; we never publish your email address or account details.
Please don't include other people's personal information (full names, phone numbers, license plates, etc.) in a report's description or photos unless it's genuinely necessary to describe the flooding.
Why we process it (legal basis)
- Contract - processing your account and reports is necessary to provide the service you signed up for.
- Legitimate interest - maintaining a public flood-safety record serves a genuine public interest (helping people avoid flood-prone areas), which we balance against your privacy rights.
- Consent - for optional things like photo uploads, you choose whether to provide them.
Third parties
Some requests your browser makes while using FloodSpots go directly to other services, which then see your IP address the way any website request works:
- Map tiles - OpenStreetMap, Esri/ArcGIS, and CARTO (the Street/Satellite/Dark basemaps).
- Weather - Open-Meteo, for the live rain outlook.
- Fonts & libraries - Google Fonts, cdnjs, and unpkg, for typography and the mapping library.
- Analytics - Google Analytics, which receives usage data about your visit (with your IP anonymised). See the Analytics note above for how to opt out.
None of these receive your FloodSpots account details - only the ordinary connection information any web request includes. Separately, our own server (not your browser) fetches a preview image from a report's linked news source and queries OpenStreetMap's Overpass API for waterway data; neither of those expose your IP to anyone.
How long we keep it
We keep account data for as long as your account is active. Approved flood reports are retained indefinitely as part of the public safety record, in the same way a news archive would keep a story about a flood - even if you later delete your account, the factual report may remain, but we'll remove your personal attribution from it on request (see below).
Messages between you and our team are kept while relevant to your account, and deleted on request along with the rest of your personal data.
Your rights
You can ask us at any time to:
- Access - get a copy of the personal data we hold about you.
- Correct - fix inaccurate details on your account.
- Erase - delete your account, messages, and personal attribution from your reports (the underlying flood-location data may be kept, anonymised, for public safety reasons - see above).
- Restrict or object - ask us to limit or stop certain processing.
- Port - receive your data in a portable format.
- Withdraw consent - for anything based on consent, at any time.
We'll respond within 30 days. If you're unhappy with how we've handled your request, you can complain to Ghana's Data Protection Commission, or your local supervisory authority if you're in the EU/UK.
Security
Passwords are hashed (never stored as plain text), all form submissions are protected against cross-site request forgery, and access to moderation and admin tools requires separate authentication. As with any site, use a unique password and be cautious of phishing attempts claiming to be from us.
Children
FloodSpots isn't directed at children, and we don't knowingly collect data from anyone under 16 without appropriate consent. If you believe a child has created an account, contact us and we'll remove it.
Changes to this page
If we materially change how we handle your data, we'll update the date at the top of this page and, where the change is significant, let logged-in users know via the message system.
Contact us
To exercise any of the rights above, or ask a question about your data, reach us by logging in and using the message form on your dashboard.