| Data Type | Purpose | Retention | User Control |
|---|---|---|---|
| IP Address (Server Logs) | Server operations | 14 days | None |
| IP Address (Web Stats) | Traffic analysis | Indefinite (anonymized) | N/A (anonymized) |
| User Agent (Server Logs) | Server operations | 14 days | None |
| Usage Metrics (Incident Card Opens) | Understand feature usage | Indefinite (aggregated by hour) | None (no PII collected) |
| Welcome Acknowledgement | Consent tracking | Until cleared (or session-only) | Full control |
| Bookmarks | User convenience | Until cleared | Full control |
| Theme Preference | User convenience | Until cleared | Full control |
| Language Preference | User convenience | Until cleared | Full control |
| Read/Unread Status | UI state | Until cleared | Full control |
This site does not:
Note: Minimal, anonymous usage metrics are collected (see "Usage Metrics" section below) using self-hosted infrastructure. This differs from third-party analytics services.
When a report is submitted to flag incorrect incident data:
Retention: 14 days (GDPR-compliant)
Purpose: Server operations, security monitoring, troubleshooting
Data Logged:
Automatic Deletion: Logs older than 14 days are automatically deleted via system log rotation.
IP Anonymization: Strong anonymization (level 2)
Retention: Indefinite (anonymized data permitted under GDPR)
IP addresses are irreversibly anonymized before processing. Anonymized data is not considered personal data under GDPR and can be retained for operational insights.
Anonymous, aggregated metrics are collected about how users interact with the site to understand feature usage. These metrics are collected regardless of storage or maps preferences and do not require localStorage, sessionStorage, or third-party services.
When an incident card is opened, the browser sends a single anonymous request. The server rounds the time to the nearest hour and increments a counter. No data is returned to the browser.
Example: If 100 people open incident cards between 2:00 PM and 2:59 PM, the stored data is simply "2 PM: 100 opens" with no information about who or which incidents.
This data collection is considered GDPR-compliant because:
Since no PII is collected, there is no opt-out mechanism required under GDPR. Browser extensions that block network requests may prevent the metrics from being sent. The site functions normally regardless.
Usage metrics are retained indefinitely as they contain no personal data. This allows for understanding long-term usage patterns.
Local storage is disabled by default. It must be explicitly enabled via the welcome screen or in the settings menu.
Note: All localStorage data remains client-side only. Nothing is transmitted to the server.
If "Continue (Session Only)" is chosen on the welcome screen, the acknowledgement is stored in sessionStorage instead of localStorage. This means:
No cookies are set.
Note: Third-party services are loaded only if consent is given via the welcome screen or in the settings menu. The site can be used without maps functionality to avoid third-party data sharing.
Purpose: Provides the marker clustering library for the map view
Data Transmitted:
When Loaded: Only when consent is given to use the map feature (via welcome screen or settings)
Privacy Policy: unpkg.com (operated by Cloudflare)
Purpose: Interactive map view with incident markers
Data Transmitted:
When Loaded: Only when consent is given to use the map feature (via welcome screen or settings)
Privacy Policy: Google Privacy Policy
On the welcome screen and in the settings menu, two toggles control data handling:
These settings can be changed at any time via the settings menu (gear icon).
Last Updated: January 30, 2026