Privacy
The short version
No accounts, no analytics, no advertising
Reading Floodway needs nothing from you. The website runs no analytics scripts and sets no third-party cookies. Nothing here is sold, shared for marketing, or used to build a profile.
Your location never leaves your phone
The app asks for your location only to pick which rivers to show first. It reads the answer from a copy of the gauge list that is already on the phone, and never sends a coordinate to us or to anyone.
What does leave the phone, and why
Only once you allow notifications: a push token, the rivers and gauges you starred, and a token that lets us start a lock-screen card. That is the least the server can know and still decide whether your phone should hear that the Avoca has crossed minor. Unstar everything and the record is deleted.
The website
Starred gauges
Stars on the website are kept in one first-party cookie in your browser, read by your browser only. They are not sent to us, and clearing the cookie clears them.
Email alerts
If you ask for an email alert, we keep the address you gave, the gauge and the level you chose, and a record of each alert we sent. The address is used for those alerts and for the message that confirms it, and for nothing else. Every alert carries a way to stop it, and you can ask us to delete the address at any time.
Server logs
Like every website, ours records requests as they arrive: the page asked for, the time, the address the request came from, and the browser or app that made it. The site is hosted on Vercel and the database on Neon; the readings are gathered by a job on Google Cloud. These logs are kept for a short period for the purpose of keeping the service working, and are not used for anything else.
The app
Reading river levels
The app carries its own copy of every gauge and river and fetches only the current levels. Those requests reach the same server logs as the website, and carry nothing about you.
Notifications
When you allow notifications, the app registers with our server: the device token Apple issues for push, whether it is a test or an App Store build, the app version, the rivers and gauges you have starred, and, on iOS 17.2 or later, a token that lets us start a lock-screen card. The server uses these to send you the notifications described on the first screen, and keeps a record of each one sent so it never sends the same one twice. The record is deleted with the registration. Unstarring everything sends an empty registration, which deletes it; deleting the app leaves a token Apple will refuse, and the registration is deleted the first time that happens.
Lock-screen cards
A Live Activity has its own token, issued per card. It is sent to us with the one gauge the card is about, so the card can be updated with the phone locked, and it is deleted when the card ends.
Reporting a problem
The Report this button opens an email in your own mail app, addressed to us, with the app’s state pasted in: the build, the device model, what the app was showing, and the rivers and gauges you starred. It never includes your location or the push token. Nothing is sent until you send it.
Your choices
See it, or have it removed
Write to support@floodway.com.au and we will tell you what we hold against an email address or a device, and delete it if you ask. Push registrations can be removed by turning notifications off for Floodway in Settings, or by unstarring everything.
Changes
This page is written from the code that does these things, and when that code changes, the page changes and the date at the top with it.
Floodway is decision support, not an official warning service — during an event follow the Bureau’s warnings and your state emergency service. Back to rivers.