Skip to main content
    Floodi LogoFloodi

    Privacy Policy

    Last updated: June 15, 2026

    Floodi publishes only public-safe flood report fields on public maps and feeds. We do not expose lead emails, phone numbers, payment details, admin moderation internals, or hidden storage paths through public data surfaces.

    Floodi ("we", "us") respects your privacy. This Privacy Policy explains what we collect when you use floodi.app and the Floodi mobile web app (the "Service"), how we use that information, who we share it with, and the rights you have. This page describes our current practices in plain language — it is not legal advice, and we don't claim it makes Floodi "fully compliant" with any specific law. It reflects the privacy controls we have built and are continuing to improve.

    1. Location data

    Floodi collects precise geolocation only with your explicit consent, and only at the moment you submit a flood report or actively share your location to center the map. We do not track your location continuously, in the background, or after a report is submitted. You may decline location access at any time using your browser or device settings.

    2. Photos & metadata

    Photos you upload are stored securely. GPS and other EXIF metadata are automatically stripped on upload by re-encoding the image, so your phone's saved camera location, device serial, and timestamp never leave your device. Uploaded photos are automatically screened by an AI moderation service (see "Third-party services and data sharing" below) before they are shown publicly; flagged photos are queued for manual review by Floodi staff.

    3. We never sell your data

    We do not sell, rent, or share personal information with third-party data brokers, advertisers, or marketers — ever.

    4. Anonymous reporting

    You can submit flood reports without creating an account. Anonymous reports include only the information you provide (location, severity, optional photo and comment) — no personal identifiers.

    5. Data retention

    Active flood reports are retained while relevant. After a report is resolved we keep it for up to 90 days for moderation and trend analysis, then anonymize it (removing user identifiers). Aggregated, anonymized data may be retained indefinitely for safety research. Account data (profile, contact preferences, watched zones) is kept while your account is active. Analytics events are retained for a limited period for traffic and abuse analysis and do not contain your name, email, or exact location.

    6. Your privacy rights & how to exercise them

    Wherever you're located, you can ask us to:

    • Access a copy of the personal data we hold about you
    • Correct inaccurate or out-of-date information
    • Delete your account and associated personal data
    • Restrict or object to certain processing (e.g. marketing or analytics)
    • Withdraw consent for location sharing, email or push alerts, or analytics cookies

    The fastest way to exercise these rights is our Privacy Request form, which sends your request directly to our privacy inbox and gives you a reference number. You can also email hello@floodi.app. We aim to respond within 30 days.

    Because deletion requests can be used to impersonate someone else and delete their data, we may ask you to verify your identity (typically by replying from the email address on the request) before making changes. Where full deletion isn't possible — for example, records we must keep briefly for fraud prevention, billing/tax records, or an audit trail of the request itself — we will tell you what is retained and why, and anonymize or minimize it wherever we can instead of deleting it outright.

    7. Cookies & analytics

    Floodi uses analytics cookies/local storage only (to understand which counties and pages get the most traffic) — our own first-party analytics and Google Analytics. We use no advertising cookies, no cross-site ad tracking, and no third-party ad networks: Google Analytics is configured with Google's advertising signals turned off, so this data is never linked to Google's ad products. The first time you visit, a banner lets you accept or decline analytics. Analytics events are only sent after you accept — if you decline or dismiss the banner, no analytics events are sent from your browser, to us or to Google. You can change your choice at any time by clearing your browser's local storage for floodi.app (which will show the banner again on your next visit).

    8. Error monitoring & diagnostics

    Floodi uses an error-monitoring service (Sentry) to capture crash reports and performance data so we can fix bugs. This can include error messages, the page you were on, browser/device information, and a recording of on-screen interactions around an error. Session recordings are configured to mask page text and block media so report photos, addresses, and account details are not captured. Error data is used for debugging only and is not used for advertising.

    9. Third-party services and data sharing

    We use a small number of service providers ("processors") to run Floodi. Each only receives the data needed to perform its function, and none are permitted to use your data for their own advertising:

    • Supabase — hosts our database, file storage, and authentication (account email, reports, photos, preferences).
    • Resend — sends transactional emails (alerts, confirmations, unsubscribe requests).
    • OneSignal — delivers push notifications if you enable them, using a device identifier and your watched-zone locations.
    • AI photo moderation (Google Gemini) — automatically screens uploaded flood-report and profile photos for policy violations.
    • Sentry — error monitoring and diagnostics, described above.
    • Google Analytics — aggregate traffic and usage analytics (which pages and counties get the most visits). Only loaded after you accept analytics cookies; configured with Google's advertising signals disabled.
    • Mapping & weather data — OpenStreetMap/Leaflet map tiles, and public data from NOAA/NWS, USGS, FEMA, and NHC. These public-data requests may include your map view's coordinates but not your identity.

    10. International data transfers

    Floodi's infrastructure runs on cloud services located in the United States. If you access Floodi from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your country.

    11. Data sources & attribution

    Active weather alerts shown on Floodi are sourced from the National Weather Service / NOAA (weather.gov). Floodi is not affiliated with NWS, NOAA, or any government agency.

    12. Children's privacy (COPPA)

    Floodi is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has used Floodi, contact us and we will delete the data.

    13. GDPR (EU/UK residents)

    If you are in the European Union or UK, you have the rights described in "Your privacy rights" above — access, correction, deletion, restriction, portability, and objection — and the right to lodge a complaint with your local data protection authority. Use our Privacy Request form or email hello@floodi.app to exercise these rights.

    14. CCPA (California residents)

    California residents have the right to know, delete, and opt out of the sale or sharing of personal information. Floodi does not sell or share personal information for cross-context advertising, so there is nothing to opt out of, but you may still use our Privacy Request form to request access or deletion.

    15. Florida Digital Bill of Rights

    Under Florida's Digital Bill of Rights, processing of precise geolocation requires explicit opt-in. Floodi always shows a consent dialog before capturing your location and never collects it without your active confirmation.

    16. Security

    Data is stored on managed cloud infrastructure with row-level security policies that restrict each row to its owner. Communications are encrypted in transit (TLS).

    17. Changes

    We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change.

    18. Contact

    Privacy questions or data requests: use our Privacy Request form or email hello@floodi.app.