Privacy Policy

This policy explains what HighWater Brief collects and why. We keep it short and we collect as little as we can.

What we collect

• Account: your email, a password hash (never the password), your language and plan.
• Places: the addresses or map pins you enter, and the briefs made from them. A brief is reachable by anyone who has its unguessable link, so share it only with people you trust.
• Alerts: for alert addresses, your email or WhatsApp number and a record of your consent (the time, the wording version and a keyed hash of your address or number).
• Usage and security: short-lived rate-limit counters keyed by a one-way hash of your network address. We do not store raw network addresses.
• Payments: handled by our payment provider. We keep only a customer reference and your plan status, never card numbers.

How we use it

To produce your briefs, run the alerts you switched on, take payment, prevent abuse and keep the service working. We do not sell your data and we do not show ads.

Who processes it

We use service providers for hosting, database, maps and place search, river data, email, WhatsApp delivery and payments. They receive only what they need for their task, for example a place name or coordinates for a lookup, or your email for sending an alert.

Retention and deletion

You can delete your account from the account page. This removes your account, saved addresses and briefs, and cancels subscriptions. Consent records are kept in anonymised form for a limited time to show that opt-outs were honoured.

Your choices

You can switch alerts off for any address at any time, use the unsubscribe link in alert emails, or reply STOP to a WhatsApp alert.