Privacy Policy

Ready Kiwi is built to be a supplementary multi-hazard alert aggregator for New Zealand. We believe location-based safety tools shouldn't come at the cost of your personal privacy. Our data handling is designed from the ground up to respect your confidentiality and secure your data.

1. On-Device Storage (No Accounts)

When you use the browser-based hazard dashboard, your configurations, alert settings, and saved places are stored purely in your browser's local storage (localStorage). No personal registration or credentials are required, and none of this on-device configuration leaves your browser unless you explicitly opt in for push notifications or email summaries.

2. Push Notifications (Mobile Devices)

To deliver real-time push alerts to your mobile device:

• Anonymous Tokens: We collect the anonymous push token generated by your device's operating system (via Apple APNs or Google FCM). This token contains no personal identifying information.
• Alert Coordinates: We store your alert preferences, radius thresholds, and coordinates to verify if a hazard intersects your target area. These target coordinates are kept solely to route notification payloads and are never linked to any email address or identity.

3. Daily Email Digest Subscriptions

If you choose to receive daily hazard summary emails:

• Encrypted Emails: Your email address is encrypted at rest using AES-GCM 256-bit encryption. We only store a secure SHA-256 hash of your email for lookup and unsubscribe verification. Your raw email address is never stored in plaintext.
• Rounded Coordinates: To prevent the storage of exact home addresses in our database, coordinates provided for email digests are automatically rounded to 1 decimal place (~11km accuracy). This is sufficient to target relevant weather and local alert zones without logging your street address.

4. IP Geolocation at the Edge

When you use the zero-click location flow to view alerts in your current area, we check your approximate town/region on-the-fly using Cloudflare's edge location headers (request.cf). Your IP address is never stored, logged, or linked to your location preview.

5. Anonymised Community Reporting

When you submit a community report (e.g. road blockages, slips, or flooding), your precise coordinates are processed dynamically to identify your suburb, but are never saved or made public. Other users will only see anonymised, aggregated check-ins at the suburb/community area level.

6. Your Rights & Data Erasure

Since your web app settings are saved locally, clearing your browser cache or site data will instantly wipe all local places and preferences. If you subscribe to push notifications or email digests, you can unsubscribe at any time using the in-app controls or the unsubscribe link in every email, which immediately disables your subscription and marks the database records as inactive.