Privacy Policy
Last updated: 2026-07-25
This policy explains what personal data What's happening?("we", operated by a equipa Agora) collects, why, and your rights under the EU General Data Protection Regulation (GDPR). Questions: privacy@agoraaqui.pt.
What we collect
- Account — your email address (for sign-in and one-time codes). Passwords are hashed by our auth provider; we never see them.
- Profile — your display name, optional @handle and avatar image, and optional "main location" (kept private to you).
- Content you create — reports (title, description, category, the coordinates you pin, and any photos/videos), comments, reactions, confirmations, corrections and flags.
- Location — your browser's live location is used to centre the map; it is not stored unless you create a report, which records that report's coordinates.
- Notifications — areas you choose to watch, and (if you enable push) your browser's push subscription.
- Technical — an essential session cookie and standard server logs.
Why we use it (legal basis)
To provide the service and your account (performance of a contract); to keep the map accurate and safe (legitimate interest); and, where required, with your consent (e.g. browser notifications). Reports and your public profile are visible to others by design.
Who we share it with
We use trusted processors to run the service. We do not sell your data:
- Supabase — database, authentication, file storage and realtime (hosted in the EU).
- Mapbox — map tiles, search and place names (receives map/coordinate requests).
- Vercel — application hosting.
- Resend — sends your sign-in and password-reset emails (receives your email address only).
- Anthropic — only if you use the optional "describe it" AI helper, the text you type is sent to parse it into a report. It is not used to train models.
- Google AdSense — advertising, and only if you agree to it in the cookie banner. Google is a controller in its own right for this; see the table below.
Official data layers (Proteção Civil / Incêndios Directo, IPMA, Open-Meteo) are read by us from public sources — no personal data is sent to them.
Cookies and local storage
We use as little as we can get away with, and nothing that identifies you across other websites is set before you agree to it.
| What | Why | Consent needed? |
|---|---|---|
| Session cookie (Supabase) | Keeps you signed in. Without it there is no account. | No — strictly necessary |
| Language cookie | Remembers whether you chose English or Portuguese. | No — set only when you choose |
| Local storage (theme, onboarding, notification preference) | Remembers your theme, that you have seen the intro, and whether you turned notifications on. Stays on your device and is never sent to us. | No — your own settings |
| Google AdSense | Advertising on some community reports. Sets its own cookies and may build an advertising profile. | Yes — nothing loads until you agree |
You can change or withdraw your choice at any time from Cookie settings, linked at the bottom of the settings page. Withdrawing is as easy as agreeing, and takes effect immediately.
Mapbox's usage telemetry is blocked by our Content Security Policy, so the map does not report your activity back to them beyond the tile requests needed to draw it.
Retention
Reports expire automatically based on their category. Account and profile data are kept until you delete your account, after which they are erased (see below).
Your rights
Under the GDPR you may access, correct, export, or erase your data, and object to or restrict processing. You can delete your account and all associated data at any time from Settings → Danger zone, or by emailing privacy@agoraaqui.pt. You may also lodge a complaint with the Portuguese supervisory authority, the CNPD (cnpd.pt).
Children
The service is not directed at children under 16. Please do not use it if you are younger.
Changes
We may update this policy; material changes will be reflected in the "last updated" date above.