Privacy policy

The Water Restrictions website and API (the services) provide a single source of information for water restriction data across New Zealand. These are developed and maintained by Joe Butler (I, me, or my) as a hobbyist initiative.

This Privacy Policy (the policy) explains how your (you or your) personal information and anonymous analytics data are collected, used, stored, and what safeguards and rights apply.

If you have any questions or concerns about this privacy policy, you can contact me at [email protected].

Last updated: 27 May, 2026

Quick summary

Here's a summary of what this policy covers:

• Anonymous feedback: The feedback form is designed to be anonymous - no personal details are required, and you are asked not to include any. The message itself is stored, so avoid including personal information in your feedback.
• Minimal data from email contact: If you contact me directly by email, your email address and any personal details you include in your message may be held to respond to your enquiry.
• No tracking for advertising: I do not use cookies, tracking pixels, or targeted advertising technologies.
• Privacy-respecting analytics: Anonymous analytics are collected through Umami Cloud to understand site usage. No personal information is included.
• Your rights: You can request access to, correction of, or deletion of any personal information held about you.
• Security: Reasonable measures are in place to protect the data that is held.
• Limited retention: Personal information is only kept as long as necessary, and no longer than 6 months.
• Your choice: You can use the services without providing any personal information.

1. Personal information I collect

The services are designed with privacy in mind. The feedback form on the website is designed to be anonymous. No personal details are required, and you are asked not to include any. However, the message you submit is stored as part of your feedback, so if you do include personal information, it will be retained - see Data retention for details.

The only personal information I may hold is what comes with direct email contact: your email address and any personal details you include in your message.

"Personal information" means information that can identify you, such as your name or email address.

You are not required to provide any personal information to use the services.

2. Anonymous analytics

The website uses Umami Cloud, a privacy-focused analytics service, to collect anonymous usage data. This helps me understand how the site is used and improve the services. Examples of the data collected include:

• Pages visited
• Device and browser type
• Referring websites
• Approximate city-level geolocation

Analytics data is anonymous and aggregated, and not shared with third parties. The tracking script does not use cookies, and the data is stored in the EU in accordance with Umami's privacy practices. For more information, see Umami's features page.

Technical data, such as IP addresses, may also be processed as part of normal server operations (for example, logs), but it is not used to identify individual users.

3. How I use your information

I use the information you provide for:

• Responding to enquiries you send via email
• Fixing issues, improving the services, and understanding user needs - including through anonymous feedback
• Maintaining service stability and monitoring for abuse (via server logs and analytics data)

I do not use your personal information for marketing, advertising, profiling, or automated decision-making.

4. How your information is shared

I do not sell, rent, or share your personal information for marketing, advertising, or profiling purposes.

Your data may be shared only in the following limited circumstances:

• Service providers - third-party services may process technical data or personal information as needed to provide functionality, security, and support. For details, see Third-party services
• Legal requirements - if I am required to comply with lawful requests under the New Zealand Privacy Act 2020, only the necessary data will be provided
• Website hosting and infrastructure - where logs or technical data may be processed as part of normal operations

These parties only process data as necessary to provide their services and must handle it securely.

5. Security

I take reasonable steps to protect your information, including:

• Hosting the services on secure infrastructure within my control
• Enforcing HTTPS for all connections
• Limiting access to personal information - only to myself, except where disclosure is required by law
• Using third-party service providers (see Third-party services) to help provide, secure, and maintain the services
• Implementing technical measures to prevent unauthorised access, loss, or misuse of personal information and analytics data

However, no online service can guarantee perfect security, and third-party service providers manage their own systems. You use the services at your own risk.

In the unlikely event of a data breach, I will take reasonable steps to contain the breach, assess its impact, and notify affected parties if required by law.

6. Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to the personal information I hold about you
• Request correction of any incorrect personal information
• Request deletion of your personal information

If you request a correction, I will update your personal information where reasonable and practical. If a correction cannot be made, I will record your request.

I may need to verify your identity before fulfilling your request.

To exercise any of these rights, email me at [email protected].

7. Data retention

• Feedback messages submitted via the website are kept only as long as needed to assist with improving the services, or for a maximum of 6 months. You are asked not to include personal information in your feedback, but if you do, it will be retained for the same period.
• Personal information received via email - your email address and any details you include in your message - is kept only as long as needed to respond and manage your request, or for a maximum of 6 months.
• Even after personal information is deleted, certain system events (e.g., feedback submitted or deleted) may be retained for auditing, troubleshooting, or legal compliance purposes. These events do not contain personally identifiable information and are only used to respond to lawful requests under the New Zealand Privacy Act 2020.
• Anonymous analytics data collected through Umami Cloud is retained according to Umami's retention period (currently up to 6 months, subject to change by Umami).
• Server logs and error logs may be kept briefly for security, troubleshooting, and compliance purposes.

After retention periods expire, data is securely deleted.

8. Third-party services

To keep the services running smoothly and securely, I use the following third-party service providers:

• Anthropic - provides the AI model used to analyse publicly available council and water authority content for restriction changes. No personal user information is sent to Anthropic
• DigitalOcean - hosts the website and API
• Supabase - hosts and manages the website's database, storing feedback and other website data. The database runs on AWS in the ap-southeast-2 (Sydney, Australia) region
• Cloudflare - provides DNS resolution, helps protect the site from attacks, and improves loading speeds
• Cloudflare Turnstile - helps prevent spam and automated submissions on the website's feedback form
• Umami Cloud - collects anonymous usage data to help understand how the site is used

These services may process limited technical information - such as IP addresses, request headers, device details, or logs - as part of normal operations for security, performance, and operational purposes. Some data may be processed outside New Zealand, depending on the provider. By using the services, you consent to this transfer.

All providers implement their own security measures to protect data, and their use is strictly to make the services work well and stay secure - not for advertising or tracking individual users.

9. Changes to this policy

This policy may be updated from time to time. The "Last updated" date at the top of this page indicates when these terms were last revised.

Your continued use of the services after any modifications constitutes acceptance of the updated policy.