1. What Information Fire Aware Processes

Fire Aware strictly minimizes data collection to what is necessary to deliver real-time wildfire safety, air quality monitoring, and geospatial intelligence across British Columbia.

• Account and sign-in data: If you create an account, sign in with email, or choose Google, GitHub, Apple, Microsoft, Discord, or another enabled provider, we receive your email address, display name, account identifier, sign-in method, email-confirmation status, and account timestamps. You may add an optional display name and organization. Passwords for email sign-in are handled by our authentication provider, Supabase Auth; we do not store passwords in our own database, and social sign-in does not give us your provider password.
• Environmental Telemetry: Outdoor sensor metrics (PM2.5, AQI, CO₂, temperature, relative humidity, barometric pressure) collected from community IoT stations. These readings reflect ambient atmospheric observations only and contain no user identity, audio, video, or biometric information.
• Inquiry & Report Submissions: Information provided when submitting contact forms or community fire witness observations (name, email, narrative description). Data is used exclusively to respond to inquiries or verify situational safety.
• Technical Telemetry: Standard HTTP request logs (IP address, user-agent, request path) processed by edge infrastructure (Vercel, Cloudflare) for rate limiting, DDoS prevention, and service availability.

How we use information. We use personal information to provide and secure the website, maps, sensors, and account features; authenticate you; remember your preferences; respond to inquiries and reports; prevent abuse and fraud; diagnose failures; and comply with applicable law. Where consent is required, we ask for it. Otherwise, we process account data because it is needed to provide the service you requested and to keep that service secure.

What we do not do. We do not sell or rent personal information. We do not use Google user data for advertising, behavioral profiling, or training generalized AI models. We do not access Gmail, Google Drive, Google Calendar, Google Contacts, or other Google services. We do not use advertising networks, behavioral tracking pixels, or data brokers on this site.

Children. Fire Aware is a general-audience public-safety service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

2. Google Sign-In, Account Data & Deletion

Signing in is optional. You can browse the public homepage, maps, air-quality readings, weather, and this Privacy Policy without creating an account. If you choose “Continue with Google” (or another enabled provider), Google authenticates you and returns basic profile information to our authentication provider, Supabase Auth.

Google user data we receive. We receive your name, email address, account identifier, and, if Google supplies it, a profile-image URL. We may also receive whether your email is verified and the sign-in timestamps needed to secure your account. We do not request or receive access to Gmail, Google Drive, Google Calendar, Google Contacts, YouTube, or any other Google service. We do not receive or store your Google password.

How we use it. We use this information only to authenticate you, create and maintain your Fire Aware account, display your name and email in the Account centre, associate developer projects with your account, prevent abuse, and provide support you request. We do not sell or rent Google user data, use it for advertising or profiling, or use it to train generalized AI models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing. Supabase hosts authentication and our database. Vercel and Cloudflare host, serve, and protect the site. Email and support providers may process messages you send us. These providers receive only what they need to perform those services and are not permitted to use Google user data for their own advertising. We may disclose information if required by law or when necessary to protect someone’s safety or our legal rights. We do not sell personal information.

Retention and deletion. We retain account data while your account is active and for a limited period afterward for security, dispute resolution, and legal obligations. You can ask us to delete your account and associated profile data by emailing [email protected] from the account email address with the subject “Delete my Fire Aware account.” We aim to complete verified deletion requests within 30 days and will tell you if a legal retention duty prevents immediate deletion. Residual copies may remain in rotating backups for a limited period. You can also revoke Fire Aware’s Google access at myaccount.google.com/permissions; revoking access stops future sign-in but does not by itself delete information we already received, so email us if you want it deleted.

3. Location, Coordinates & Map Data Disclosures

Location and map data: If you grant browser location access or use a location feature, coordinates can be processed in the browser, sent to Fire Aware, and/or sent to third-party data providers to return location-specific results. Some pages call Open-Meteo directly from your browser; other requests are proxied through Fire Aware. Location is stored in browser localStorage on supported pages; retention follows browser storage and your site-data settings. Fire Aware may receive coordinates in GET URLs (which can appear in browser, proxy, or server logs) or, on selected lookups, in POST bodies. POST avoids putting the point in the URL; it does not make the request anonymous or prevent Fire Aware from processing it.

Place selection and geocoding: The residential exposure page uses a bundled list of British Columbia places; typing and selecting a result do not send search text to a geocoding provider. The route planner also matches text locally against curated places, but calculating a route sends the resolved waypoint coordinates to Project OSRM. If you open an external-navigation link, entered place names or coordinates are sent to the selected service—Google Maps, Apple Maps, Waze or OpenStreetMap. Satellite-animation shortcuts on fire-detail and residential pages build a CIRA RAMMB SLIDER (Colorado State University) link that includes the selected point's coordinates; opening it sends that location to CIRA. After you select a residential-report place, its approximate coordinates are sent to Fire Aware for nearby public-data queries. The public forward and reverse geocoding endpoints are disabled. Do not enter home addresses, names or other personal/confidential information into free-text location fields.

4. Providers Receiving Location or Map-Area Requests

Providers receiving location or map-area requests: Depending on the page, selected location, and enabled layers, point or area queries may be sent to Open-Meteo/Copernicus CAMS (weather, air quality, elevation and historical weather); Environment and Climate Change Canada / GeoMet (AQHI and map layers); NRCan/CWFIS and B.C. government mapping services (fire-weather, terrain and other geospatial layers); and optional services including WeatherAPI, Visual Crossing, Tomorrow.io, Google Pollen, OpenWeatherMap, WAQI/AQICN, IQAir, PurpleAir, OpenAQ, Infernis, SpotWX, Vaisala/Earth Networks, Overpass (OpenStreetMap fire-station data), USGS LandsatLook, Amazon Earth Search and Microsoft Planetary Computer. Map tiles and terrain imagery are requested from external hosts such as OpenStreetMap, OpenTopoMap, Esri, NASA GIBS, ECCC GeoMet and AWS Open Data terrain tiles; tile requests can reveal the viewed map area to those hosts. Route planning sends waypoint coordinates directly to the public OSRM service at Project OSRM. These examples reflect current code and configuration; optional providers are contacted only when their feature is used and, for keyed providers, configured. Provider URLs and logging/retention practices are governed by those providers.

Pages also load general-purpose third-party content and services: icon and map-library files from CDNs (cdnjs.cloudflare.com, unpkg.com), optional machine translation served by Google, and a Cloudflare Turnstile human-verification challenge on forms that use it. Like any third-party request, these receive your IP address and page context.

Translation is loaded only when you ask for it. The Google Translate widget is not present on page load. Choosing a language other than English, or using the language selector, is what loads Google's script; at that point Google receives this page's text together with your IP address, user agent and referrer, and may set its own cookies. If you never choose translation, nothing is sent to Google. Declining it does not reduce the functionality of the site, and no consent category is required to keep using Fire Aware.

5. Hardware Store Purchases & IoT Node Data

Current status: the checkout is a demonstration and no purchase can be completed. Our checkout page is an interface preview. It does not contact any bank, card network or payment processor, it does not accept or store card details (the card-entry fields have been removed), and it does not place an order. Anything you type into it stays in your own browser; the only thing it writes is a local preview record in your browser's localStorage, which you can clear at any time.

Because no payment is processed, we do not collect payment card data at all. If we begin accepting real orders, this section will be updated before that happens, and any card payment will be handled exclusively on a PCI-DSS compliant processor's own hosted fields — we will not receive or store raw card numbers, expiry dates or security codes.

When a real purchase is offered, the following will apply:

• Shipping & Fulfillment: Your recipient name, physical delivery address, email, and telephone number are utilized solely to generate shipping manifests via postal carriers (Canada Post, UPS, FedEx) and deliver order confirmation receipts.
• Hardware Sensor Data: Field nodes deployed on private property stream environmental data (particulate matter, air temperature) into the public sensor snapshot map. Node locations are displayed on the public map at neighborhood resolution without revealing private resident identity.

6. Cookies & Browser Storage Technologies

Fire Aware uses client-side storage technologies (cookies, localStorage, sessionStorage) partitioned strictly by necessity:

• Strictly Necessary: Consent selection tokens (fireaware_consent_v1), theme preferences (theme), and edge security tokens. These do not track personal identity and cannot be switched off.
• Site Preferences: Saved map center coordinates, active layer toggles, and evacuation checklist completions in the Interactive Guide.
• Performance Analytics: Vercel Web Analytics and Speed Insights collect aggregate, cookieless metrics on page latency and error rates. Performance analytics remain strictly deactivated until you grant opt-in consent.

Review our complete Cookie & Browser Storage Policy for an itemized table of all keys and retention periods.

7. AI Conversational Assistant & Abuse Prevention

The on-page AI Assistant provides rapid answers to wildfire safety and platform questions.

• Queries are verified using Cloudflare Turnstile to prevent bot exhaustion. Turnstile validates browser authenticity without presenting interactive CAPTCHA puzzles.
• Assistant session histories are retained ephemerally in browser memory and are discarded upon tab closure.
• Conversation questions are processed server-side through bounded LLM interfaces solely to generate immediate replies. We do not sell user queries to third parties.

8. How to Withdraw Consent & Your Legal Rights

Under the British Columbia Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you hold the right to access, correct, or request deletion of your personal information.

To make a request, email [email protected] from the address associated with your account with the subject “Privacy request.” Tell us whether you want access, correction, export, or deletion. We may ask for information to verify that the request comes from you. We aim to respond within 30 days; if we need more time, we will explain why. Deleting your account removes your profile and account record, subject to the retention duties described in section 9. You may also contact the Office of the Information and Privacy Commissioner for British Columbia if you are not satisfied with our response.

You can revoke or modify your optional cookie and storage consent at any time by clicking the Cookie & Privacy Settings button located in the footer of every page or on this Privacy Policy. You can also clear browser localStorage directly in your browser developer settings at any time.

9. Security, Retention & Breach Response

We apply reasonable technical and organizational safeguards proportionate to the information we hold: transport encryption (HTTPS) in transit, access controls and least-privilege credentials for server-side systems, secrets kept out of client code and version control, and dependency and configuration review as part of development. No system is perfectly secure, and we do not claim otherwise.

Retention. We keep personal information only as long as it is needed for the purpose it was collected, or as a law requires. Browser storage you control (theme, saved map position, consent record) stays until you clear it. Where a legal retention period applies, deletion is deferred until it ends.

Where information is processed. Our team is based in British Columbia. Our service providers may process information in Canada, the United States, or other countries where they operate. We use contractual and organizational safeguards appropriate to the sensitivity of the information and limit transfers to what is needed to provide the service. Laws in those countries may differ from BC law; contact our privacy officer if you have questions about a specific transfer.

If a breach happens. We investigate every suspected incident promptly and contain it. Where a breach creates a real risk of significant harm — for example financial loss, identity theft, or serious reputational or other harm — we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible after we determine a breach occurred, and we will keep a record of the breach and our response. We also report to the Office of the Information and Privacy Commissioner for British Columbia. Because our records are held in British Columbia and processed through service providers that may be located outside Canada, a breach notification may involve both regulators. Our BC privacy officer coordinates the response and is the contact for breach enquiries (see below).

This describes how we intend to respond and is not a guarantee of a particular outcome. Where a legal duty applies, we follow it; the federal mandatory reporting threshold is described in PIPEDA s.10.1, and BC's privacy commissioner recommends reporting private-sector breaches.

10. Privacy Officer & Contact Information

For inquiries regarding our data management practices, to exercise your privacy rights, or to submit a formal PIPA request, please contact:

Changes to this policy

We may update this policy to reflect changes to the service, providers, or law. We will post the revised policy at this URL and change the effective date above. If a change materially affects how we use personal information, we will provide a clear notice before it takes effect. The version in effect when you use the service governs that use.