Privacy policy
Overview
Floodboard is a free, independent flood map for Thailand. It has no user accounts, uses no tracking cookies and shows no ads. We do not sell personal data. The Floodboard team is the data controller under the Personal Data Protection Act B.E. 2562 (PDPA).
Data we collect
- Flood reports: location, road status, water depth, and an optional note and photo. Faces in photos are blurred and file metadata (including GPS) is removed before storage.
- Data sent with a report: a random identifier stored in your browser (we keep only its hash), a network fingerprint that cannot be turned back into your IP address, and your device position at that moment if you have allowed location access.
- Location: used to calculate routes and show reports near you. The path you actually travel stays on your device.
- Usage data: visit statistics without cookies or stored IP addresses; which reports were viewed or passed, to count how many people each report helped; and recordings of a sample of map sessions with all typed text masked. Enable Do Not Track or Global Privacy Control in your browser to opt out.
Purposes and legal basis
To show flood conditions and safe routes (protecting life and health); to detect false or abusive reports; and to secure and improve the service (legitimate interest). Optional features such as location sharing and nicknames rely on your consent, which you can withdraw at any time.
What is public
Reports appear on the public map and may be posted on Floodboard's X and Facebook accounts. Nicknames appear on the leaderboard. Reports are also published as open data with coordinates rounded to about 110 m, without photos or reporter identifiers.
Service providers
We use third-party services for content delivery and security (Cloudflare), map tiles (OpenStreetMap, Esri), place search (Photon by komoot) and analysis of public Traffy Fondue photos (Anthropic). Opening a route in Google Maps sends your start and destination to Google. Some providers process data outside Thailand.
Retention
Reports and photos, including the data sent with them, are kept as an archive of the floods until you ask us to delete them. Data used to detect false reports is kept for 72 hours and session recordings for 14 days. Security logs are rotated automatically.
Your rights
You may request access to, correction or deletion of your data, object to its processing, and withdraw consent. Contact us on X @floodboardTH or the Floodboard Facebook page; for a report or photo, include its time and place. We delete reports and photos within 7 days and respond to other requests within 30 days. You may also lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).
Acceptance and changes
Tapping "I understand" in the warning dialog confirms that you have read and accept this policy. Changes are dated below.
Last updated: 12 Oct 2026