Privacy Policy

1. Who is responsible

OverWatts is operated by an independent developer, who is the data controller for the processing described here. For any privacy question or to exercise any of the rights set out below, contact: [email protected]. We answer privacy requests within one month, as GDPR Art. 12(3) requires.

2. What we collect when you visit

Server logs. Like every website, our hosting provider records a technical log line for each request: your IP address, the page or API path, timestamp, referrer, and browser user-agent. We use these only to keep the service running and secure — diagnosing errors, spotting abuse and scraping, and sizing capacity. Legal basis: legitimate interests (Art. 6(1)(f)) in operating a secure service. We do not use these logs to build profiles, and we do not link them to anything else. They are retained for a short operational period (up to 30 days) and then rotated out.

Settings stored on your device. The site saves three things in your browser's local storage: your chosen theme, your map panel layout, and a flag recording that you have dismissed the introduction. These are read only by your own browser, are never transmitted to us, and expire only when you clear your browser data. Because they are strictly necessary to provide a feature you asked for, they do not require consent under the ePrivacy Directive (Art. 5(3)) — but you can remove them any time by clearing site data.

No analytics. There is no Google Analytics, no Plausible, no Matomo, no heatmapping, no session recording and no social tracking pixel anywhere on this site. Nothing measures you across pages or across sites. The one Google script we do load is an advertising-account verification tag, described in full in the next section.

3. Third parties your browser contacts

Almost every external data source on this site is fetched by our server, not your browser — prices, oil stocks, grid mix, news, weather and radar all come to you from our own domain. That is a deliberate choice: it means those providers never see your IP address. The exceptions are listed here in full.

• OpenFreeMap (map tiles and label fonts)
  The basemap is streamed directly to your browser from openfreemap.org, so that provider receives your IP address and the tile coordinates you are viewing (which reveals roughly what part of the world you are looking at). Tiles cannot practically be proxied at this scale. OpenFreeMap is a free, non-commercial service that states it does not track users or log personal data. Legal basis: legitimate interests (Art. 6(1)(f)) — a map cannot be delivered without it.
• Google AdSense (advertising)
  Advertising is active on the country, asset, chokepoint and insight pages — never on the map. Consent is collected by Google's own certified consent manager (the IAB TCF v2.2 framework), which appears the first time you open one of those pages. Google's tag loads in order to show you that prompt, but withholds advertising cookies and any personalisation until you have chosen. If you agree, Google may set cookies and personalise ads; if you decline, you are served non-personalised ads instead. Legal basis: consent (Art. 6(1)(a)) and ePrivacy Art. 5(3). See how Google uses data from partner sites. One exception you should know about. While our advertising account is being reviewed, every page carries a single Google script (adsbygoogle.js) whose only job is to prove to Google that we own this domain. It loads before any consent prompt, because Google's automated reviewer does not answer prompts — which means Google receives your IP address and the address of the page you are on, and may set a cookie. It serves you no advertising. We consider this the minimum needed to complete verification (Art. 6(1)(f)), we have disclosed it here rather than leave it unmentioned, and it is removed as soon as the review completes. You can block it with any content blocker without affecting the site.

Fonts are self-hosted. The typefaces are compiled into our own domain at build time and served from it. Your browser makes no request to Google Fonts, so no IP address is disclosed that way.

Hosting. The site runs on Railway, which processes the server logs described in section 2 on our behalf as a processor under Art. 28.

4. Your advertising consent

You can change or withdraw your choice at any time, with the same ease you gave it (Art. 7(3)):

5. When you contact us

The feedback button composes a message in your own mail client — nothing is submitted to our servers, and nothing is stored unless you actually press send in your mail app. To help us reproduce issues, the draft is pre-filled with the page URL you were on and your window size; you can delete that text before sending. If you do email us, we process your address and message solely to reply (legal basis: legitimate interests, Art. 6(1)(f)), and keep the correspondence only as long as it is useful, typically under 24 months.

Email alerts and subscriptions are advertised in places as a future feature. They are not built or active: the endpoint refuses every request and no email address can currently be stored. If that changes, this page will be updated before any address is collected.

6. About the infrastructure and vessel data

The content of the map — refineries, terminals, pipelines, power plants, mines, and the AIS positions of merchant vessels — is not personal data about you, and is published from open sources listed on the sources page. AIS broadcasts identify commercial ships and their operators, not private individuals, and are transmitted publicly by the vessels themselves. If you believe a record we display relates to you personally, contact us and we will review it.

7. International transfers

Serving a website inevitably means your IP address reaches whoever delivers the bytes. Our hosting and the map-tile provider may process requests outside the European Economic Area. Where a recipient is outside the EEA and not covered by an adequacy decision, transfers rely on the European Commission's Standard Contractual Clauses or the provider's equivalent safeguards. No special categories of data are involved, and the only data transferred is the technical request metadata described above.

8. Your rights

Under the GDPR you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of what came before.

In practice there is very little to exercise these rights against: without an account we hold no record that identifies you, and we usually cannot link a log line to a person even if asked (Art. 11). To make a request, email [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority in the EU or EEA country where you live or work (Art. 77) — you can find yours via the European Data Protection Board.

9. Automated decisions, children, and embeds

We carry out no automated decision-making or profiling that produces legal or similarly significant effects (Art. 22). The site is a professional data tool and is not directed at children. If you embed the OverWatts map in another website using our embed view, visitors to that site load our map and its tiles, and this policy applies to that loading — the embedding site is responsible for its own notice.

10. Changes

If what we process changes, this page changes with it and the date at the top is updated. Material changes to anything requiring consent will be re-prompted rather than quietly applied.