The short version
- We have no accounts and keep no personal data on our servers.
- Your run settings live in your browser’s local storage, on your device only.
- Your location is used once per lookup to pick a forecast point and is not stored or logged by us.
- Analytics runs only with your consent, or until you opt out where the law uses an opt-out model. It consists of anonymous usage counts kept on our own server and, where configured, Google Analytics 4.
- Advertising is planned to keep the site free. It is not active yet; when it is, this policy will be updated and you will be asked again.
- We honour the Global Privacy Control (GPC) signal everywhere.
Who is responsible
PuddleRunner operates puddlerunner.com. Contact: [email protected].
What we collect, and what we do not
Data stored on your device (local storage)
These keys are stored by your browser for this site only. They never leave your device unless you share a link yourself. Clear them at any time through your browser’s site-data settings.
| Key | Purpose | Category |
|---|---|---|
puddlerunner-settings-v2 | Your last location search, distance, pace, time window, route exposure, plan mode, units and comfort settings (heat tolerance, cold, rain, daylight) so the planner is ready when you return. | Functional (no consent needed, disclosed here) |
puddlerunner-consent | Your privacy choices: policy version, timestamp, analytics on/off, advertising on/off. | Functional |
puddlerunner-session | A random identifier for the current tab, so usage events from one visit can be counted together. Session storage: gone when the tab closes, and removed immediately if you decline analytics. | Analytics (consent-governed) |
PuddleRunner sets no first-party cookies. The service worker caches the app’s own files (styles, scripts, fonts, icons) so the page opens quickly; it never caches forecasts as if they were fresh.
Location
When you type a postal code or town, it is sent to our server, which asks a geocoding provider for a forecast point. When you tap “Use my location”, your browser asks for permission, your device coordinates are rounded to two decimals (about 1 km) before they are sent, and our server resolves them to a public place name and forecast point. We do not persist or log raw coordinates or postal codes: our access logs exclude query strings, and forecast caches are keyed by rounded public forecast points, not by visitor.
Server logs
Our server records the request method, path, status and timing for reliability and abuse prevention, without query strings. Our hosting edge (Cloudflare) provides a country code with each request so we can show the correct consent model; it is stored only alongside consented usage events, never with a request log.
Analytics
With your consent we record, on our own server, which pages were opened and which planner features were used: a window lookup and its settings (plan mode, units, route exposure, run length, pace, start-time range and the country of the forecast), whether it succeeded, which start time was selected, the forecast range viewed, calendar and share buttons, how long the page was visible and how far it was scrolled. Each event carries a random session identifier that your browser keeps in session storage for the current tab only, your device size, the website that linked you here (its domain only) and the country code supplied by our hosting edge. These events never include your postal code, coordinates, place name, IP address or browser details, and cannot be linked to you or across visits. They are deleted after 90 days and are only used to understand how the planner is used.
Where Google Analytics 4 is configured, the same consent also allows it to count visits and successful lookups; the event we send includes the country of the forecast and whether a route was marked waterfront or inland, never your postal code, coordinates or place name. GA4 does not log or store IP addresses. Google Consent Mode v2 is configured so that no analytics or advertising storage is used until you say yes.
Advertising
We intend to show advertising to keep PuddleRunner free. No advertising scripts load today. Before any are added we will update this policy, bump its version so you are asked again, and keep advertising subject to the same consent controls as analytics.
Your choices
Open at any time to accept, reject or change analytics and advertising. Rejecting takes effect immediately without a reload, and we expire any analytics cookies we can reach.
- EU/EEA, UK and Switzerland (GDPR, UK GDPR, ePrivacy, FADP): optional services are off until you opt in. “Reject all” is one tap. You have the right to access, correct, erase, restrict or object to processing and to data portability. Because we hold no personal data on our servers, there is nothing for us to retrieve or delete; the data lives in your browser and you can clear it directly. You may lodge a complaint with your supervisory authority.
- United States (CCPA/CPRA and other state laws): we do not sell personal information. Consent-governed advertising may count as “sharing” under California law; the persistent “Your privacy choices / Do Not Sell or Share My Personal Information” control in the footer lets you opt out, and a Global Privacy Control signal is treated as an opt-out automatically. You have the right to know, delete, correct, and not be discriminated against for exercising your rights.
- Everywhere: we treat an unknown jurisdiction with the opt-in model and honour GPC.
To exercise any right, e-mail [email protected]. We respond within 30 days, or sooner where the law requires.
Retention
We retain no personal data. Forecast caches hold public weather for about two days. Anonymous usage events are deleted after 90 days. Operational logs rotate and contain no location or identity information.
Children
PuddleRunner is not directed at children under 13 and we do not knowingly collect information from them (COPPA). The site collects nothing that would change that.
Data sources
US forecasts, observations and alerts come from the National Weather Service (public domain). International forecasts, the UV index for every location and location search come from Open-Meteo (CC BY 4.0) and GeoNames. Requests to these providers include the forecast coordinates but no information about you.
Security
The site is served over HTTPS with strict transport security, a content security policy and rate limiting. Report a security issue to [email protected] or see security.txt.
Changes
When this policy changes materially, its version and effective date change and the consent prompt is shown again. Policy version 2026-10-29, effective October 29, 2026.