Your privacy on RoadFlag
RoadFlag is built to need as little about you as possible. There are no accounts, no names, no adverts tracking you and no cookies.
- You never give us your name, email or phone number to use RoadFlag.
- Location data is removed from your photos on your phone before they're uploaded, and you can blur faces before posting.
- "Share my location" links are made on your phone. We never see or store them.
- We don't sell anything that identifies you. The only thing we might ever share or sell is road information: what was reported, where and when, with its photos.
Who we are
RoadFlag is run by LCM 4x4 Ltd, a company in West Wales. LCM 4x4 Ltd is the "data controller" for RoadFlag. For anything about your information, email [email protected].
What we collect and why
| What | Why | How long |
|---|---|---|
| Your reports The spot on the map, the type of hazard, whether it's passable, your note and photo, and the time. | To show the hazard to everyone. Reports are public. | Reports leave the map after 48 hours unless someone confirms them. We keep the record afterwards, because a history of where roads flood or trees come down is useful to people and councils. |
| A random device code Made by your browser the first time you use RoadFlag, e.g. "a7f3…". It isn't linked to your name, number or phone. | To stop spam: limiting how many reports one phone can post, stopping one phone confirming the same thing over and over, and blocking someone who posts abuse. It's never shown publicly. | Kept with the reports and updates it made. |
| Updates you make "Still there", "Now passable", "Cleared", or "Report a problem". | To keep the map accurate and spot misuse. | As for reports. |
| Visit counts Each day you open RoadFlag, we note the random device code, the date, and whether you're using the installed app. | To count how many people use RoadFlag. No location, IP address or anything else is recorded with it. | Kept as running totals. |
| Technical logs Like every website, the servers that deliver RoadFlag briefly log things like your IP address and browser type. | Security and keeping the site running. | Short-term, set by our hosting providers. |
Our lawful basis is legitimate interests: running a free public safety map and protecting it from abuse. We've kept what we collect to the minimum needed for that.
Your location
When you press Report a hazard or the locate button, your phone asks whether RoadFlag may use your location. We use it only to move the map to where you are. Your own position is never saved. Only the spot where you place the hazard is saved, and only when you post the report.
The first time you open RoadFlag, the map opens roughly where you are – your town or county – using the approximate area that Cloudflare, our web host, works out from your internet connection. There's no pop-up for this and it isn't precise. We use it once to centre the map; we don't save it or link it to you.
Photos
Photos are shrunk on your phone before upload, which removes the hidden data cameras add, including GPS location. Before you post, you can tap your photo to check it and use "Blur faces": your phone looks for faces and blurs them, using Google's MediaPipe face detector, which runs entirely on your phone (the photo is not sent to Google). It can miss faces or blur the wrong thing, so you see the result and can undo it. Please avoid number plates and faces where you can. If you appear in a photo and want it removed, email us and we'll take it down.
Who we share reports with
Reports are public anyway, but we also send them directly to partners who help people travel safely – local newspapers, radio and other media, councils and bus companies. They get what anyone can see on the map: the type of hazard, where and when, the note, the photos, and how many people backed it up. They never get the random device code, your IP address, or anything else that could identify you. Partners may publish reports and photos, credited to RoadFlag.
Who else is involved
We use a few trusted services to run RoadFlag. Your browser connects to them directly, so they can see your IP address:
- Supabase: stores reports and photos, on servers in London.
- Cloudflare: hosts the website.
- OpenStreetMap and Esri: provide the map and satellite images.
- postcodes.io: when you open a report, its location (not yours) is looked up to find the right council.
- Google Fonts, cdnjs and jsDelivr: deliver the lettering and code libraries the page uses.
Fuel prices, flood warnings, power cuts and bus routes come from the UK Government's Fuel Finder, Natural Resources Wales, National Grid, SP Energy Networks and Traveline. We collect them on our own servers, so looking at them sends nothing about you to any of those organisations.
Response teams: "On duty" and location
People in a response team with a RoadFlag partner account can choose to go "on duty" and share their location with their own team's control room. This is off unless they turn it on, and only their own organisation's control and managers can see where they are – never the public, other volunteers or other organisations. We keep only their latest position (no history of where they've been), it's sent only while RoadFlag is open on their phone, and it's deleted as soon as they stand down, or automatically after 12 hours at most. Team members also get an email when control gives them a job.
What's stored on your phone
RoadFlag saves a few small settings in your browser: the random device code, your light or dark choice, your map style, which layers you've switched on, the part of the map you last looked at (so it opens there next time), and whether you've seen the welcome guide. These aren't cookies and aren't used for tracking. Clearing your browser data removes them.
Your rights
You can ask to see, correct or delete information about you, or object to how we use it. Because we don't know who you are, the easiest way is to tell us which report it is (tap the report, then Share this report, and send us the link). Email [email protected] and we'll reply within a month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.
Changes
If we change how RoadFlag uses information, we'll update this page and the date at the top.