1. What Information Fire Aware Processes

Fire Aware strictly minimizes data collection to what is necessary to deliver real-time wildfire safety, air quality monitoring, and geospatial intelligence across British Columbia.

• Environmental Telemetry: Outdoor sensor metrics (PM2.5, AQI, CO₂, temperature, relative humidity, barometric pressure) collected from community IoT stations. These readings reflect ambient atmospheric observations only and contain no user identity, audio, video, or biometric information.
• Inquiry & Report Submissions: Information provided when submitting contact forms or community fire witness observations (name, email, narrative description). Data is used exclusively to respond to inquiries or verify situational safety.
• Technical Telemetry: Standard HTTP request logs (IP address, user-agent, request path) processed by edge infrastructure (Vercel, Cloudflare) for rate limiting, DDoS prevention, and service availability.

2. Location, Coordinates & Map Data Disclosures

Location and map data: If you grant browser location access or use a location feature, coordinates can be processed in the browser, sent to Fire Aware, and/or sent to third-party data providers to return location-specific results. Some pages call Open-Meteo directly from your browser; other requests are proxied through Fire Aware. Location is stored in browser localStorage on supported pages; retention follows browser storage and your site-data settings. Fire Aware may receive coordinates in GET URLs (which can appear in browser, proxy, or server logs) or, on selected lookups, in POST bodies. POST avoids putting the point in the URL; it does not make the request anonymous or prevent Fire Aware from processing it.

Place selection and geocoding: The residential exposure page uses a bundled list of British Columbia places; typing and selecting a result do not send search text to a geocoding provider. The route planner also matches text locally against curated places, but calculating a route sends the resolved waypoint coordinates to Project OSRM. If you open an external-navigation link, entered place names or coordinates are sent to the selected service—Google Maps, Apple Maps, Waze or OpenStreetMap. Satellite-animation shortcuts on fire-detail and residential pages build a CIRA RAMMB SLIDER (Colorado State University) link that includes the selected point's coordinates; opening it sends that location to CIRA. After you select a residential-report place, its approximate coordinates are sent to Fire Aware for nearby public-data queries. The public forward and reverse geocoding endpoints are disabled. Do not enter home addresses, names or other personal/confidential information into free-text location fields.

3. Providers Receiving Location or Map-Area Requests

Providers receiving location or map-area requests: Depending on the page, selected location, and enabled layers, point or area queries may be sent to Open-Meteo/Copernicus CAMS (weather, air quality, elevation and historical weather); Environment and Climate Change Canada / GeoMet (AQHI and map layers); NRCan/CWFIS and B.C. government mapping services (fire-weather, terrain and other geospatial layers); and optional services including WeatherAPI, Visual Crossing, Tomorrow.io, Google Pollen, OpenWeatherMap, WAQI/AQICN, IQAir, PurpleAir, OpenAQ, Infernis, SpotWX, Vaisala/Earth Networks, Overpass (OpenStreetMap fire-station data), USGS LandsatLook, Amazon Earth Search and Microsoft Planetary Computer. Map tiles and terrain imagery are requested from external hosts such as OpenStreetMap, OpenTopoMap, Esri, NASA GIBS, ECCC GeoMet and AWS Open Data terrain tiles; tile requests can reveal the viewed map area to those hosts. Route planning sends waypoint coordinates directly to the public OSRM service at Project OSRM. These examples reflect current code and configuration; optional providers are contacted only when their feature is used and, for keyed providers, configured. Provider URLs and logging/retention practices are governed by those providers.

Pages also load general-purpose third-party content and services: icon and map-library files from CDNs (cdnjs.cloudflare.com, unpkg.com), optional machine translation served by Google, and a Cloudflare Turnstile human-verification challenge on forms that use it. Like any third-party request, these receive your IP address and page context.

Translation is loaded only when you ask for it. The Google Translate widget is not present on page load. Choosing a language other than English, or using the Translate control, is what loads Google's script; at that point Google receives this page's text together with your IP address, user agent and referrer, and may set its own cookies. If you never choose translation, nothing is sent to Google. Declining it does not reduce the functionality of the site, and no consent category is required to keep using Fire Aware.

4. Hardware Store Purchases & IoT Node Data

Current status: the checkout is a demonstration and no purchase can be completed. Our checkout page is an interface preview. It does not contact any bank, card network or payment processor, it does not accept or store card details (the card-entry fields have been removed), and it does not place an order. Anything you type into it stays in your own browser; the only thing it writes is a local preview record in your browser's localStorage, which you can clear at any time.

Because no payment is processed, we do not collect payment card data at all. If we begin accepting real orders, this section will be updated before that happens, and any card payment will be handled exclusively on a PCI-DSS compliant processor's own hosted fields — we will not receive or store raw card numbers, expiry dates or security codes.

When a real purchase is offered, the following will apply:

• Shipping & Fulfillment: Your recipient name, physical delivery address, email, and telephone number are utilized solely to generate shipping manifests via postal carriers (Canada Post, UPS, FedEx) and deliver order confirmation receipts.
• Hardware Sensor Data: Field nodes deployed on private property stream environmental data (particulate matter, air temperature) into the public sensor snapshot map. Node locations are displayed on the public map at neighborhood resolution without revealing private resident identity.

5. Cookies & Browser Storage Technologies

Fire Aware uses client-side storage technologies (cookies, localStorage, sessionStorage) partitioned strictly by necessity:

• Strictly Necessary: Consent selection tokens (fireaware_consent_v1), theme preferences (theme), and edge security tokens. These do not track personal identity and cannot be switched off.
• Site Preferences: Saved map center coordinates, active layer toggles, and evacuation checklist completions in the Interactive Guide.
• Performance Analytics: Vercel Web Analytics and Speed Insights collect aggregate, cookieless metrics on page latency and error rates. Performance analytics remain strictly deactivated until you grant opt-in consent.

Review our complete Cookie & Browser Storage Policy for an itemized table of all keys and retention periods.

6. AI Conversational Assistant & Abuse Prevention

The on-page AI Assistant provides rapid answers to wildfire safety and platform questions.

• Queries are verified using Cloudflare Turnstile to prevent bot exhaustion. Turnstile validates browser authenticity without presenting interactive CAPTCHA puzzles.
• Assistant session histories are retained ephemerally in browser memory and are discarded upon tab closure.
• Conversation questions are processed server-side through bounded LLM interfaces solely to generate immediate replies. We do not sell user queries to third parties.

7. How to Withdraw Consent & Your Legal Rights

Under the British Columbia Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you hold the right to access, correct, or request deletion of your personal information.

You can revoke or modify your optional cookie and storage consent at any time by clicking the Cookie & Privacy Settings button located in the footer of every page or on this Privacy Policy. You can also clear browser localStorage directly in your browser developer settings at any time.

8. Security, Retention & Breach Response

We apply reasonable technical and organizational safeguards proportionate to the information we hold: transport encryption (HTTPS) in transit, access controls and least-privilege credentials for server-side systems, secrets kept out of client code and version control, and dependency and configuration review as part of development. No system is perfectly secure, and we do not claim otherwise.

Retention. We keep personal information only as long as it is needed for the purpose it was collected, or as a law requires. Browser storage you control (theme, saved map position, consent record) stays until you clear it. Where a legal retention period applies, deletion is deferred until it ends.

If a breach happens. We investigate every suspected incident promptly and contain it. Where a breach creates a real risk of significant harm — for example financial loss, identity theft, or serious reputational or other harm — we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible after we determine a breach occurred, and we will keep a record of the breach and our response. We also report to the Office of the Information and Privacy Commissioner for British Columbia. Because our records are held in British Columbia and processed through service providers that may be located outside Canada, a breach notification may involve both regulators. Our BC privacy officer coordinates the response and is the contact for breach enquiries (see below).

This describes how we intend to respond and is not a guarantee of a particular outcome. Where a legal duty applies, we follow it; the federal mandatory reporting threshold is described in PIPEDA s.10.1, and BC's privacy commissioner recommends reporting private-sector breaches.

9. Privacy Officer & Contact Information

For inquiries regarding our data management practices, to exercise your privacy rights, or to submit a formal PIPA request, please contact: