Privacy Policy

Effective October 3, 2026

The MQPE Locator (qpe.geronimoengineering.com) is run by Geronimo Engineering. This page says what we collect, why, who helps us run the service, and how to get your information changed or removed.

What we collect

• Using the map and results needs no account, and we keep no record of the places you look at: the rainfall and forecast views are computed in your browser from published data, and the place you picked is kept in its address bar. To draw the map and fetch forecasts, though, your browser asks a few other services directly — they see your IP address and the area or place involved. See What your browser fetches from other services below.
• If you create an account: your name, your email address and your mobile number — creating an account means confirming both, the email with a code we email you and the number with a code we text it.
• If you set up alerts: the places and settings of your alerts, and the email addresses and mobile numbers you ask us to send them to — yours, or ones someone else added and their owner confirmed.
• Delivery records: when each alert or code was sent, and whether it was delivered, bounced, or opted out.
• Abuse protection: IP addresses and request counts, used to rate-limit sign-in and sign-up attempts.

Why

Only to run the service: to sign you in, send the alerts and sign-in codes you asked for, show you what was sent, and keep the service safe from abuse. We don’t show ads, and we don’t sell, rent or share your personal information for anyone’s marketing. Mobile numbers and SMS opt-in consent are never shared with third parties or affiliates for marketing or promotional purposes.

Who helps us run it

These service providers process data for us, only to provide their part of the service:

• Twilio sends our text messages from our toll-free number. For confirmation and sign-in codes we first ask Twilio’s Verify service to send the code; when Verify won’t send it, we make the code ourselves and text it from the same toll-free number. Either way Twilio receives your mobile number and the message.
• Our email provider delivers alert, confirmation and sign-in emails.
• Cloudflare sits in front of the site (security and delivery) and hosts the published rainfall data (R2), so it handles every request to the site and to the data — including which part of the rainfall grid your browser loads for the place you look at.

Accounts, alerts and delivery records are stored in a database on servers Geronimo Engineering runs.

What your browser fetches from other services

Some parts of the page are loaded by your browser straight from public services that we don’t run. Each one receives your IP address and your browser’s usual request details, plus what’s listed here, and handles it under its own privacy policy. We send them nothing about your account.

• OpenFreeMap (tiles.openfreemap.org) — the base map: the map tiles for the area and zoom you’re viewing. If it can’t be reached, a simpler fallback map comes from MapLibre’s demo tiles (demotiles.maplibre.org).
• OpenStreetMap’s Nominatim (nominatim.openstreetmap.org) — address search: the text you type in the address search box, sent as you type once it is three characters long. Entering coordinates in the latitude/longitude box or clicking the map sends nothing to it.
• National Weather Service (api.weather.gov) — forecasts and warnings: the latitude and longitude of the point whose forecast you open, and a statewide request for active flood warnings.
• Iowa Environmental Mesonet (Iowa State University, mesonet.agron.iastate.edu) — radar images: the radar tiles for the area and times you view, when a radar layer is on.
• Amazon Web Services (s3.amazonaws.com, the public elevation tiles) — terrain for the 3D view: the tiles for the area shown, only when you open 3D.
• Stream-gauge agencies — USGS (api.waterdata.usgs.gov), NOAA’s National Water Prediction Service (api.water.noaa.gov), the Bureau of Reclamation (data.usbr.gov) and the Army Corps of Engineers (cwms-data.usace.army.mil): which station’s readings you open on the Stream sensors layer. Other stream-sensor readings come through this site from Geronimo Engineering’s own sensor service.

The site’s fonts are served from this site itself, and it loads no advertising, analytics or tracking scripts and sets no cookies unless you sign in.

Public records shown on the map

Besides your own account, the map republishes public records about places and permits. These are about sites, not about you, and we take only what the tool needs:

• Construction permit sites and filings from the State Water Resources Control Board (SMARTS and its open data): a site’s permit number (WDID), name, address, risk level, coverage dates, and the reports, sampling results and Board actions filed for it. The State’s files also name owners, contacts, consultants and certifiers — we remove those names, emails and phone numbers when we read the files, and never store or show them. A site’s name is shown as it was filed; if a filed name identifies you personally and you’d like it hidden here, email [email protected].
• Water-quality monitoring results (CEDEN, via data.ca.gov), rain-gauge readings from public networks (CDEC, county flood-control districts, airports, CoCoRaHS volunteers by station name only),Caltrans project information, impaired-water listings and National Weather Serviceforecasts and warnings.
• The official records stay with the agencies that publish them; corrections to the underlying data belong with them, and we pick them up on our next refresh.

How long we keep it

Account, alert and contact details are kept until you delete them (or ask us to). Sign-in codes, rate-limit and abuse records are short-lived — days to weeks. Delivery records are kept while the alert they belong to exists. Encrypted database backups, used only to recover from a failure, are kept for up to 30 days, so something you delete can remain in a backup until it ages out. Archives of public rainfall, gauge and forecast data are kept indefinitely; they contain no personal information.

Your choices

• Delete an alert or a contact in the app. To delete your account and everything in it, email us.
• Stop email alerts with the unsubscribe link in any alert email.
• Stop texts by replying STOP to any message; reply HELP for help. See the SMS Terms.
• Ask what we hold about you, or have it corrected or removed: email [email protected].

Where

The service is meant for use in the United States, and data is processed in the United States.

Changes and contact

If this policy changes we’ll update this page and its effective date. Questions: [email protected].