Privacy

In short

• No account is needed, and none can be created.
• Advertising is served by Google, which sets cookies and reads device identifiers on every page. That is the one thing here that can follow you beyond this site, and it is described in full below.
• Nothing this site stores about you — an email address, and only if you asked for alerts — is passed to Google, to any advertiser, or sold to anyone.
• The only personal data the site can ever store is an email address, and only if you ask for alerts and then confirm.
• Your location, if you choose to share it, stays in your browser. It is never transmitted to this site and never stored.
• maqua.app sets no cookies of its own. The advertising cookies are set by Google, under Google's policy rather than this one.

This deployment has anonymous, cookieless usage measurement enabled. Details below.

Usage measurement

Vercel Analytics and Vercel Speed Insights are used to understand which pages are read and how quickly they load. Both are cookieless: they set nothing on your device and build no cross-site profile. What is recorded is the page path, an approximate country, referrer, device type and page-performance timings, aggregated so an individual visitor cannot be picked out or followed between visits.

• Page views: enabled
• Performance timings: disabled

Independently of this, the hosting platform keeps ordinary server request logs — the kind every web server keeps — for a short period, for security and abuse prevention. These contain an IP address, which is personal data. They are not used to profile visitors and are not combined with anything else on this site.

Advertising

maqua.app carries advertising through Google AdSense. Google's advertising script is loaded on every page of this site, including this one.

Google uses cookies and similar device identifiers to choose which advertisements to show, to limit how often you are shown the same one, and to measure whether it worked. This is not the anonymous, cookieless measurement described above and it is not confined to this site: Google may combine what it observes here with what it observes elsewhere. What it collects, and what it does with it, is governed by Google's own privacy policy rather than by this page.

Advertising cookies are not strictly necessary, so under the EU ePrivacy rules they require your consent before they are set. A consent tool for visitors in the EEA and the UK is being put in place. Until it is, you can turn off personalised advertising in Google’s own Ads Settings, or block third-party cookies in your browser — neither affects anything else on this site.

Advertising is what pays for running this site. It does not influence the readings: the measurements, the bands and the health guidance come from ERA and the EEA and from the published European index, and no advertiser sees, supplies or affects any of them.

Cookies and local storage

maqua.app sets no cookies of its own, and the usage measurement described above is cookieless. The advertising is not: Google sets cookies and reads device identifiers from your browser, and it does so directly rather than through this site.

Advertising cookies

Set by Google to select and measure advertisements, and readable by Google across other sites that carry its advertising. These are the only cookies on this site, they are the only thing here that is not strictly necessary, and they are covered by Google's policy rather than this one.

Appearance preference

Choosing light, dark or “match device” stores a single value in your browser's local storage so the page does not flash the wrong theme on your next visit. It never leaves your device and can be cleared with your browser data.

In-page data

Readings fetched while you browse are held in memory for the life of the tab and are discarded when it closes.

Location

The map has an optional “find my location” control. It uses your browser's geolocation, which always asks your permission first and can be declined without losing any other feature.

Your coordinates are used only inside your browser, to centre the map and to work out which monitoring station is nearest. They are never sent to this site, never written to a database, and never included in a log.

Declining the prompt changes nothing else: every station is reachable from the map and from the list either way. Permission can be revoked at any time in your browser settings.

Email alerts

Alerts are not enabled on this deployment. No email address can be submitted, and none is stored.

What is stored, if you subscribe

• Your email address.
• The station and band you asked to be alerted about, and how often.
• Whether the address has been confirmed, and the times of subscription, confirmation and the most recent alert — needed to avoid sending the same alert twice.

The address is used for nothing but the alerts you asked for. There is no newsletter, no marketing, and it is never shared with or sold to anyone.

The legal basis is your consent, and consent can be withdrawn at any time. Every alert email carries a one-click unsubscribe link. Confirmation and unsubscribe links are signed so that nobody can subscribe or unsubscribe an address they do not control.

Services involved

maqua.app is deliberately thin, but a few third parties are involved in delivering it. Each is listed with what it actually sees. Where a service is not configured on this deployment, it processes nothing at all.

Vercel — hosting

Serves every page and API response, and therefore sees your IP address and request headers as any web host would. Also provides the optional analytics described above.

Base map tiles — third-party tile service

The map is drawn from tiles your browser requests directly from a tile provider, using OpenStreetMap data. Those requests reveal your IP address and which part of the map you are looking at to that provider, and they are subject to its own privacy policy rather than this one. Choosing the list view instead of the map avoids them entirely.

Neon — PostgreSQL database (not configured)

Not configured on this deployment. Nothing is written to a database, so no subscription or history exists to store.

Resend — email delivery (not configured)

Not configured on this deployment. No email is sent and no address is transmitted.

Upstash — Redis cache (not configured)

Not configured on this deployment. Caching falls back to the memory of the running server instance and nothing is written to an external store.

OpenRouter — AI explanations (configured)

Routes requests for plain-language explanations to a language model. What is sent is the air-quality figures already shown on the page — station, pollutant, concentration, band and time. Nothing that identifies you is included: no IP address, no email address, no location, no request history. Explanations are cached so that the same reading is not sent repeatedly.

Google AdSense — advertising

Serves the advertising. Your browser requests Google's code directly, so Google sees your IP address, which page you are on, and whatever its own cookies and identifiers already tell it about you — here and on every other site carrying its advertising. It is the only third party on this list that your browser contacts for a purpose other than delivering the page, and the only one that can build a profile spanning other sites. Subject to Google's privacy policy rather than this one.

Environment and Resources Authority and the European Environment Agency

The source of the measurements. Requests to the upstream feed are made by our server, on a schedule, and never by your browser — so your visit is not visible to either organisation.

How long things are kept

Alert subscriptions

Kept while the subscription is active. Removed when you unsubscribe. An unconfirmed subscription expires by itself if the confirmation link is never followed, and the pending record is deleted.

Air-quality readings

Public environmental measurements, not personal data. Retained to show history and trends.

Server and error logs

Short-lived, kept for operational and security purposes only.

Caches

Expire on their own, typically within minutes to an hour.

Your rights, and how to use them

Under the GDPR you can ask for access to your personal data, its correction or erasure, a restriction on its processing, a copy in a portable form, and you can object to processing. You can also complain to Malta's Information and Data Protection Commissioner.

In practice, the only personal data this site can hold is an email address you gave it for alerts, so most requests reduce to one action:

• Stop and delete: there is nothing to stop or delete on this deployment. Alerts are not enabled, no address can be submitted, and none is stored. The link to the alerts page is withheld here for the same reason it is absent from the menus: it describes a feature this deployment cannot provide.
• Anything else: raise an issue on the project's source repository, linked from the About page. Please do not include personal details in a public issue.

If you never subscribed to alerts, this site holds nothing about you to access or erase.

Children

The site is general public information and is safe for anyone to read. Alerts require an email address, and are not intended for children under the age at which they can give valid consent.

Changes to this page

This page describes how the software actually behaves, and the parts of it that describe optional services are generated from the running configuration. If the way data is handled changes, this page changes in the same release.

Air-quality data provided by Malta's Environment and Resources Authority (ERA), disseminated via the European Environment Agency (EEA). maqua.app is an independent project and is not operated by, affiliated with, or endorsed by ERA or the EEA.