Privacy Policy

Last updated: September 22, 2026

In short

You can use the whole site without giving us any personal data.
We collect an email address only if you subscribe to the weekly digest or write to us.
We measure traffic with Google Analytics and Vercel Analytics. In the EEA, UK and Switzerland, Google Analytics runs only if you accept it.
We do not sell or share personal data for advertising, run no advertising, and set no advertising cookies.
You can ask us to see, correct or delete your data at any time via the contact form or hello@coloradorivermonitor.com.

1. Who is responsible

Colorado River Monitor (coloradorivermonitor.com) is an independent informational website operated by its publisher, who is the data controller for the purposes of the EU and UK General Data Protection Regulations and the "business" for the purposes of the California Consumer Privacy Act as amended by the CPRA. Contact: hello@coloradorivermonitor.com or the contact form. We are not affiliated with the U.S. Bureau of Reclamation or any government agency.

2. What we collect, why, and on what basis

Data	When	Purpose	Legal basis (GDPR)	Kept
Email address, the page you signed up from, signup IP address and time	You subscribe to the weekly digest	Sending the digest; proving you asked for it	Consent (Art. 6(1)(a)), given by double opt-in	Until you unsubscribe or ask us to delete it
Name, email address, message	You use the contact form	Answering you	Legitimate interest (Art. 6(1)(f)) in replying to correspondence	Up to 12 months after the last message
Usage data: pages viewed, referrer, approximate location (city), device and browser type, a random visitor identifier	You browse the site	Understanding what is read and keeping the site working	Consent (Art. 6(1)(a)) where required, otherwise legitimate interest in measuring the site	Google Analytics: 14 months; Vercel Analytics: aggregated, no individual retention
Server logs: IP address, user agent, URL, time	Every request	Security, abuse prevention, debugging; rate limiting the signup form	Legitimate interest (Art. 6(1)(f)) in securing the service	Up to 30 days

We collect nothing else. The site has no accounts, no comments, and no payment. Reservoir data is fetched from the Bureau of Reclamation by our server; no visitor data is sent to Reclamation.

3. Cookies, consent, and how to change your mind

Google Analytics sets first-party cookies (_ga and _ga_ followed by an id, lasting up to two years) to tell one visit from another. It runs with Google Consent Mode: advertising features are always off, and in the European Economic Area, the United Kingdom and Switzerland analytics storage stays off until you accept it in the banner. Declining has no effect on the site. Your choice is stored in your browser (a local-storage entry named crm-analytics-consent); clear it or your site data to be asked again. Elsewhere, analytics runs by default and you can block it with your browser settings or Google's opt-out add-on.

Vercel Analytics uses no cookies and no persistent identifier; it hashes the request to count visits. Our hosting provider may set functional cookies needed to serve the site. We set no advertising or cross-site tracking cookies.

Global Privacy Control: we do not sell or share personal data, so a GPC signal requires no action from us, and we treat it as a request not to be tracked in any case.

4. Who processes data for us

Vercel Inc. (USA): hosting, server logs, Vercel Analytics. Privacy policy.
Google LLC (USA): Google Analytics 4, with IP addresses not logged or stored and Google signals off. How Google uses data from partner sites.
Intuit Mailchimp (USA): stores digest subscribers and sends the digest; records opens and link clicks in those emails. Privacy statement.
Resend Inc. (USA): delivers contact-form messages and our automated data-quality alerts to us. Privacy policy.

Each acts on our instructions under a data-processing agreement. We share personal data with no one else, and never sell it or share it for cross-context behavioural advertising. We would disclose data only if required by law.

5. International transfers

The site is hosted in the United States and the processors above are U.S. companies. If you are in the EEA, UK or Switzerland, your data is transferred to the United States under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the processor is certified, and otherwise under the European Commission's Standard Contractual Clauses included in their terms.

6. Your rights

Wherever you are, you can:

ask what personal data we hold about you and receive a copy (access, portability);
ask us to correct or delete it;
withdraw consent at any time (unsubscribe link in every digest, or the analytics banner choice), without affecting earlier processing;
object to, or ask us to restrict, processing based on legitimate interest;
not be discriminated against for exercising any of these rights.

To exercise a right, write to hello@coloradorivermonitor.com or use the contact form. We will confirm your identity by replying to the email address concerned and answer within 30 days (45 days for California requests, extendable once with notice). An authorised agent may act for you with your written permission.

EEA, UK and Switzerland: you may also complain to your national data protection authority (in the UK, the ICO). We have no obligation to appoint an EU representative given the scale and nature of our processing.

California (CCPA/CPRA): in the last 12 months we collected the categories listed in section 2 (identifiers, internet activity, and approximate geolocation) for the purposes stated there, disclosed them only to the service providers in section 4, and did not sell or share personal information or use sensitive personal information. You have the rights to know, delete, correct, and to opt out of sale or sharing (none occurs). Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have comparable rights and may use the same contact.

7. Security

The site is served over HTTPS with strict transport security and a content security policy. Subscriber data lives in Mailchimp and is reachable only with credentials held by the publisher. Contact-form messages are delivered by email and are not stored on our servers.

8. Children

The site is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has subscribed, tell us and we will delete the address.

9. Advertising (none at present)

The site shows no advertising and sets no advertising cookies. If we introduce contextual advertising in future, this policy will be updated first, the cookies involved will be listed here, and consent will be requested where the law requires it before any advertising cookie is set.

10. Changes to this policy

Changes are posted here with a new "last updated" date. If a change materially affects how we use data you have already given us, digest subscribers will be told in the next digest before it takes effect.

11. Contact

hello@coloradorivermonitor.com, or the contact form.