Privacy Policy

Last updated 30 October 2026

Panawen is a free barangay weather site run by one person, who is the personal information controller under the Data Privacy Act of 2012 (RA 10173). This page says what we collect, why, who else handles it, how long we keep it and what rights you have. Questions go to aaronjohn.tamayo29@gmail.com.

What we collect

Google sign-in: your Google name, email address, profile picture link, Google account id and the sign-in tokens Google gives us.
Email sign-up: your name, email address and a password. We store only a scrambled hash of the password, never the password itself. The sign-in codes we email you are also stored hashed and expire after 10 minutes.
Session cookie: one cookie that keeps you signed in. With each session we store your IP address and browser type.
Server logs: each forecast or alert request logs the page path, time and either your account id (signed in) or your IP address (signed out). What you type in the search box is not logged.
Location (optional): "My location" asks your browser for a GPS fix only after you tap it. Your device matches the fix to a barangay. The position is never sent to us or stored.
On your device only (localStorage): your saved barangays, recent picks and the positions of the dashboard panels and whether you dismissed the cookie notice. We never receive these. Clearing your browser data removes them.

We do not use analytics, ads or tracking cookies, and we do not sell your data or share it for marketing.

Why we use it

to create and run your account and sign you in;
to email you sign-in and password reset codes;
to keep you signed in between visits;
to stop abuse, using sign-in limits and logs;
to find and fix errors.

Our basis is providing the service you asked for (Section 12 of RA 10173) and our legitimate interest in keeping Panawen secure.

Who else handles it

Google: handles sign-in if you choose Google. Google Fonts also receives your IP address when a page loads the typeface. Google privacy policy.
Resend: sends our emails, so it receives your email address and the code. Resend privacy policy.
Open-Meteo: supplies the forecasts. Our server asks it for a barangay's coordinates only. No personal data is sent. Open-Meteo terms.
Amazon Web Services: only if you turn on the experimental Terrain switch on the dashboard. Your browser then asks Amazon's public terrain-tile server for elevation tiles, so it receives your IP address and the map area of the town you are viewing. AWS privacy notice.
Coolify host: our server, database and logs run on a server we manage with Coolify.

Google, Resend, Open-Meteo and Amazon may process data outside the Philippines. Each follows its own policy.

How long we keep it

Account data: until you delete your account.
Sessions: 7 days, renewed while you use Panawen, and deleted when you sign out.
Sign-in codes: 10 minutes.
Sign-in limit counters: held in memory, gone within an hour or when the server restarts.
Server logs: until the host rotates them. We do not copy them elsewhere.
Browser storage: until you clear it.

Cookies

Panawen sets one session cookie, which is strictly needed to keep you signed in. When you sign in with Google it also sets a short-lived cookie (5 minutes) that protects the sign-in from forgery. It sets no other cookies, and nothing for analytics, ads or tracking.

Keeping it safe

We use HTTPS, hash passwords and codes, limit sign-in attempts and keep access to the maker. No system is perfect. If a breach puts your data at risk, we will tell you and the National Privacy Commission, as RA 10173 requires.

Your rights under the Data Privacy Act

to be informed about how your data is used;
to access the data we hold about you;
to object to its use;
to correct it;
to have it erased or blocked;
to data portability, meaning a copy in a common format;
to claim damages if you are harmed by misuse of your data;
to file a complaint.

To use any of these, email aaronjohn.tamayo29@gmail.com and we will answer within 30 days. You can also complain to the National Privacy Commission.

Deleting your account

Email aaronjohn.tamayo29@gmail.com from the address on your account. Within 30 days we delete your account, your sessions and the linked Google record, and confirm by email. Logs age out on their own. To remove what is stored on your device, clear this site's data in your browser.

Changes to this policy

We may update this policy. We change the date at the top, and for important changes we will show a notice on the site.

Contact

Questions or requests about your data: aaronjohn.tamayo29@gmail.com. See also the Terms of Service.

Back to Panawen or check your barangay.