Privacy

Last updated 27 September 2026.

Where's Dry? is run by Recurrent Ltd. Questions or requests: [email protected].

It's a small pilot for a group of riders. It checks the rain forecast at the places you ride and tells you where, and when, it's driest. This page says what it keeps, what it sends to other services to work, what it stores on your device, and how to delete it.

What we keep

Your account: you can start with just a postcode. Then your account is a random ID held by a cookie in this browser, with your rough home base and your spots. If you clear that cookie, we can't get you back in. If you sign up with an email and password, we keep them too, the password only as a salted hash (PBKDF2), never as the password itself.
Your home base, kept rough: the postcode district (for example FK8) and a point rounded to about 1 km. It is used for drive times only and never shown to anyone.
Your settings: how far you'll drive, and which emails you've ticked.
Your spots: each one's name, its pin (or, for a spot found in your rides, where those rides usually start) and the 2 km squares of forecast around it. Places only, never routes or rides. If you take a spot out with "Don't include" we keep it so Undo can put it back and so it isn't offered again.
Sign-in: a cookie (see Cookies) that keeps you signed in on this browser, for up to 400 days and renewed as you use the site. We store only a hash of it, so our copy can't sign anyone in. Failed sign-ins are counted by email address and network address to slow down guessing, and those counts are deleted after a day.
Emailed codes: a password-reset code lasts 15 minutes and a confirm link 7 days. We store only a hash of each.

Your browser also keeps your search settings, your drive times and the last forecast, so the app opens quickly and works offline. That stays on your device (see Cookies).

Spots you share

Spots you add, by pin or from Strava, are shared with other riders unless you untick "Share with other riders?" on the spot. Other riders see its name and the centre of the 2 km forecast square it sits in, never your pin, never where your rides start, and never who shared it. Untick the box and the spot stops showing to other riders, but anyone who already added it keeps their own copy. A Strava spot is only shown once it has a real name.

Strava

If you connect Strava, we ask to read your activities (not your private ones). We read your list of rides from the last 3 years, work out the places you ride, and keep only those places. We keep nothing from Strava itself: no keys, no Strava id, no rides. We look again only when you tap "Look for new spots". Removing Where's Dry? in your Strava settings stops that; the spots already found stay until you remove them or delete your account.

Other services we use

Cloudflare hosts the site and its database (in Western Europe).
Open-Meteo gives the forecast. Your browser sends it the positions of the forecast squares around your spots.
OSRM, a public route planner, gives the drive times. Your browser sends it your home base point and your spots' parking points.
postcodes.io looks up a postcode you type. If you tap "Use my location", your browser sends it your location to find your postcode district.
OpenStreetMap draws the map when you add or look at a spot. Its place search (Nominatim) gets the town or postcode you search for, and, to name spots found in your rides, the area of each spot and where its rides usually start.
Cloudflare Turnstile checks that a sign-up or sign-in comes from a person and not a bot. It runs unseen when you start, sign in or save an account. Cloudflare sees your browser's details and network address for that check. We send nothing else.
Have I Been Pwned checks a new password against known breaches. Only the first 5 characters of a hash of it are sent, never the password.
Resend sends our emails: a reset code when you ask for one, and a confirm link when you tick an email. It gets your email address and that message. Nothing else is sent yet.

Like any website, each of these sees your device's network address when your browser or our server contacts it.

Google Analytics (only if you say yes)

We ask once the first forecast is on screen: "Can we count visits?". If you say yes, Google Analytics sets cookies and we send which screens you open and a few counts: that a forecast was shown, roughly how many spots were in reach (as a range, such as 2-5), the ride length and period you picked, whether you narrowed your free hours, whether the best spot was dry, and that you signed up, signed in, added a spot or connected Strava. Never your email, postcode, home base, spot names, places or drive times. Nothing is used for ads.

Google keeps this for 14 months. If you say no, Google's script is never loaded and nothing is sent. To change your mind, tap Cookie settings at the bottom of the forecast page; saying no there deletes the cookies. We ask again after 12 months.

Cookies

What Where's Dry? stores in your browser, and why.

Strictly necessary, always on

__Host-wd (cookie): keeps you signed in. HttpOnly and Secure, so scripts can't read it and it only travels over HTTPS, to wheresdry.com only. It lasts up to 400 days and is renewed as you use the site; signing out or deleting your account removes it.
analytics-consent and analytics-consent-at (device storage, not cookies): your answer to "Can we count visits?" and when you gave it, so we don't ask every visit. Kept for 12 months, then we ask again.

Device storage the app needs to work (not cookies; nothing here is sent to us or anyone else)

wd.prefs: your search settings (the period, ride length and free hours) and the screen you were on.
wd.drive and wd.fetchedAt: your drive times and when the forecast was last fetched, so the page opens quickly.
wd.home: only without an account, the start point you typed (with an account it's kept on our side instead, as above).
The app's offline copies (the service worker's caches wd-shell and wd-data): the app's own files and the last forecast, drive times and postcode answers, so it works offline.
wd-internal: set only on the owner's own devices, so his visits aren't counted.

Optional: Google Analytics, only after you say yes

_ga and _ga_S8W08PDHK6 (cookies set by Google): tell one visit from another and group a visit's screens together. Google sets them to last up to 2 years.

What is sent and what never is: see "Google Analytics" above. Google keeps it for 14 months. To change your mind, tap Cookie settings at the bottom of the forecast page, which reopens the choice; saying no deletes the _ga cookies and stops the counting.

Deleting it

Settings, then Delete my account, removes your account, your spots and your sign-ins straight away. Or email [email protected] and we'll do it for you.

Your rights

Under UK data protection law you can ask to see, correct or delete what we hold about you. If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office (ico.org.uk).

Back to Where's Dry?