Terms of use

The creator of this site, nor its contributors, take any responsibility of quality or accuracy of the data provided, including but not limited to optimal water levels, geographic coordinates, and descriptions. Use at your own risk. Always scout rivers. Make your own judgements, and do not rely solely on recommendations from this site or others. This site is non-profit.

Commercial use of the site, its data, or derivative works requires written permission from the operator. See the licensing note below for the default terms that apply to user-visible content.

User content & community rules

Signed-in paddlers can post public condition reports and keep a private trip logbook. This site is run by a single volunteer in their spare time: moderation, support, and everything else are best-effort with no response-time promise. Automated safeguards do the day-to-day work so nothing depends on someone being at a keyboard.

Reports are observations, not advice. A condition report is one paddler's statement, never a gauge reading. Verify against the gauge and scout.
Reporting content: every public post carries a report link. Content flagged by several distinct accounts is hidden automatically pending review; the author is notified on the site and can appeal through the contact form. The operator can also remove content that breaks these rules at any time.
No abuse: no harassment, hate speech, spam, or deliberately false condition reports. Deliberately misleading safety-relevant information is treated as the most serious violation.
No impersonation: do not pose as another person, club, or organisation — in your handle, display name, or content. Impersonation accounts are removed.
Handles are first come, first served. They are not trademarks reserved for anyone; a handle can change at most once per 90 days and is never recycled to another account.
Age: you must be at least 16 years old to create an account. We do not collect your age or date of birth, so we rely on this statement — accounts that state they belong to someone younger are removed.

Elevation profiles

Elevation profiles on this site show the monotonic descent envelope of Kartverket's DTM 1 observations sampled along each river's routed track. They are suitable for understanding reach-scale gradient and overall river slope, but are not precise elevation readings at any specific point.

DTM 1's 1-meter horizontal resolution is sometimes insufficient to keep all samples on water in narrow features such as canyons or slot channels. We apply a guaranteed-monotonic post-processing step so the strip is always honest about descent direction.

For specific drops, ledges, weirs, or recent geomorphic changes, consult section descriptions and recent local knowledge. The elevation profile cannot detect these features.

Source: Kartverket Høydedata (DTM 1), licensed under CC BY 4.0.

Privacy

The site operator is based in Norway. Where applicable, we follow the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR). The plain-language description below is what we actually do; please read it before assuming anything stricter.

What we collect

Anonymous visitors: nothing on our servers. Your browser may store small preference cookies (see the cookie inventory below); those values never leave your device unless you submit them with a form.
Account holders: email address, a salted argon2id hash of your chosen password (never the plaintext), and the alerts you subscribe to. We do not collect names, phone numbers, or addresses.
Public handle (optional): the byline on condition reports you choose to sign. Reports older than 48 hours display without the handle ("a paddler").
Condition reports: public — status, optional estimate, optional note, and (if you chose it) your handle. A public report shows you were at that section around that time.
Trip logbook: private to you — trips, notes, companions you type, the private gauge snapshot, and your custom sections. Nothing from the logbook is shown to anyone else, and gauge snapshots are never aggregated.
GPX tracks (optional): if you upload a track it is cropped to the river section at upload — only the on-section segment is ever stored. Approach and drive-out geometry, and the raw file, are discarded immediately and never persisted. Stored tracks are visible only to you and downloadable per trip as GPX.
Contact form messages: the message text, and the email address you optionally provide for a reply. Messages are emailed to the operator and not retained in a searchable database beyond the operator's mailbox.
Server logs: nginx records request lines (method, path, status, bytes) plus IP address for short-term operational diagnostics. These logs are not joined with account data, never shared, and rotate within days.

What we do not collect

No analytics. No Google Analytics, no Plausible, no Matomo, no third-party tag managers.
No advertising trackers. No social-media pixels.
No cross-site identifiers. No fingerprinting.

Where data is stored

Account data lives in a PostgreSQL database hosted on operator-controlled infrastructure in the EU/EEA. Backups are encrypted and retained on the same footprint. We do not transfer personal data outside the EU/EEA.

How long we keep it

Account email + password hash: until you delete the account.
Alerts subscriptions: until you remove them, or until the account is deleted.
Sessions: 30 days rolling from last use; cleared on sign-out.
Trips, tracks, custom sections, and condition reports: until you delete them — or until you delete the account, which removes all of them at once (see below).
Contact-form messages: in the operator's mailbox, retained per ordinary email retention practice (months, not years).
Server access logs: a few days, then rotated out.
Backups: encrypted, kept for a bounded window (weeks, not months). Deleted data drops out of the backups as that window rolls over; backups are only ever restored wholesale after data loss, never to resurrect individual deleted content.

Your rights

Under GDPR you may request access to, rectification of, or erasure of your personal data; portability of data you have provided; and you may object to processing. To exercise any of these rights, use the contact form. Account holders can change their email and password from /account/profile, manage alerts from /account/alerts, and delete the account from the danger zone on /account/security.

Both data rights are self-service, no ticket needed: export downloads everything your account stores — profile, trips, tracks, custom sections, reports, favorites, alert rules — as one JSON file from /account/security (each trip's track is also downloadable as GPX from the logbook), and deletion from the same page permanently removes the account and everything it owns: trips, tracks, custom sections, condition reports (including hidden ones), favorites, and sessions, in one irreversible step.

You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are not handling your data correctly.

Cookies

We do not use cookies for analytics or tracking. The cookies below are either strictly necessary for the site to work (sign-in, CSRF protection) or store small preferences you set yourself (favorites, filters). All cookies are first-party. We do not set third-party cookies.

Name	Purpose	Type	Retention
`nks`	Signs you in. Holds the random session token; HTTP-only.	Essential	30 days, rolling
`nkc`	CSRF protection. A token paired with the session cookie to block cross-site form submissions.	Essential	Session
`favorites`	Your favorite sections, when you are signed out. JSON array of section ids; readable by the browser only. Once you sign in, your favorites move to your account and the cookie is cleared.	Functional	180 days from last write
`WhatsUpListCookie`	Remembers your filter selections on /WhatsUpList so a return visit lands on the same view.	Functional	90 days
`WhatsUpMapCookie`	Remembers your filter selections on /WhatsUpMap.	Functional	90 days
`home_view`	Remembers whether you prefer the cards or compact view on the home page.	Functional	90 days
`location_denied`	Marks that you declined the location prompt this browser session, so we don't keep asking.	Functional	Session
`nokken_prompt_location_dismissed`	Marks that you dismissed the location prompt without answering it, so we suppress the prompt for a while.	Functional	60 days
`nokken_prompt_favorites_dismissed`	Marks that you dismissed the sign-up prompt on the home page, so we don't keep showing it.	Functional	1 year
`nk_cookie_ack`	Records that you have seen the cookie banner so we don't show it again.	Functional	1 year
`nk_color_scheme`	Stores your color-scheme preference (light / dark / auto). When unset, the site follows your OS preference.	Functional	1 year

The /contact and /alerts forms render a Cloudflare Turnstile challenge widget; the no-cookie variant is used, so the widget itself does not set a cookie on your browser. If the site is fronted by Cloudflare's edge, Cloudflare may set its own bot management cookie (__cf_bm, max 30 minutes) to score automated traffic. That cookie is set by the network edge, not by this application, and Cloudflare states it does not allow them to track you across other sites.

Local storage

If you opt in to "near me" features, the location you grant or enter is kept in your browser's local storage (nokken_location, valid for 90 days). Unlike a cookie, local storage is never transmitted with requests: your coordinates stay in your browser and are never sent to or stored by nokken. Distance calculations happen entirely on your device. You can remove the stored location at any time with the "× Clear" control next to any location feature, or by clearing your browser's site data.

Contact

For data requests, takedown requests, or any other privacy question, use the contact form and mention "data request" in your message.

Licensing

All content of this website is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License unless otherwise stated. Attribution requirements may not be limited to this website, but apply to this website's sources as well.

By submitting content (section descriptions, river notes, corrections, photos) through this site, you grant the operator a non-exclusive, royalty-free licence to publish and adapt that content under the same CC BY-NC-SA 4.0 terms.