Terms of use

The creator of this site, nor its contributors, take any responsibility of quality or accuracy of the data provided, including but not limited to optimal water levels, geographic coordinates, and descriptions. Use at your own risk. Always scout rivers. Make your own judgements, and do not rely solely on recommendations from this site or others. This site is non-profit.

Commercial use of the site, its data, or derivative works requires written permission from the operator. See the licensing note below for the default terms that apply to user-visible content.

Elevation profiles

Elevation profiles on this site show the monotonic descent envelope of Kartverket's DTM 1 observations sampled along each river's routed track. They are suitable for understanding reach-scale gradient and overall river slope, but are not precise elevation readings at any specific point.

DTM 1's 1-meter horizontal resolution is sometimes insufficient to keep all samples on water in narrow features such as canyons or slot channels. We apply a guaranteed-monotonic post-processing step so the strip is always honest about descent direction.

For specific drops, ledges, weirs, or recent geomorphic changes, consult section descriptions and recent local knowledge. The elevation profile cannot detect these features.

Source: Kartverket Høydedata (DTM 1), licensed under CC BY 4.0.

Privacy

The site operator is based in Norway. Where applicable, we follow the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR). The plain-language description below is what we actually do; please read it before assuming anything stricter.

What we collect

Anonymous visitors: nothing on our servers. Your browser may store small preference cookies (see the cookie inventory below); those values never leave your device unless you submit them with a form.
Account holders: email address, a salted argon2id hash of your chosen password (never the plaintext), and the alerts you subscribe to. We do not collect names, phone numbers, or addresses.
Contact form messages: the message text, and the email address you optionally provide for a reply. Messages are emailed to the operator and not retained in a searchable database beyond the operator's mailbox.
Server logs: nginx records request lines (method, path, status, bytes) plus IP address for short-term operational diagnostics. These logs are not joined with account data, never shared, and rotate within days.

What we do not collect

No analytics. No Google Analytics, no Plausible, no Matomo, no third-party tag managers.
No advertising trackers. No social-media pixels.
No cross-site identifiers. No fingerprinting.

Where data is stored

Account data lives in a PostgreSQL database hosted on operator-controlled infrastructure in the EU/EEA. Backups are encrypted and retained on the same footprint. We do not transfer personal data outside the EU/EEA.

How long we keep it

Account email + password hash: until you delete the account.
Alerts subscriptions: until you remove them, or until the account is deleted.
Sessions: 30 days rolling from last use; cleared on sign-out.
Contact-form messages: in the operator's mailbox, retained per ordinary email retention practice (months, not years).
Server access logs: a few days, then rotated out.

Your rights

Under GDPR you may request access to, rectification of, or erasure of your personal data; portability of data you have provided; and you may object to processing. To exercise any of these rights, use the contact form. Account holders can change their email and password from /account/profile, manage alerts from /account/alerts, and delete the account from the danger zone on /account/security.

You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are not handling your data correctly.

Cookies

We do not use cookies for analytics or tracking. The cookies below are either strictly necessary for the site to work (sign-in, CSRF protection) or store small preferences you set yourself (favorites, filters, location). All cookies are first-party. We do not set third-party cookies.

Name	Purpose	Type	Retention
`nks`	Signs you in. Holds the random session token; HTTP-only.	Essential	30 days, rolling
`nkc`	CSRF protection. A token paired with the session cookie to block cross-site form submissions.	Essential	Session
`favorites`	Your favorite sections, when you are signed out. JSON array of section ids; readable by the browser only. Once you sign in, your favorites move to your account and the cookie is cleared.	Functional	180 days from last write
`WhatsUpListCookie`	Remembers your filter selections on /WhatsUpList so a return visit lands on the same view.	Functional	90 days
`WhatsUpMapCookie`	Remembers your filter selections on /WhatsUpMap.	Functional	90 days
`home_view`	Remembers whether you prefer the cards or compact view on the home page.	Functional	90 days
`location`	Stores a coarse location you have explicitly granted or entered, so "near me" works without re-prompting on every page. Set only after you opt in.	Functional	90 days
`location_denied`	Marks that you declined the location prompt this browser session, so we don't keep asking.	Functional	Session
`nokken_prompt_location_dismissed`	Marks that you dismissed the location prompt without answering it, so we suppress the prompt for a while.	Functional	60 days
`nokken_prompt_favorites_dismissed`	Marks that you dismissed the sign-up prompt on the home page, so we don't keep showing it.	Functional	1 year
`nk_cookie_ack`	Records that you have seen the cookie banner so we don't show it again.	Functional	1 year
`nk_color_scheme`	Stores your color-scheme preference (light / dark / auto). When unset, the site follows your OS preference.	Functional	1 year

The /contact and /alerts forms render a Cloudflare Turnstile challenge widget; the no-cookie variant is used, so the widget itself does not set a cookie on your browser. If the site is fronted by Cloudflare's edge, Cloudflare may set its own bot management cookie (__cf_bm, max 30 minutes) to score automated traffic. That cookie is set by the network edge, not by this application, and Cloudflare states it does not allow them to track you across other sites.

Contact

For data requests, takedown requests, or any other privacy question, use the contact form and mention "data request" in your message.

Licensing

All content of this website is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License unless otherwise stated. Attribution requirements may not be limited to this website, but apply to this website's sources as well.

By submitting content (section descriptions, river notes, corrections, photos) through this site, you grant the operator a non-exclusive, royalty-free licence to publish and adapt that content under the same CC BY-NC-SA 4.0 terms.