We read the water, never the resident

When a resident submits a photo, the console records one thing: a water condition at a location and a time — a depth band, a road segment, an hour. It is a property of the street at a moment, not a record of the household that reported it. The reporter’s name, phone number, home address and account are never fields the street-state schema carries, so they never enter the operating map.

A useful flood photo is of water against a kerb or a wall, not a document about a person. Faces, body, vehicle registration plates, house numbers and doorways that would locate a specific family are masked at ingest, and image metadata (EXIF, precise GPS, device id, exact timestamp) is stripped before anything is kept. A payload that reads as an un-redacted personal scene is refused at the validation boundary, not quietly stored — a sighting that cannot be anonymised simply does not move the map.

What the control room and the resident see is a condition for a road segment, corroborated across many independent reports and against gauge and radar telemetry. No output ties a flood report to a named individual, and no report is ever published as “this family flagged this.” Reports are tagged to a rotating, time-windowed pseudonym, so one resident’s separate submissions cannot be strung into a location history of where they live — by anyone, including the operating council.

A reporter carries a pseudonymous confidence score — a reputation that lets a corroborating witness count for more and a serial fabricator count for less. That reputation is a number, not an identity: the credentials layer (AnVerified rails) makes accountability possible precisely by never requiring a name. A resident is trusted or discounted as an anonymous sensor, never tracked as a person.

The reference implementation and any production instance are Malaysia-hosted and structured to satisfy the Personal Data Protection Act 2024 by construction rather than by clause: resident identities are not collected, personal detail in imagery is redacted at the edge, and — because each council runs its own air-gapped instance with no cross-council join key — there is no national resident profile that could ever be disclosed, subpoenaed or breached. Where the law asks for purpose limitation and minimisation, the architecture answers it before a policy has to.

A resident may choose to bring a flood report they raised in their community app across into their council’s instance. That movement happens only when the person themselves moves it — a deliberate, consented act, not a background sync between systems. Councils are air-gapped from each other and from every other agency by construction; nothing flows that a resident did not consciously send.

During scoping and any first reference catchment, participating councils, responder agencies and early sensor or gauge partners — and any coverage, threshold or incident figures — are named only with their consent. Street-state and hazard data are reported without identifying any authority that has not agreed to be named. Anonymity for the pilot cohort is a rule of the product, not a courtesy.

To ask how any field above is enforced in code, or to raise anything about the data a council instance handles, write to anbanjir@antrex.app or use the Antrex contact desk at antrex.app/contact.