Privacy Policy

The short version

Cal Coast Tides is a tide and coastal conditions site. You can use all of it without an account, and we don't sell your data or run advertising trackers. We collect anonymous usage statistics, and personal details only when you send us a message or sign in.

What we collect

• Visits. Vercel Web Analytics and Speed Insights record page views, referrer, country, device and browser type, and page performance. They use no cookies and don't follow you across other sites.
• Contact form. Your name, email address and message, emailed to us through Mailgun.
• Feedback button. Your message, an optional email address, and (unless you untick it) page details: route, station, screen size, whether the site is installed as an app, browser user agent, build and time. Emailed to us through Mailgun.
• Sign-in. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider. We keep no password.
• Spam protection. To limit abuse, we keep a short-lived, irreversible hash of your IP address for rate limiting. The raw address isn't stored.

Cookies and local storage

• Session cookie. Set only when you sign in, so you stay signed in. It is strictly necessary and is removed when you sign out or it expires.
• reCAPTCHA (Google). The contact form and feedback dialog load Google reCAPTCHA v3 to filter spam. Google may set cookies and collect device and interaction signals to tell people from bots. See Google’s Privacy Policy and Terms of Service.
• Offline cache. If your browser supports it, a service worker stores pages and recent tide data on your device so the site works offline. It contains no personal information.

We don't use advertising or cross-site tracking cookies. If that changes, we will ask for your consent first and update this page.

Why we use it

To run and improve the site, answer your messages, keep the forms free of spam and keep accounts secure. Where GDPR applies, our legal bases are our legitimate interests (security, understanding aggregate use), performing a request you make (replying to you, signing you in) and, where required, your consent.

Who processes it

We use a small set of service providers: Vercel (hosting and analytics), Mailgun (email delivery), Google (reCAPTCHA and Google sign-in) and GitHub (GitHub sign-in). Tide, weather and buoy data come from NOAA, Open-Meteo and NDBC; your browser requests it directly or through our servers, and none of it includes your personal details. Map tiles are loaded from Esri and terrain tiles from AWS, which receive your IP address like any web request. Providers may process data in the United States.

How long we keep it

Messages and feedback stay in our email until we've dealt with them, and we keep them no longer than needed. Analytics are aggregate and retained according to Vercel's limits. Rate-limit hashes live in server memory for minutes.

Your rights

Depending on where you live (including under GDPR and the California CCPA/CPRA), you can ask to see, correct, delete or export the personal data we hold about you, object to its use, or withdraw consent. We don't sell or share personal information for cross-context advertising. To make a request, use the contact page; you can also complain to your local data protection authority.

Children

The site is not directed at children under 13, and we don't knowingly collect their data.

Changes

We'll post any changes here and update the date above.