Privacy Policy

The short version

Cal Coast Tides is a tide and coastal conditions site. You can use all of it without an account, and we don't sell your data or run advertising trackers. We collect anonymous usage statistics, and personal details only when you send us a message or sign in.

What we collect

• Visits. Vercel Web Analytics and Speed Insights record page views, referrer, country, device and browser type, and page performance. They use no cookies and don't follow you across other sites.
• Contact form. Your name, email address and message, emailed to us through Mailgun.
• Feedback button. Your message, an optional email address, and (unless you untick it) page details: route, station, screen size, whether the site is installed as an app, browser user agent, build and time. Emailed to us through Mailgun. If you give a star rating, the rating, report reference, page route and station are also saved in our database (Neon, US); no email or IP address goes with it.
• Sign-in. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider. We keep no password.
• Spam protection. To limit abuse, we keep a short-lived, irreversible hash of your IP address for rate limiting. The raw address isn't stored.

King tide photos

When you post a photo to the king tide photo wall, we keep:

• The photo, re-encoded. Your browser makes a smaller copy and our server re-encodes it again, removing everything stored in the file: location (GPS), camera details and the original time. The file you picked is never stored. The copies are kept in Vercel Blob.
• What you type. The tide station, the time, the place name, the caption and the name or handle to credit. These are shown with the photo once we approve it, together with the gauge reading at that time.
• Your email, only if you ask for the reminder. If you tick “Email me before the next king tide”, we keep your email address to send it. It is never shown. Without that box ticked we keep no email at all.

Every photo waits for our review before anyone else can see it. By posting you confirm you took it and let us show it on the site and in our social posts, credited. To have a photo taken down, or your email removed, ask through the contact page and tell us where and when it was taken.

Cookies and local storage

• Session cookie. Set only when you sign in, so you stay signed in. It is strictly necessary and is removed when you sign out or it expires.
• reCAPTCHA (Google). The contact form, feedback dialog and king tide photo form load Google reCAPTCHA v3 to filter spam. Google may set cookies and collect device and interaction signals to tell people from bots. See Google’s Privacy Policy and Terms of Service.
• Offline cache. If your browser supports it, a service worker stores pages and recent tide data on your device so the site works offline. It contains no personal information.

We don't use advertising or cross-site tracking cookies. If that changes, we will ask for your consent first and update this page.

Why we use it

To run and improve the site, answer your messages, keep the forms free of spam and keep accounts secure. Where GDPR applies, our legal bases are our legitimate interests (security, understanding aggregate use), performing a request you make (replying to you, signing you in) and, where required, your consent.

Who processes it

We use a small set of service providers: Vercel (hosting, analytics and photo storage), Neon (database), Mailgun (email delivery), Google (reCAPTCHA and Google sign-in), GitHub (GitHub sign-in) and Sentry (error and performance monitoring: when something breaks, a report with the page address, browser type and the error goes to Sentry, without your IP address or account). Tide, weather and buoy data come from NOAA, Open-Meteo and NDBC; your browser requests it directly or through our servers, and none of it includes your personal details. Map tiles are loaded from Esri and terrain tiles from AWS, which receive your IP address like any web request. Providers may process data in the United States.

How long we keep it

Messages and feedback stay in our email until we've dealt with them, and we keep them no longer than needed. Star ratings stay in the database, with nothing that identifies you. Analytics are aggregate and retained according to Vercel's limits. Rate-limit hashes live in server memory for minutes (a day for king tide photos). Approved king tide photos stay on the wall until you ask us to take one down; rejected ones are deleted. A reminder email address is kept for the king tide reminders until you ask us to remove it.

Your rights

Depending on where you live (including under GDPR and the California CCPA/CPRA), you can ask to see, correct, delete or export the personal data we hold about you, object to its use, or withdraw consent. We don't sell or share personal information for cross-context advertising. To make a request, use the contact page; you can also complain to your local data protection authority.

Children

The site is not directed at children under 13, and we don't knowingly collect their data.

Changes

We'll post any changes here and update the date above. The Terms and Disclaimer cover how to use the site's forecasts and data.