1. Who is responsible
The responsible party is Michael Ross Tarr, an individual trading as Beaches Africa. Our Information Officer is Michael Ross Tarr, who you can reach at welcome@beaches.africa.
2. What we collect
- Account details: anyone can create an account. We store your email address and a hashed password (with Supabase Auth), and the display name you choose, if any. For beach managers and admins we also store the beaches and role they have access to.
- Votes: the thumbs up or down you give a beach, with your account and the time. Only votes from the last 24 hours are counted, and only the totals are shown to anyone else.
- Issue reports: the beach, the kind of issue and any note you write. The people who manage that beach see the report with your display name; our global admins can also see your email.
- Moderation records: if an account is blocked for abusing votes or reports, we record when, by whom and why.
- Beach suggestions: the beach details you send, and, only if you choose to give them, your name and email so a reviewer can contact you.
- Your location: only when you tap "show my location". It is used in your browser to centre the map and sort beaches by distance. We don't send it to our servers or store it.
- Analytics, only if you accept cookies: through PostHog, the pages you view, what you tap or click (for example which beach you open, or getting directions), your device, browser and approximate location worked out from your IP address, and recordings of how you use the page. Text you type into forms is masked in recordings. If you're signed in, this is linked to your account ID, email and display name.
- Account activity and errors: when you vote, report an issue, or (for managers) review or update a beach, our server records that action in PostHog with your account ID, but not your email. If something breaks, the error and what led to it are sent to PostHog so we can fix it. This happens on our server, uses no cookies, and doesn't depend on your cookie choice.
- Visit statistics: Cloudflare Web Analytics counts page views and measures how fast pages load. It doesn't use cookies or local storage, doesn't identify you, and doesn't follow you across other sites.
- Technical data: like any website, our host Cloudflare processes your IP address, browser details and the pages you request, and keeps short-lived logs to run and secure the site.
- Cookies and local storage: see below.
4. Why we use it (purposes and lawful basis)
- To run your account and the features you use (votes, issue reports, your display name, and managing beaches): to perform our agreement with you.
- To review beach suggestions and contact you about them: your consent, which you give by adding your details, and which you can withdraw at any time.
- To understand how the site is used and improve it with PostHog analytics in your browser: your consent, which you give by accepting cookies and can withdraw with "Cookie settings".
- To keep the site secure and reliable, count visits, fix errors, understand which features are used, and stop abuse such as fake votes or spam reports (including blocking accounts): our legitimate interest in running a safe, reliable service.
- To meet legal obligations, if any apply.
We don't sell your personal information or use it for direct marketing.
5. Who processes it for us
- Supabase: database, authentication and beach photo storage.
- Cloudflare: hosting, content delivery, security, caching (Workers KV) and Web Analytics.
- PostHog: product analytics, session recordings, error tracking and server logs, hosted in PostHog's EU cloud.
- Mapbox: map tiles, loaded directly by your browser, and place names for beach coordinates.
- Open-Meteo: weather and ocean forecasts. We send only beach coordinates, never anything about you.
- YouTube: some beaches have YouTube livestreams. Nothing is loaded from YouTube until you press play; after that, YouTube's own terms and privacy policy apply to the video.
- Fonts: served from our own domain, so Google Fonts isn't contacted when you visit.
Some of these providers store or process information outside South Africa. Under section 72 of POPIA we only use providers that are bound by laws, binding corporate rules or agreements that give an adequate level of protection.
6. How long we keep it
- Account details: while your account is active, and deleted within a reasonable time after it closes.
- Votes: your latest vote on each beach, until you change or clear it or your account is deleted. It only counts towards a beach's total for 24 hours.
- Issue reports: while they're useful for looking after the beach. If your account is deleted, the report stays but is no longer linked to you.
- Moderation records: while the account exists.
- Suggestion contact details: until the suggestion is reviewed and any follow-up is done.
- PostHog analytics and error data: up to 12 months; session recordings: up to 30 days. Withdrawing consent stops new analytics; email us to delete what's already been collected.
- Cloudflare Web Analytics: aggregated statistics only, with nothing that identifies you.
- Server logs: for the short period our host keeps them.
7. Security
We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), hashed passwords, and access controls that limit who can see what. No system is perfectly secure. If a breach affects you, we'll tell you and the Information Regulator as POPIA requires.
8. Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete it;
- object to us processing it, or withdraw consent you gave; and
- complain to the Information Regulator at inforegulator.org.za.
To use these rights, email welcome@beaches.africa. We may need to confirm who you are first.
9. Children
The site is for general audiences and we don't knowingly collect personal information from children under 18. Accounts are for adults only. If you think a child has sent us their details, email us and we'll delete them.
10. Changes and contact
We may update this policy; the "last updated" date above shows when. Questions? Email welcome@beaches.africa. See also our Terms of Service.