Privacy Policy

Sargasso Tracker ("the app", "the website", "we") is a community map of sargassum conditions on the beaches of the Riviera Maya, Mexico, available as a mobile app and at sargassotracker.com. This policy explains what information the app and the website handle, why, and what you can do about it. It is written in plain language; if anything is unclear, write to hello@sargassotracker.com.

1. What we collect and why

If you only browse (Map, Beaches, Reports) you do not need an account and we do not ask for any personal information. The app requests map tiles, beach data and reports from our servers; those requests carry your IP address and your chosen language like any web request.

If you create an account we store:

• your email address — to sign you in (by password or by a one-time code sent to that address), verify your account and let you recover it;
• your username — shown publicly next to your reports;
• your password, if you set one — stored only as a secure hash;
• the name of your device (for example "Pixel 8 (Android 15)") next to each sign-in — so you can recognise and sign out your sessions;
• your language preference.

If you post a report we store the report itself: the beach or the coordinates you chose, the condition (Good / Okay / Bad), your note, and the photo if you attached one. Reports are public: they appear on the map, in the app, on the website and may be shared by others, together with your username and the time of posting.

Location. The app asks for your location only when you tap "Show my location" on the map or "Use my location" while writing a report, and only while the app is open (never in the background). The map position stays on your device. If you post a report with "Use my location", those coordinates become part of the public report; choosing a beach from the list instead sends no coordinates.

Photos. Only the photo you choose is uploaded. Before upload the app resizes it and removes its metadata (including any embedded location).

We do not collect contacts, calendars, health data, payment details, your browsing history, or background location, and neither the app nor the website contains an analytics or crash-reporting service of our own.

2. Advertising in the app

The app shows a banner ad from Google AdMob (Google Mobile Ads SDK). Google may collect your device's advertising ID, an approximate location derived from your IP address, information about the ads shown and your interactions with them, and technical diagnostics, and uses them to serve and measure ads and to prevent fraud. We do not pass your precise location, your email or your username to Google.

Where the law requires it (for example in the European Economic Area, the United Kingdom and some US states) the app shows a consent form before any ad is requested, and you can change your choice at any time in Profile → About → Ad privacy options. On iOS the app asks for tracking permission; if you decline, ads are non-personalised. You can also reset or limit your advertising ID in your device settings. Google's handling of this data is described in Google's privacy policy and in "How Google uses information from sites or apps that use our services".

3. The website (sargassotracker.com)

The website is a read-only set of pages rebuilt from our data once a day. It has no sign-in, no forms and no comments, and it does not ask you for any personal information. Visiting it involves the following:

• Hosting. Pages are served by Netlify. Like any web host, Netlify receives your IP address, browser user agent and the address of the page you request, and keeps them in short-lived logs for security and troubleshooting.
• Advertising and cookies. The website shows ads from Google AdSense. Google and its advertising partners may use cookies and similar technologies to show ads based on your visits to this and other websites, to limit how often you see an ad, to measure ads and to prevent fraud. Where the law requires it, a consent message is shown before personalised ads are used. You can turn off personalised advertising in Google's My Ad Center or opt out of third-party vendors' use of cookies at aboutads.info (or youronlinechoices.eu in Europe), and you can block or delete cookies in your browser settings. See how Google uses cookies in advertising.
• Our own cookies. The website itself sets no cookies and stores nothing in your browser (no local storage), and it runs no analytics. The only cookies you may receive while visiting are the advertising cookies described above.
• Map tiles. The map on the website loads its tiles from OpenStreetMap (tile.openstreetmap.org); those requests include your IP address and the map area you are looking at, and are covered by the OpenStreetMap Foundation's privacy policy.
• Photos. Report and beach photos are loaded from our media storage on Amazon Web Services (Amazon S3), which receives your IP address like any image request.
• Fonts. Fonts are served from our own domain; your browser does not contact Google Fonts.
• Links to other sites. "Get Directions" opens Google Maps, the download buttons open the App Store or Google Play, and some pages link to other websites. Nothing is sent to those sites until you click, and after that their own privacy policies apply.

4. Other services the app talks to

• Map tiles are loaded from OpenFreeMap (tiles.openfreemap.org); those requests include your IP address and the map area you are looking at.
• App updates: the app checks for updates through Expo's update service (u.expo.dev), sending the app version, platform and an anonymous update identifier. No account information is involved.
• Our own API (api.sargassotracker.com) handles everything described in section 1 over HTTPS. Report photos are stored on Amazon Web Services (Amazon S3).

5. How long we keep it

Your account data is kept until you delete your account. Reports stay published until you delete them (you can delete your own reports in the app) or we remove them for moderation reasons. Sign-in sessions expire when you sign out or sign out everywhere. Server and hosting logs are kept for a short period for security and troubleshooting.

6. Your choices and rights

• Delete your account in the app: Profile → Delete account. This removes your email, username, password and sessions immediately. Reports you posted remain published, attributed to "Deleted user", so the beach history stays useful; delete a report first if you want it gone too.
• Edit your username, email address and password in Profile.
• Ads: see section 2 for the app's consent and advertising-ID controls, and section 3 for the website's cookie and personalised-ads controls.
• Ask us: for anything the app cannot do (for example removing a report after deleting your account, or a copy of your data) write to hello@sargassotracker.com. Depending on where you live you may have rights to access, correct, delete or object to the processing of your personal data, including under Mexico's LFPDPPP and the EU GDPR; we honour those requests through the same address.

7. Children

Sargasso Tracker is not directed at children under 13 (or the age required in your country) and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

8. Security

Data travels over HTTPS; passwords are stored hashed; sign-in tokens are kept in your device's secure storage. No method is perfectly secure, so keep your password private and sign out of devices you no longer use.

9. Changes

We will post any change to this policy on this page with a new effective date. Material changes will also be announced in the app.

10. Contact

hello@sargassotracker.com