Privacy Policy
Effective Date: October 9, 2026
ShellTide ("we," "us," or "our") operates the ShellTide application at shelltide.app. This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.
1. Information We Collect
Account Information
When you create an account, we collect your username, email address, and password (stored as a cryptographic hash — we never store your actual password). You may optionally provide a display name, bio, profile photo, and favorite beach.
User Content
We store content you create on the platform, including:
- Shell posts (text, photos, videos)
- Marketplace listings (text, photos, pricing, location)
- Messages (direct messages, group chats)
- Comments on posts and events
- Event listings and related content (vendor booths, speaker schedules)
- Shell collection progress (species marked as found)
Location Information
We collect location data in several ways:
- Text locations: Free-text location names you enter on posts, marketplace listings, events, and shell finds. These are stored as text strings you type, not GPS coordinates.
- Tagged locations: Location names auto-saved to your profile when you create posts.
- Event coordinates: GPS latitude and longitude for events you create, used to display events on the map.
- Live location (Nearby Map only): If you use the Nearby Map feature, your browser's GPS coordinates are sent to our server while you have the map page open. This data is ephemeral — it is overwritten each time your position updates and is not permanently stored. When you leave the map page, your location is no longer tracked.
Payment Information
Shell Society purchases are processed through PayPal. We store only the PayPal order ID for transaction records. We do not collect, store, or have access to your credit card number, bank account details, or PayPal password. PayPal handles all payment processing under their own privacy policy.
Shell Identification Images
When you use the Shell ID feature, the photo you upload is sent to OpenAI's API for AI-powered species identification. See Section 3 for details on this third-party processing.
Device and Browser Information
- Cookies: We use a session cookie (
sessionid) to keep you logged in and a security cookie (csrftoken) to protect against cross-site request forgery. No advertising or tracking cookies are used. - Push notification tokens: If you enable push notifications, we store your browser's push subscription endpoint and encryption keys to deliver notifications.
- Service worker cache: Our Progressive Web App caches certain pages and assets on your device for faster loading and offline access.
2. How We Use Your Information
- Account management: To create and maintain your account, authenticate you, and display your profile to other users.
- Content display: To show your posts, listings, and comments to other users on the platform.
- Messaging: To deliver your messages to other users in DMs, group chats, and location channels.
- Location features: To show events on the map, enable the Nearby Map feature, and power rare shell notifications based on your tagged locations.
- Payments: To process Shell Society purchases and track your interaction balance.
- AI identification: To identify shell species from photos you submit via the Shell ID feature.
- Notifications: To alert you about likes, comments, friend requests, and other activity via in-app and push notifications.
- Tide data: To display tide predictions, sunrise/sunset times, and moon phases for beach locations you select.
3. Third-Party Services
We share specific data with the following third-party services to operate ShellTide:
| Service | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI shell species identification | Shell photos you submit for identification (sent as images to OpenAI's API). Subject to OpenAI's Privacy Policy. |
| PayPal | Payment processing | Transaction amounts and descriptions. You are redirected to PayPal's hosted page to complete payment. Subject to PayPal's Privacy Policy. |
| NOAA | Tide predictions | Tide station IDs and dates only. No personal user data is sent. |
| Sunrise-Sunset.org | Sunrise and sunset times | Beach coordinates (latitude/longitude of the selected beach, not your personal location). |
| Google Fonts | Typography (Playfair Display, Montserrat) | Your IP address is exposed to Google when fonts are loaded. Subject to Google's Privacy Policy. |
| jsDelivr / Cloudflare CDN | CSS and JavaScript libraries | Your IP address is exposed when loading assets from these CDNs. |
| OpenStreetMap | Map tiles for the Nearby Map | Map tile requests may expose your approximate viewport location. |
We do not sell your personal information to any third party. We do not use any advertising networks, analytics services, or tracking pixels.
4. Cookies and Tracking
ShellTide uses only essential cookies required for the application to function:
sessionid: Keeps you logged in. Expires after 2 weeks of inactivity.csrftoken: Protects against cross-site request forgery attacks. Essential for form security.
We do not use any third-party advertising cookies, tracking pixels, analytics services (such as Google Analytics), or fingerprinting techniques.
5. Data Retention
- Account data: Retained for as long as your account is active.
- User content: Posts, messages, listings, and comments are retained until you delete them or delete your account.
- Location data: Tagged locations are retained until you delete your account. Live map coordinates are ephemeral and overwritten on each update.
- Payment records: PayPal order IDs and interaction logs are retained for accounting and dispute resolution purposes.
- Push subscriptions: Retained until you disable notifications or delete your account.
When you delete your account, your personal data is permanently removed from our systems. Some content you shared publicly (such as comments on others' posts) may remain in an anonymized form.
6. Your Rights
You have the right to:
- Access your personal data — your profile, posts, and activity are visible in your account.
- Correct your data — edit your profile, posts, and listings at any time.
- Delete your data — delete individual posts, messages, listings, or your entire account.
- Opt out of push notifications — disable notifications through your browser settings at any time.
- Opt out of location tracking — the Nearby Map feature only tracks your location while you have the page open. Simply navigate away to stop.
To request a full export or deletion of your data, contact us at admin@shelltide.app.
7. Children's Privacy (COPPA)
ShellTide is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at admin@shelltide.app.
8. California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- Right to know: You may request the categories and specific pieces of personal information we have collected about you.
- Right to delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to opt out of sale: We do not sell your personal information. There is nothing to opt out of.
- Non-discrimination: We will not discriminate against you for exercising your CCPA rights.
Categories of personal information we collect: identifiers (username, email), internet activity (posts, messages, interactions), geolocation data (when using the map feature), and commercial information (Shell Society purchases).
9. International Users (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland:
- Lawful basis: We process your data based on your consent (account creation, optional features like push notifications and location tracking) and our legitimate interest in operating the platform (displaying content, delivering messages).
- Data transfers: Your data is stored on servers in the United States. By using ShellTide, you consent to the transfer of your data to the US.
- Additional rights: You have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority.
- Withdrawal of consent: You may withdraw consent at any time by deleting your account or disabling specific features (such as push notifications or location tracking).
10. Security
We take reasonable measures to protect your information:
- Passwords are stored using strong cryptographic hashing (never in plain text).
- All form submissions are protected against cross-site request forgery (CSRF).
- Session cookies are HTTP-only to prevent JavaScript access.
- We use HTTPS in production to encrypt data in transit.
No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please use a strong, unique password for your ShellTide account.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective Date" at the top of this page and notify users through the application. Your continued use of ShellTide after changes are posted constitutes your acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
Email: admin@shelltide.app