Privacy Policy — Beachmap

Overview

Beachmap is a public beach catalogue. You do not need an account to use it. We do not require you to register, log in, or provide any personal information to browse the site.

What data we collect

We do not collect your name, email address, or any other information that identifies you as a person. There are no accounts and no logins on Beachmap — anyone can use the site without signing up for anything.

We use Google Analytics to understand general site usage — for example, which pages are visited and how users navigate the site. Google Analytics collects anonymised data such as browser type, device type, country, and pages visited. It does not identify you as an individual. You can opt out using the Google Analytics opt-out browser add-on.

Location / Geolocation

Beachmap offers an optional "Find beaches near me" feature on the home page. Your browser will ask for your permission before any location access occurs — this is a standard browser prompt controlled entirely by your device.

We do not access your location automatically. If you decline the browser prompt, the feature is simply not used and the site continues to work normally.

Low-accuracy mode — by design

Beachmap explicitly requests low-accuracy location only (enableHighAccuracy: false via the browser Geolocation API). This means your device uses Wi-Fi or cell-tower signals rather than GPS. The result is a general area — typically accurate to 1–3 km — which is more than sufficient to find nearby beaches.

We deliberately avoid requesting precise GPS coordinates. Only your general location is used — enough to find beaches nearby.

How your location data is used

If you grant permission, your approximate coordinates are used in a single request to calculate which beaches are nearest to you. This data is:

Not stored — coordinates are used only to compute the response and are never written to any database or log file
Not shared — your location is never transmitted to any third party
Not tracked — no location history is maintained
Short-lived — the browser may cache your position for up to 5 minutes to avoid repeat permission prompts; after that it is discarded

Legal basis (GDPR / UK GDPR)

Where data protection law applies, the legal basis for processing approximate location data is your explicit consent, given through the browser permission prompt. You may withdraw this consent at any time by revoking location access in your browser or device settings. Withdrawing consent does not affect any processing that occurred before withdrawal.

Beachmap uses the standard browser Geolocation API. You can revoke permission at any time through your browser or device settings.

Liked beaches

Beachmap has a ❤️ like button on every beach page. Here is exactly how it works, in plain terms:

When you like a beach, a session cookie is saved in your browser. Think of it like a temporary sticker — it has a random code, not your name or any personal detail.
That random code is stored alongside the beach you liked in our database. We can see that a beach was liked, but we cannot tell who liked it.
Your liked beaches are shown on the /liked/ page for as long as the session cookie is active — typically until you close your browser or clear cookies.
If you clear your cookies, switch browsers, or use a different device, your likes will no longer appear. The anonymous database records remain but are no longer linked to you in any way.
No name, email address, or any identifying information is ever collected or stored as part of the likes feature.

Legal basis (GDPR): the session cookie is strictly necessary to deliver the likes feature you actively choose to use. It does not track you across other websites and contains no personal data.

Cookies & local storage

Cookies set by Beachmap:

sessionid — a random identifier used only to remember which beaches you have liked. Contains no personal information. Expires when you close your browser (or after two weeks if you keep it open).
csrftoken — a standard security token that protects form submissions from cross-site attacks. No personal data.

Local storage: your liked beach IDs are also saved in your browser's local storage so the heart icon loads instantly without waiting for the server. This data never leaves your device.

Google Analytics cookies measure anonymised site usage. No advertising or tracking cookies are used.

Third-party content

Beach descriptions and images are sourced from Wikipedia and Wikimedia Commons. Satellite map tiles are served by Esri. Weather data is provided by Open-Meteo. These services may have their own privacy policies.

Hosting

Beachmap is hosted on PythonAnywhere. Standard web server logs (IP address, request path, timestamp) may be retained by PythonAnywhere in line with their own privacy policy. Beachmap does not access or process these logs.

Changes to this policy

This policy may be updated from time to time. The effective date at the top of the page reflects the most recent revision.