WHALE LOCATOR
Live Community Sightings Network
Privacy Policy
Effective Date: March 31, 2026
Live Community Sightings Network
Effective Date: March 31, 2026
Whale Locator ("we," "us," or "our") operates the website whalelocator.com and the Whale Locator mobile application (together, the "Service"). This policy explains how we collect, use, and protect your information.
By using the Service you agree to this policy.
Account information: name, display name, email address, and password (stored securely via Firebase Authentication). Optionally: profile photo, date of birth, country, and community role.
Sighting reports: sighting location coordinates, species, count, direction of travel, behaviour, notes, and photos you upload. Your device location is collected at the time of reporting to place the sighting on the map.
Automatically collected: device type, browser, operating system, and IP address (used for rate limiting and security — not stored long-term).
| Purpose | Data Used |
|---|---|
| Display sighting reports on the map | Display name, sighting data, photos |
| Account emails (verification, welcome, password reset) | Email address, display name |
| Content moderation and abuse prevention | Account info, IP address |
| Community tier and rewards system | Sighting count, points |
| Research and conservation data backup | Sighting data |
| Provide data to conservation and enforcement partners | Sighting and vessel tracking data |
With other users: your display name, profile photo, tier level, and sighting reports are visible to authenticated users. Your email, password, and private profile fields are never shared.
With conservation partners: we work with NGOs, First Nations Governments, and federal, provincial, and state enforcement agencies. We may share aggregated sighting and vessel tracking data with these partners. Individual identities are not shared without consent unless required by law.
Service providers: Firebase (Google) for authentication and database, Google Workspace for email, Netlify and Render for hosting.
We do not sell your personal information.
Whale Locator displays publicly available AIS (Automatic Identification System) vessel positions. AIS data is broadcast publicly by vessels as required by maritime law and is received via third-party data providers. This is public maritime safety information, not personal data.
All data is transmitted over HTTPS. Passwords are managed by Firebase Authentication and never stored in plaintext. Database access is restricted via security rules. Server-side rate limiting protects against abuse. No security method is 100% guaranteed.
Account data is retained while your account is active. Sighting reports are retained indefinitely for research and conservation. Vessel track data is automatically deleted after 24 hours. IP addresses are not stored beyond the current session.
If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP):
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 6(1)(b) GDPR) |
| Subscription delivery and billing | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sighting submission and display | Consent (Art. 6(1)(a) GDPR), granted each time you submit a sighting |
| Push notifications | Consent (Art. 6(1)(a) GDPR), granted by enabling notifications |
| Content moderation, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) in platform integrity |
| Data sharing with conservation and enforcement partners | Legitimate interest (Art. 6(1)(f) GDPR) in marine conservation and, where applicable, compliance with legal obligations |
| Research and statistical analysis | Legitimate interest (Art. 6(1)(f) GDPR), with data aggregated or anonymised where feasible |
You may withdraw consent at any time by contacting us or by disabling the relevant feature in the app. Withdrawal does not affect processing carried out before withdrawal.
Whale Locator is operated from Canada. Personal data may be stored or processed on servers located in Canada, the United States, and other countries where our service providers operate (including Google Firebase, Netlify, and Render). When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and supplementary technical measures such as encryption in transit.
All users:
Additional rights for users in the European Economic Area, United Kingdom, and Switzerland:
Additional rights for users in California, Colorado, Connecticut, Utah, Virginia, and other U.S. states with applicable privacy legislation: you have the right to know what personal information we collect, request deletion, request correction, opt out of the sale or sharing of personal information (we do not sell personal information), and not be discriminated against for exercising your rights.
To exercise any of the rights above, contact contact@whalelocator.com. We will respond within the time frame required by applicable law (30 days under GDPR, extendable once by up to 60 days for complex requests). We may request information to verify your identity before processing a request. These rights are provided in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the GDPR, the UK GDPR, the Swiss FADP, applicable U.S. state privacy laws, and other applicable privacy legislation.
Whale Locator is not directed at children under 18. We do not knowingly collect information from children under 18. Contact us at contact@whalelocator.com if you believe a child has provided personal information.
We may update this policy and will revise the effective date above. Continued use of the Service constitutes acceptance of the updated policy.