Effective Date: August 8, 2026
Whale Locator ("we," "us," or "our") operates the website whalelocator.com and the Whale Locator mobile application (together, the "Service"). This policy explains how we collect, use, and protect your information.
By using the Service you agree to this policy.
Account information: name, display name, email address, and password (stored securely via Firebase Authentication). Optionally: profile photo, country, and community role.
Sighting reports: sighting location coordinates, species, count, direction of travel, behaviour, notes, and photos and videos you upload. Your device location is collected at the time of reporting to place the sighting on the map.
Uploaded media: photos are re-encoded on your device before upload, which removes embedded camera metadata (including any GPS location stored in the photo file). Videos under the size limit are uploaded as recorded and may retain embedded metadata; larger videos are compressed on your device, which removes it.
Automatically collected: device type, browser, operating system, and IP address (used for rate limiting and security — not stored long-term).
| Purpose | Data Used |
|---|---|
| Display sighting reports on the map | Display name, sighting data, photos |
| Account emails (verification, welcome, password reset) | Email address, display name |
| Content moderation and abuse prevention | Account info, IP address, uploaded media (automated scanning), moderation records |
| Community tier and rewards system | Sighting count, points |
| Research and conservation data backup | Sighting data |
| Provide data to conservation and enforcement partners | Sighting and vessel tracking data |
With other users: your display name, profile photo, tier level, and sighting reports are visible to authenticated users. Your email, password, and private profile fields are never shared.
With conservation partners: we work with NGOs, First Nations Governments, and federal, provincial, and state enforcement agencies. Data shared with partners may include sighting details, timestamps, approximate reporter locations, vessel tracking data, encounter tracks, and aggregated behavioural patterns, and reports concerning possible infractions may be used in enforcement activities. Your identity (name, email, phone) is not shared with partners unless required by law or with your explicit consent.
Service providers: Firebase and Google Cloud (authentication, database, media storage, and automated content screening via Cloud Vision and Video Intelligence), Google Workspace (email and data backup), Netlify and Render (hosting), and RevenueCat (subscription management). Payment card details are handled entirely by the Apple App Store or Google Play Store and never reach Whale Locator.
We do not sell your personal information.
To keep the community safe, photos and videos uploaded to the Service are automatically screened for prohibited content. Screening is performed by Google Cloud Vision and Google Cloud Video Intelligence, acting as our service providers: the uploaded media is processed for this purpose only and is not used by Google for advertising. Media that is flagged may be hidden pending review by our moderators; final moderation decisions involve human review, and you may contest a decision as described in our Terms of Use.
When a user reports a photo or video, we record which account made the report. Reporter identities are visible only to Whale Locator and are not shown to other users, including the person reported. Moderation outcomes (such as strikes or a suspension of media-posting privileges) are recorded on the account concerned and retained while the account is active.
Whale Locator displays publicly available AIS (Automatic Identification System) vessel positions. AIS data is broadcast publicly by vessels as required by maritime law and is received via third-party data providers. This is public maritime safety information, not personal data.
All data is transmitted over HTTPS. Passwords are managed by Firebase Authentication and never stored in plaintext. Database access is restricted via security rules. Server-side rate limiting protects against abuse. No security method is 100% guaranteed.
Account data is retained while your account is active. Sighting reports are retained indefinitely for research and conservation. Uploaded photos and videos are retained until removed by you (within the editing window), by moderation, or with your account. Moderation records and media reports are retained while the accounts involved are active, or longer where the law requires preservation. Vessel track data is automatically deleted after 24 hours. IP addresses are not stored beyond the current session.
If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP):
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 6(1)(b) GDPR) |
| Subscription delivery and billing | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sighting submission and display | Consent (Art. 6(1)(a) GDPR), granted each time you submit a sighting |
| Push notifications | Consent (Art. 6(1)(a) GDPR), granted by enabling notifications |
| Content moderation, fraud and abuse prevention (including automated media screening) | Legitimate interest (Art. 6(1)(f) GDPR) in platform integrity and user safety, and compliance with legal obligations (Art. 6(1)(c)) where reporting is required by law |
| Data sharing with conservation and enforcement partners | Legitimate interest (Art. 6(1)(f) GDPR) in marine conservation and, where applicable, compliance with legal obligations |
| Research and statistical analysis | Legitimate interest (Art. 6(1)(f) GDPR), with data aggregated or anonymised where feasible |
You may withdraw consent at any time by contacting us or by disabling the relevant feature in the app. Withdrawal does not affect processing carried out before withdrawal.
Whale Locator is operated from Canada. Personal data may be stored or processed on servers located in Canada, the United States, and other countries where our service providers operate (including Google Firebase, Netlify, and Render). When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and supplementary technical measures such as encryption in transit.
All users:
Additional rights for users in the European Economic Area, United Kingdom, and Switzerland:
Additional rights for users in California, Colorado, Connecticut, Utah, Virginia, and other U.S. states with applicable privacy legislation: you have the right to know what personal information we collect, request deletion, request correction, opt out of the sale or sharing of personal information (we do not sell personal information), and not be discriminated against for exercising your rights.
To exercise any of the rights above, contact contact@whalelocator.com. We will respond within the time frame required by applicable law (30 days under GDPR, extendable once by up to 60 days for complex requests). We may request information to verify your identity before processing a request. These rights are provided in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the GDPR, the UK GDPR, the Swiss FADP, applicable U.S. state privacy laws, and other applicable privacy legislation.
The Service requires users to be at least 16 years of age, as set out in our Terms of Use. Whale Locator is not directed at children, and we do not knowingly collect personal information from anyone under 16. If we learn that an account belongs to a person under 16, we will terminate it and delete its personal information. Contact us at contact@whalelocator.com if you believe a child has provided personal information.
We may update this policy and will revise the effective date above. Continued use of the Service constitutes acceptance of the updated policy.