Privacy policy

Last updated 22 September 2026

Kelp Horn is an app that shows whale sightings around Hermanus and the Overberg on a live map. It is built to know as little about you as it can. This policy covers the Kelp Horn app and this website.

Using the app without an account

You can view the map, open sightings, share them and get alerts without an account. We don't collect anything about you to do that: no name, no email, no location, and no advertising or analytics identifiers.

Alerts. Push notifications are delivered by Google's Firebase Cloud Messaging, which gives your phone a push token and knows which areas you subscribed to. On iPhone they go through Apple's push service too. We don't receive or store your push token. Your alert settings stay on your phone.
Location. The map only shows where you are if you ask it to, by tapping the location button. Approved posters are also asked for it when posting, to pick the nearest viewing spot. Either way it stays on your phone: your location is never sent to us or stored.

If you sign in

You need an account to confirm a sighting ("Yes I saw") or, if you're an approved poster, to post one. You sign in with Apple or Google. We then keep:

the sign-in details Apple or Google send us: an account identifier and your email address (with Apple, this can be a private relay address);
the display name you choose. We don't copy your name from Apple or Google;
the sightings you post, and which sightings you confirmed;
your role (member, poster or admin), and a record of when it changed.

What other people can see

Anyone using the app or this website can see today's sightings: the spot, the time, the species and number of whales, how many people confirmed it, and the display name of whoever posted it. At midnight a sighting stops being visible. Nobody else can see your email address, or which sightings you confirmed.

When you share a sighting, the message has the spot and the time and a link. It doesn't carry anyone's name.

Where it's kept

Kelp Horn's data is stored with Supabase in Frankfurt, Germany. That is a transfer of personal information outside South Africa, which POPIA allows because the EU's data protection law (GDPR) gives it the same level of protection. Push notifications go through Google and Apple.

How long we keep it

We keep your account until you delete it. Delete it in the app, under Account. That removes your sign-in details, display name and role right away. Sightings you posted, confirmations you made and the record of role changes stay, no longer linked to you.

This website

The website uses no cookies, no analytics and no tracking. It is hosted on GitHub Pages, and GitHub may log visitors' IP addresses as part of running it. When you open a shared sighting, your browser loads it from Supabase and the map from OpenStreetMap, which see your IP address as part of serving it.

Your rights

You can ask what personal information we hold about you, ask us to correct or delete it, or object to how we use it. Email us at the address below. If you're not happy with our answer, you can complain to the Information Regulator of South Africa.

Children

Kelp Horn is for general audiences. Accounts are not meant for children under 13, and we don't knowingly collect their information.

Changes

If this policy changes, we'll update it here and change the date at the top.

Contact

Kelp Horn is run by h360.dev, Hermanus, South Africa: kelphorn-privacy@h360.dev.