Privacy policy

Sargassum Check has no accounts, no advertising cookies and no payments. This page lists everything the site collects, why, who processes it and how to reach us about your data.

Last updated October 18, 2026

Version 2026-10-18. Effective on publication. Published at sargassumcheck.com/privacy and beachsignal.com/privacy and linked from every footer and from the photo tool before you send anything.

The short version

• There are no accounts, no passwords, no payments and no advertising. We do not ask who you are.
• We count visits with Cloudflare Web Analytics, which sets no cookies and does not fingerprint your device; we see totals only.
• Your browser contacts our host (Cloudflare) and, when a map is open, OpenStreetMap's tile servers. "Use my location" is resolved on your device and not sent to us.
• If you send a beach photo, we store it privately with its capture time and place, may send it to Google's Gemini service for automated condition analysis, and never publish the original. One anonymous cookie limits abuse of the photo tool. You can have the photo deleted with its receipt number.
• When an AI assistant calls our connector, we process its tool inputs for the request without storing them; Cloudflare keeps request metadata and an in-memory address counter limits abuse (section 3a).
• Booking links lead to other companies, which may set their own cookies, including affiliate cookies that tell them we referred you.
• We do not sell personal data, share it for advertising, or use your photos to train AI models unless the permission you accepted when you sent them says so (section 4).
• Wherever you live, you can ask us what we hold about you, have it corrected or deleted, and complain to a regulator.

1. Who is responsible

The data controller is Velkan Studio LLC, a Delaware limited liability company, 2093 Philadelphia Pike, Ste 2073, Claymont, DE 19703, United States, operating sargassumcheck.com and beachsignal.com under its Terra Continua and BeachSignal brands ("operated by Velkan" on the site means Velkan Studio LLC).

Contact: contact@sargassumcheck.com — for anything in this policy, for requests about your data, for photo withdrawal and for legal notices. There is no data protection officer; the law does not require one for processing of this size and kind.

2. What this policy covers

This policy covers sargassumcheck.com, map.sargassumcheck.com, beachsignal.com, their data feeds and the operator pages. It describes the Service as it runs on the version date. A flow that is switched off is marked as such; when a flow is switched on or changed, this policy changes in the same release and its date moves.

3. Browsing the map and planner

• No account, no identity. You do not need an account. We do not ask for your name or email to use anything.
• Visit measurement. We count visits with Cloudflare Web Analytics, which sets no cookies and does not fingerprint your device. It records page views, the referring site, an approximate country, browser and device type, and page load times, and we see only totals. The measurement script loads only when the site is configured with its public site token; it reads nothing else. It honours nothing it does not need: there is no identifier to opt out of, because none is set.
• Hosting. The site runs on Cloudflare (Workers, D1 database, R2 storage) in the United States. Like any host, Cloudflare processes your IP address and request details to deliver the pages, cache them and protect the site from abuse, and may set its own security cookie (for example __cf_bm) to tell people from bots. We use that cookie for nothing.
• Map tiles. The base map is loaded by your browser from OpenStreetMap tile servers, which receive your IP address and the tile addresses (so, roughly, the area you look at) when a map is open. Their policy is at osmfoundation.org/wiki/Privacy_Policy. No map, no request.
• Your location. If you choose "use my location", your browser asks your permission and shares your position with the page to select the nearest beach. This happens on your device and is not sent to us.
• Webcams. Camera cards give our reading of a public webcam operated by someone else, with a link to the operator's page. Nothing from the camera is fetched by your browser on our site; the operator is contacted, and sees your IP address under its own policy, only when you open its page. We may fetch webcam frames ourselves, on our servers, to analyse sargassum; that contacts the operator from our side, not yours.
• Local storage. The site keeps small settings (for example a chosen month or a collapsed panel) and your photo receipts in your browser's local storage, which never leaves your device.

3a. Asking through an AI assistant

Our read-only connector lets an assistant such as Claude or ChatGPT request beach and seasonal answers. It needs no account or sign-in.

• What reaches us. The assistant sends a tool name and text inputs: a place, a second place or starting place, a hotel name, a month and an answer language, as needed for that tool. Inputs are limited to 120 characters each and the request body to 64 KB. We are not given access to your conversation, files, assistant account or memory. The assistant chooses the inputs and may include words from your question, including personal information you wrote; do not include sensitive information. Connection metadata such as the assistant's own name and version is ignored. The endpoint sets a fixed assistant tag, not a user identifier.
• Inputs and answers. We do not store tool inputs or answers or write them to application logs. They are processed in memory for the request. No aggregate tool-call counts are collected by the deployed connector, and it creates no conversation history, account, cookie or session identifier. We do not sell these inputs, use them for advertising or profiling, or train models on them.
• Abuse control. The limit is 300 requests per 10-second window per client address, shared across the connector addresses, per Worker isolate. The address normally belongs to the assistant's server. The counter holds at most 10,000 addresses in memory. Addresses are discarded on the first request in a later window or when the isolate is discarded; an idle isolate can therefore retain the previous window until then. Beyond the capacity, new addresses are not counted in that window. The address counter is not written to storage or logs. Requests over the limit receive a retry time; the limit is not a global per-person quota.
• Host logs. Cloudflare processes request details to deliver and protect the connector. Workers invocation logs are enabled and persist request and response metadata, including the method and URL, for up to 7 days under Cloudflare's Workers Logs retention. URL query strings are not redacted, so do not put personal information in a connector URL. The connector does not add inputs or answers to these logs; request bodies are not part of the standard invocation log. Logpush and tail log consumers are not enabled. We use host logs to investigate faults and abuse, not to build a history of your questions.
• Links. Site links carry fixed assistant and tool tags (utm_source, utm_medium=ai_connector, utm_campaign), not a user identifier. If you follow a link, section 3 applies. We do not claim to measure individual connector referrals or link them to a conversation. hotel_beach_status returns no links or suggestions. An out-of-coverage answer may link to the University of South Florida's Sargassum Watch System at optics.marine.usf.edu; its own policy applies if you open it.
• Your assistant. Its provider holds your conversation under its own terms and privacy policy. We do not control what it sends or how it stores or presents the returned answer. Questions or deletion requests about its conversation history go to that provider. Requests about our processing go to contact@sargassumcheck.com.

4. Sending a beach photo or report

If you choose to send a photo of a beach, we receive and store:

• the image, compressed on your device, with its embedded metadata removed before upload;
• the capture time and location your device reports, or a map point you confirm, and the beach you had selected;
• the exact consent text you accepted (its version and fingerprint) and a receipt number;
• the time of upload and the request's technical details (IP address, browser description) in our host's logs.

Where it goes. Photos are stored privately in Cloudflare R2 and the records in Cloudflare D1, in the United States. There is no public address for an original photo.

Automated analysis. As the photo form states, a photo may be sent to Google's Gemini service for automated beach-condition analysis (how much sargassum is on the sand and in the water, and whether the frame is usable). Google receives the image and the beach context, not your receipt, cookie or any identifier of you, and processes it under its API terms, which do not allow Google to use API content to improve its models. We keep the structured reading the model returns. Webcam frames and hotel-site images are also classified automatically (by Cloudflare Workers AI or Gemini); those are not about you.

What we never do. We never publish your original photo; only a privacy-processed version — metadata removed, any face or plate obscured, reviewed by a person — could ever be shown, with the beach and date and without your name unless you ask. We do not sell your photos or license them to others. A photo is used to train AI models only if the permission you accepted when you sent it says so; photos sent under earlier permissions are not used for training.

Abuse limits. To limit abuse, the photo service sets one anonymous, secure cookie (__Host-beachsignal-photo) that expires after 31 days; it identifies no person and is not used for anything else. Your browser keeps your photo receipts in its local storage so you can manage or withdraw your photos for 30 days; after that you need the receipt number you were shown.

How long we keep it. We keep visitor photos and archived camera frames indefinitely to improve our estimates and models (section 9). You can ask us to delete a photo at any time by sending its receipt number to contact@sargassumcheck.com; if you have no receipt, send the approximate time, beach and device details and we will look for a match. Deleting a photo removes the file, its location and its records; the condition reading derived from it and the fact that a photo was received may remain in the beach's estimate history without any link to you.

Reports without a photo (a condition level you select) are stored with the beach, time and the same technical details, and handled the same way.

5. Booking links and other sites

Hotel and booking links take you to other companies' sites — hotel websites, Expedia, Hotels.com, Vrbo, Booking.com, Google Maps and others. After you click, those companies may set their own cookies, including affiliate cookies that tell them we referred you (Expedia Group's lasts 7 days), and their privacy policies apply. You book and pay on their sites; we never receive your name, your payment details or your booking. What an affiliate programme reports back to us is a count of referred clicks and bookings and the commission earned, with no personal data about you. Where our links go through a link-tagging service (Stay22), that service sees the link you clicked and your IP address under its own policy. See the Affiliate Disclosure.

6. Email, operators and partners

• If you write to us, we receive your email address and message and use them only to reply, to act on your request and to keep a record of how we handled it.
• Operator inquiries prepared on the operators page are sent from your own email app; the page itself saves nothing.
• Operators in a pilot (hotels, beach clubs) give us a business contact, photos and reviews of their listing; we keep them for the pilot and the listing, show the operator's name beside its photos, and never show the contact person's details. Operators can ask for their data to be removed at any time.
• Affiliate programmes (Expedia Group, Stay22 and hotel-chain programmes once joined) hold our account details, not yours.

7. Why we process your data, and on what legal basis

For people in the EEA, the UK and Switzerland the law requires us to name a legal basis for each purpose. The table applies to everyone; the legal-basis column matters where that law applies.

We do not profile you, make automated decisions with legal effect about you, or use your data for marketing. If we ever want to use your data for a new purpose, we tell you first and, where the law requires, ask.

8. Who receives your data

Service providers (processors). Each receives only what its job needs, under its written terms.

AI assistant providers you choose receive your conversation and our returned answer under their own policies; they are independent of us.

Independent recipients your browser contacts (not our processors): OpenStreetMap Foundation (map tiles), webcam operators, and the hotel and booking sites you click, each under its own policy.

Authorities and legal claims. We disclose data when a law, court order or lawful request requires it, or when necessary to protect the Service, our users or the public from fraud, abuse or harm. We check that each request is valid, limit what we give to what is required, and — unless a law or court forbids it or a life is at risk — tell the person concerned when we can reach them.

A change of ownership. If Velkan Studio LLC transfers the Service to an affiliate or a successor, your data may pass with it under this policy; we say so on the Service first.

Nobody else. We do not sell personal data, do not share it for advertising, and do not give it to data brokers. We have never done so.

9. How long things are kept

10. International transfers

Velkan Studio LLC is a United States company and its providers are in the United States. If you use the Service from the European Economic Area, Switzerland or the United Kingdom, the little we hold about you is transferred to the United States. For the transfer from you to us, it is necessary to provide what you asked for. For transfers to our providers we rely on each provider's certification under the EU-U.S. Data Privacy Framework where it has one (Cloudflare and Google are certified as of the version date; check dataprivacyframework.gov) and otherwise on the European Commission's Standard Contractual Clauses in our contract with it. You can ask us for a copy of the clauses.

11. Security

Photos are stored in private storage with no public address; access to our providers' consoles is limited to the operator, protected by multi-factor sign-in, and used to read contributions only to moderate them or to answer a request. Everything between your browser and the Service travels over TLS. No system is perfectly secure: if we learn of a breach that affects your personal data, we will tell you without undue delay where we can reach you, and tell the regulators the law requires within the time it requires (72 hours under the GDPR). Report security problems to contact@sargassumcheck.com; our security policy is published in the repository's SECURITY file.

12. Your rights

These rights are yours wherever you live. Where a law such as the GDPR, the UK GDPR, Mexico's federal data-protection law or a U.S. state privacy law gives you more, you have that too.

You can: know what personal data we hold about you and get a copy; have it corrected; have it deleted (a photo, with its receipt number, without asking anything else); take it with you in a machine-readable form; restrict or object to processing based on our legitimate interests; withdraw consent at any time where we rely on it (photos), with no effect on what was done before; opt out of sale or sharing of your personal data and of targeted advertising — we do none, so there is nothing to opt out of, and we treat a Global Privacy Control signal as such an opt-out anyway; and not be discriminated against for exercising any right.

How. Email contact@sargassumcheck.com. For a photo, the receipt number is all we need. For anything else we ask only what is needed to find your data and to be sure it is yours. An authorised agent may act for you if you confirm the authorisation. We answer within one month (or 45 days where U.S. state law sets that period) and tell you if we need longer. There is no charge unless a request is manifestly unfounded or repetitive.

Appeal. If we refuse a request, we tell you why and how to appeal; you can appeal by replying, and a different reviewer answers within 45 days. You can also complain to a regulator at any time.

Regulators. In the EEA, your national data protection authority (in Spain, the Agencia Española de Protección de Datos, www.aepd.es; all of them at edpb.europa.eu). In the UK, the Information Commissioner's Office (ico.org.uk). In Switzerland, the FDPIC. In Mexico, the Secretaría Anticorrupción y Buen Gobierno (successor to INAI). In the United States, your state attorney general or the California Privacy Protection Agency.

California. We do not sell or share personal information and have not done so in the preceding 12 months. The categories we collect are identifiers (IP address, the anonymous photo-tool cookie), internet activity limited to request logs and cookie-free visit totals, geolocation data only when you send a photo or report, and the photos themselves; the sources are you and your browser; the purposes are those in section 7; the recipients are those in section 8. We collect no sensitive personal information except the precise location you attach to a photo, which we use only for the purpose you sent it.

13. Children

The Service is meant for adults planning travel. We do not knowingly collect personal data from children under 13 (16 in the EEA, Switzerland and the UK, or your country's lower age). If you believe a child has sent us a photo, write to contact@sargassumcheck.com and we will delete it within 48 hours of confirming it.

14. Changes to this policy

We change this policy when the Service changes. A feature that is switched on or added changes the policy in the same release. For a change that reduces your rights or widens what we collect or who receives it, we show a notice on the Service at least 30 days before it takes effect, and we never apply it to data already collected without your consent where the law requires consent. Smaller changes take effect when posted. The date at the top says which version you are reading; earlier versions are available on request.

15. Contacting us

Write to contact@sargassumcheck.com. You do not need an account or anything but email. By post: Velkan Studio LLC, 2093 Philadelphia Pike, Ste 2073, Claymont, DE 19703, United States.

Velkan Studio LLC · Version 2026-10-18