Privacy

No ads, no ad trackers, no cookies, and nothing about you is sold.

Last updated September 2026

In short

  • We count page views with a privacy-focused service that sets no cookies.
  • The map keeps your trips in your own browser, and your location never leaves it.
  • Dark mode is remembered in your own browser and is never sent anywhere.
  • The contact form sends us an email and nothing more.
  • If you have a member account, we store your email address and an optional name, and you can change the name or delete the account yourself.
  • A few third parties see your IP address when a page loads, because they serve part of it. They are listed below.

Website analytics

Page views on this site are counted by Aptabase. Each view sends the page path, your browser’s language, and a session id that exists only in your browser’s memory and resets after an hour of inactivity. Clicks on the homepage tiles and on the social links in the footer are counted the same way. No cookie is set and nothing is written to your browser’s storage. Aptabase’s servers are in the United States, and according to Aptabase they do not store IP addresses or anything that identifies a person.

The contact form

What you type into the contact form, meaning your name, your email address, the reason you chose and your message, is sent to us as an email and nothing else. It is not stored in a database and it is not used for a mailing list. The email is delivered by Resend, whose servers are in the United States; they pass the message on and do not use it for anything of their own. We keep the email in our mailbox for as long as the matter is open. The form counts one thing for analytics: that a message was sent and whether it succeeded. What you wrote is never part of that.

Your account

You do not need an account to use the site or the map. If you sign up for one, we store your email address, the name you choose to give (or none), whether the account is approved, its role, and when it was created and last changed. Nothing else is collected: no password, because signing in works by a link emailed to you, and no profile picture. The account database is hosted by Supabase in Sydney. The sign-in link is delivered by Resend, as the contact form’s email is, and it expires after a short time whether or not it is used. To stop the sign-in form being abused, requests for a link are counted for a short while: a hash of the address for 15 minutes, and a hash of the IP address it came from for an hour. Neither the address nor the IP is stored in the clear, and the counts are dropped once the window has passed.

From the account page you can change your name or delete your account. Deleting it removes the record and any unused sign-in link at once, and signs you out. It does not stop the same email address signing up again later; that makes a new account, which starts unapproved like every other.

Map analytics

The map can count how often a business listing is opened and which of its buttons are tapped, so that a business can see what its listing did. That counting is currently switched off. When it is on, it counts business listings and nothing else: which boat ramps or campsites you look at is never recorded. It honours the Do Not Track and Global Privacy Control signals, and it sets no cookie and stores nothing.

Hosting

The site is served by Vercel, which keeps ordinary server logs (IP address, browser, the address requested) for a short time to run and secure the service.

What stays on your device

The map’s trip planner saves your trips in your browser’s local storage, under the name saltcharts-trips, and nowhere else. We never see them. A shared trip link carries the ids of the places on the trip in the address and nothing about you. Clearing the site’s data in your browser removes the saved trips.

Switching the site to dark mode writes one more thing in the same place, under the name saltcharts-theme: the word light or dark, and nothing else. It is read when a page loads so the site comes back the way you left it. It is never sent to us or to anyone else, and clearing the site’s data returns the site to light.

Your location

The map asks for your location only when you tap the locate button, and only after your browser asks you. It is used to draw your position and to sort nearby places by distance, held in memory while the page is open, and never sent to us.

Third parties that see your IP address

Parts of the site are served by other people, and their servers see the request:

  • OpenStreetMap Foundation, which serves the map tiles.
  • Cloudflare’s cdnjs, which serves the map library files.
  • YouTube, on pages with a video, through the youtube-nocookie.com player. It sets no cookie until you press play.
  • Google Maps or Apple Maps, only if you tap a Directions button.

Fonts are served from this site, so there is no request to Google Fonts.

Overseas

Vercel, Aptabase and Resend are outside Australia, so the logs, counts and form messages above are held overseas. The account database is in Sydney.

Australian law

This page is written with the Australian Privacy Principles in mind. As a small operator we may sit under the Privacy Act 1988 threshold, but we follow the principles anyway. If you have an account, the account page lets you see, correct and delete what we hold. For anything else, or to ask what we hold about you, ask through our contact page. If you are not satisfied with our answer you can contact the Office of the Australian Information Commissioner.

This is a description of what we do, not legal advice. Our terms of use cover the rest.

Changes

When this page changes, the date at the top changes with it.