TideButBetter — Privacy Policy

Last updated: 21 July 2026

This policy should be read alongside the Terms of Use.

In short (the plain-language version — the full policy below is what binds us): we collect very little. If you make an account we hold your email and name; we keep the searches you run and the areas you ask us to forecast; we count visits to our own pages anonymously (no cookies), we don’t track you around the web, we show no ads, and we never sell your data. If you use the locate button, your position stays in your browser — we don’t store it. You can ask us for a copy of your data, ask us to delete it, or complain — to us first at privacy@tidebutbetter.com, and to the ICO at any time.

1. Who we are

1.1 This policy explains how Obtanium Software Limited (“we”, “us”, “our”), a company registered in England and Wales (company number 17327621), of 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, collects and uses personal data when you use TideButBetter (the “Service”), and the rights you have. For the purposes of the UK GDPR, we are the data controller.

1.2 For any privacy question or to exercise your rights, contact us at privacy@tidebutbetter.com.

1.3 Where we operate and who this policy covers. We operate the Service from the United Kingdom and are established in the UK, so the UK GDPR governs our processing. The Service is available to, and can be purchased from, users worldwide. Because we offer the Service to individuals in the European Union, the EU GDPR also applies to that processing under its Article 3(2). We have not appointed a representative in the EU under Article 27 of the EU GDPR: we rely on the exemption in Article 27(2)(a) for processing that is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to individuals’ rights and freedoms — which reflects this Service (a small user base, no special-category data, and low-risk account and usage data). We keep this position under review as our EU user numbers grow, and have recorded the assessment internally in our data protection impact assessment. Wherever you are, you have the rights set out in §12, and the international-transfer safeguards in §7 are designed to satisfy both the UK GDPR and the EU GDPR.

2. A note on what we don’t do

To be clear up front: we do not sell your personal data, we do not use it for third-party advertising, and the Service does not run advertising or behavioural-tracking technology. The only usage measurement we do is the cookieless, aggregate page-view analytics described in §10 — it does not follow you across other sites and stores nothing on your device. If this ever changes, we will update this policy and obtain consent where the law requires it.

3. The personal data we collect

We collect only what we need to run the Service.

3.1 Information you give us

• Account information (only if you create an account; account features use the third-party provider Clerk): your email address and name. If you sign in with Google, we receive — via Clerk — the following Google user data: your Google account’s name, email address and profile picture (the basic sign-in scopes). We use this data only to create and operate your account and to authenticate you; we do not use it for any other purpose, and we share it only with the processors listed in §6. It is retained and deleted with your account data (§8), and you can revoke our access at any time in your Google Account settings at myaccount.google.com/connections. We also store an account role, a credit balance, a record of your acceptance of the Terms of Use, and (if you set one) a home club or venue preference associated with your account.
• Billing information (only if you buy a plan or a commissioned simulation): your purchase is sold through Onelink, Stripe’s merchant-of-record service, acting on our behalf. Stripe (Onelink) takes your payment directly and processes the transaction under its own privacy policy — we never see or store your card details. From Stripe we receive your subscription status, a customer reference and the billing email associated with your purchase, which we use to keep your account and entitlements in sync. Onelink issues your receipts and any invoices or credit notes, and sends renewal reminders (see §6).
• Search queries: the text you type into the place-search bar. To return results, this text is sent to Stadia Maps’ geocoding service (see §6).
• Simulation requests: when you request a high-resolution tidal-current simulation, we store the geographic area (a bounding box of coordinates), the dates and parameters you chose, the status of the request, and an identifier linking it to your account. Finished simulation outputs are stored on our storage provider’s content-delivery network at unguessable (randomised) URLs; encrypted stream data additionally requires a key issued only to signed-in, authorised users. Simulations designated as public are visible to all users.
• Communications: if you email us, we keep your message and contact details to respond.

3.2 Information collected automatically

• Technical and log data: like any website, our hosting platform (Vercel) automatically processes standard request data, which may include your IP address, browser/user-agent, device information, and the pages or API endpoints you access, for security, reliability and to operate the Service.
• Map and tile requests: as you pan and zoom or search, your browser requests map tiles and geocoding directly from Stadia Maps; that provider necessarily receives your IP address and the area or text requested under its own privacy policy.
• Access records: when your browser requests the decryption key for a stream, we record which stream was requested, your account identifier, whether access was granted, and the time. We keep these records for security and to audit access to protected data.
• Aggregate usage analytics: our hosting platform’s analytics service (Vercel Web Analytics) records the pages you visit, the referring page, your country (derived from your IP address; the IP address itself is not retained in the analytics data available to us) and your browser and device type. It sets no cookies and stores nothing on your device; visitors are distinguished only by a short-lived anonymised identifier derived from the IP address and browser information sent with every web request, which is discarded and rotated daily and cannot be used to follow you across other sites or between days. See §10.

3.3 Location

The Service centres the map on a default location and on places you search for. It also offers an optional locate button: if you choose to use it (and grant your browser’s permission prompt), your device’s precise location is used, and tracked while the feature is active, to centre the map and the tide graph on your position. Your precise position is processed in your browser and is not stored by us or sent to our servers. Note that as the map follows your position, your browser’s map-tile requests necessarily reveal the map area you are viewing (together with your IP address) to our map provider, Stadia Maps, like any other panning or zooming (§3.2). You can stop location use at any time via the button or your browser settings. We do not otherwise request or track your device’s location. This section concerns your device’s live position only: places you deliberately choose — a saved home club or venue preference, and the geographic areas of simulations you request — are stored with your account as described in §3.1.

4. Legal bases for processing

Under the UK/EU GDPR we rely on the following legal bases:

• Performance of a contract — to provide the Service and the features you request (e.g. running your account, returning search results, performing simulations you ask for).
• Legitimate interests — to keep the Service secure and working, to prevent abuse and manage cost, to understand and improve how the Service is used (in aggregate), and to protect our legal rights. Where we rely on legitimate interests, we have considered that they are not overridden by your interests and rights.
• Legal obligation — where we must process or disclose data to comply with the law or a lawful request from an authority.
• Consent — where consent is required (for example, when you choose to use the locate button and grant your browser’s location permission, before placing any non-essential cookie, or before sending optional marketing). You can withdraw consent at any time without affecting prior processing.

5. How we use your data

We use personal data to:

• operate, maintain and secure the Service and your account;
• carry out the searches and simulations you request, and show you your own and publicly available results;
• communicate with you about the Service, including service and security notices and replies to your enquiries (receipts, invoices and renewal reminders for purchases are sent by Onelink, the merchant of record, on our behalf — see §6);
• keep your paid features and entitlements in sync with your purchases, which are sold and processed by Onelink (see §6);
• monitor for, prevent and address abuse, fraud and technical problems, and manage the cost of third-party compute and data services;
• understand usage in aggregate to improve the Service; and
• comply with our legal obligations and establish, exercise or defend legal claims.

We do not currently send marketing emails. If we introduce them, we will only do so on a lawful basis and you will be able to opt out at any time.

6. Who we share data with

We do not sell your data. We share it only with service providers who process it on our behalf, or (in Stripe’s case) as the merchant of record that takes payment for your purchase as our agent. Our current providers are:

6.1 Other disclosures. We may also disclose personal data: (a) to comply with the law or a valid legal request, or to protect our rights, users or the public; and (b) in connection with a reorganisation, merger or sale of the business, in which case any recipient will remain bound by this policy or an equivalent one.

6.2 Each provider acts under our instructions and/or its own published privacy terms, and may not use your data for its own unrelated purposes beyond what is necessary to provide its service.

6.3 Payment data and deletion through Onelink. Because Stripe (Onelink) is the merchant of record and an independent controller for your purchase transaction data, requests about that data — including deletion of your payment information — are handled by Stripe under its own privacy policy, through your Onelink account or Onelink support. When payment data is deleted at Stripe, Stripe may cancel any active subscription and delete the related billing objects on its side and notify us at our business email; we then update your account and entitlements accordingly. You can still exercise all of your rights against us for the data we hold (§12).

7. International data transfers

Some of our providers are located outside the UK and European Economic Area, including in the United States. Where personal data is transferred outside the UK/EEA, we rely on an appropriate safeguard — such as the UK International Data Transfer Addendum together with the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified — to ensure your data receives an equivalent level of protection. Of our current providers, Clerk, Vercel, Neon (a Databricks company) and Stripe are certified under the EU–US Data Privacy Framework, including its UK Extension, with Standard Contractual Clauses as a contractual fallback in their data-processing agreements; for Modal and Stadia Maps we rely on data-processing agreements incorporating the Standard Contractual Clauses and, for UK transfers, the UK Addendum. You can ask us for more detail using the contact above.

8. How long we keep data

We keep personal data only for as long as we need it for the purposes set out above, and then delete or anonymise it. In particular:

• Account data — for as long as your account is open, and then deleted within a reasonable period after you close it (subject to anything we must keep by law).
• Simulation request records and outputs — 12 months from the date the simulation was requested, after which the record and its stored outputs are deleted by a periodic clean-up (which targets data slightly ahead of this period, so data may be removed up to a week or so earlier).
• Stream-access audit records — 12 months, deleted by the same clean-up.
• Technical and server logs — kept by our hosting provider for a short period for security and troubleshooting (of the order of 30 days) and then deleted or aggregated.
• Communications — kept as long as needed to handle your enquiry and any follow-up.

We may keep certain data longer where necessary to comply with legal, accounting or tax obligations, or to establish, exercise or defend legal claims.

9. Cookies and local storage

9.1 Our authentication provider (Clerk) sets strictly necessary cookies so you can sign in and stay signed in. The Service also stores a small number of preferences in your browser’s local storage, on your own device only:

• theme — your light/dark display preference;
• tbb-help-seen — that you have seen the first-visit help;
• tbb-safety-ack — that you have acknowledged the safety notice;
• tbb:recent — your recent place searches (kept on your device; your searches are separately sent to the geocoding provider to get results, §3.2).

You can clear all of these at any time with the “Reset saved settings” button in the Help panel, or via your browser settings.

9.2 We do not use analytics, advertising or cross-site tracking cookies. The aggregate usage analytics described in §10 operates without cookies and without storing or reading anything on your device. If we ever introduce any non-essential cookies or similar technologies, we will first provide the required information and obtain your consent where the law (including UK PECR / EU ePrivacy rules) requires it.

10. Analytics and tracking — current position

The Service uses one privacy-preserving analytics tool: Vercel Web Analytics, provided by our hosting platform. It gives us aggregate statistics — page views, referrers, countries, browser and device types — so we can understand how the Service is used and improve it. It is cookieless: it sets no cookies, stores nothing on and reads nothing from your device, and does not track you across other websites. Visitors are counted using a short-lived anonymised identifier derived from the IP address and browser information sent with every web request; it is rotated and discarded daily and is never exposed to us. Because nothing is stored on or accessed from your device, this does not require consent under UK PECR; our lawful basis for the underlying processing is our legitimate interest in understanding and improving the Service in aggregate (§4).

Beyond this, the Service contains no other analytics, tag managers, session-recording, advertising pixels or similar tracking. If any such technology is added in future, this policy will be updated and cookie-consent obligations re-assessed.

11. Children

The Service is not directed at children. You must be at least 16 to use it, matching our Terms of Use. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it. (The plain-language summary at the top of this policy is there so that younger readers who encounter the Service can understand it too.)

12. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data (“right to be forgotten”);
• restrict or object to our processing, including processing based on our legitimate interests;
• data portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• withdraw consent at any time where we rely on consent;
• complain to us — see below; and
• lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk), or the authority in your country of residence.

To exercise any of these rights, contact us at privacy@tidebutbetter.com. We will respond within the statutory time limit (one month under the UK/EU GDPR, which may be extended for complex requests), carrying out the reasonable and proportionate searches the law requires. We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Complaints. If you are unhappy with how we have handled your personal data, you can complain to us directly by emailing privacy@tidebutbetter.com with the subject line “Data protection complaint” (or by post to the address in §15). We will acknowledge your complaint within 30 days and respond substantively without undue delay, telling you what we have done or why we disagree. Complaining to us first often resolves things fastest, but it is not a precondition — you can also complain to the ICO at any time. (For complaints about the Service itself, rather than personal data, see §1.3 of the Terms of Use, which also states our position on alternative dispute resolution.)

13. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, disclosure, alteration or destruction, and we work with reputable infrastructure providers. Simulation outputs are stored at unguessable randomised URLs, protected stream data is encrypted and its keys are issued only to signed-in, authorised users, and key requests are logged for audit (see §3). However, no method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping any account credentials confidential; please notify us promptly of any suspected unauthorised use.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new “last updated” date and, where changes are material, take reasonable steps to bring them to your attention. Your continued use of the Service after an update takes effect indicates your awareness of the revised policy.

15. Contact

For any question about this policy or our handling of your personal data, or to exercise your rights, contact Obtanium Software Limited at privacy@tidebutbetter.com, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.