Privacy Policy
Contents
Version: draft-2026-11-01 · Last updated: 1 November 2026
This policy explains how OSIBOT PTY LTD (ABN 78 626 606 844), Cairns, Queensland, Australia ("we", "us") handles personal information for Chart Gap (chartgap.org). We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Privacy contact: Adam Cropp, Director · [email protected] · contact page
1. What we collect
| What | Why |
|---|---|
| Account: email address, password (stored only as a one-way hash), optional name, settings (such as units and language), the Terms version you accepted and when | To run your account and sign you in |
| Google sign-in (if you use it): your Google account ID, email, name and profile picture link. We never see your Google password | To sign you in |
| Plan and billing: plan, subscription status and dates, Stripe customer and invoice references | To manage your subscription. Stripe holds your card details; we never receive or store your full card number |
| Exports: what you exported and when | To apply export limits and data licences |
| Researcher requests: name, email, institution, research purpose and the request's IP address | To decide the request |
| Reports and messages: your email, what you write, and for map reports the point you clicked and the layers shown | To fix data problems and answer you |
| Affiliate records: who referred whom, and invitation email addresses | To credit referrals and prevent abuse |
| Logs: IP address, time, pages and tiles requested, browser type; records of account changes | Security, abuse prevention and fixing faults |
Your GPS position stays on your device. The GPS / boat view runs in your browser; your position is not sent to or stored by us.
We do not sell personal information, and we do not use it for advertising. Marketing emails are sent only if you opt in, and every one has an unsubscribe link. You can browse our public pages without telling us who you are, but the map needs an account.
2. Cookies
We use only cookies needed for the site to work. There are no analytics, advertising or tracking cookies.
| Cookie | Purpose | Lasts |
|---|---|---|
| csrftoken | Security: protects forms | 1 year |
| sessionid | Keeps you signed in | Until you sign out, or 2 weeks |
| uc_tt | Lets your browser load the map tiles your plan allows | 10 minutes |
| django_language | Remembers a language you pick (only if you pick one) | Until you close the browser |
| uc_aff | Remembers the affiliate link you arrived from (only if you used one) | 30 days |
Cloudflare, which protects our site, may set a strictly necessary security cookie (such as __cf_bm) if it needs to check for automated traffic. Stripe and Google set their own cookies on their own pages when you pay or sign in with Google. The map viewer also keeps your display settings in your browser's local storage; they are not sent to us.
3. Who we share it with
We share personal information only as needed to run Chart Gap:
| Provider | What for | Where |
|---|---|---|
| Stripe | Payments and invoices | United States and other countries |
| Sign-in, only if you choose 'Continue with Google' | United States and other countries | |
| Cloudflare | Network security and delivery: all traffic to chartgap.org passes through it | Global network, including the United States |
| Migadu | Sending and receiving our email | Switzerland (company), servers in France |
Chart Gap itself is hosted on our own server in Australia, so your account data is stored in Australia. We may also share information with professional advisers under confidentiality, or where the law requires it.
Overseas disclosure. Our providers above may handle personal information in the United States, Switzerland, France and other countries where Cloudflare, Stripe and Google operate. We use reputable providers and rely on their data-processing terms to protect it.
4. How long we keep it
We keep account information while your account is open and delete or de-identify it within [ADAM TO CONFIRM: 90] days after you close it, except billing records, which Australian tax and company law require us to keep for 7 years. Server logs are kept for [ADAM TO CONFIRM: 90 days].
5. Security
We use hashed passwords, encrypted connections (HTTPS), access controls, short-lived access tokens and audit logs. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the OAIC.
6. Your rights and complaints
6.1 You can ask for a copy of your personal information, ask us to correct it, or ask us to delete your account. Many details can be changed on your account page. Contact us at [email protected]; we will reply within 30 days. Requests are free.
6.2 If you have a complaint, contact us first. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
6.3 We do not make decisions that significantly affect you by automated means alone.
7. Europe and the UK (GDPR)
If the GDPR or UK GDPR applies to you, we are the controller of your information. We rely on contract (your account and plan), legitimate interests (security, abuse prevention, licence protection and improving the Service), legal obligation (tax records) and consent (marketing emails). You also have the rights to erasure, restriction, objection, data portability and to withdraw consent, and you can complain to your local data protection authority. Transfers rely on our providers' standard contractual clauses or equivalent safeguards.
8. Children and changes
Chart Gap is for adults and is not directed at children. We may update this policy; the version and date at the top show the current one, and we will email you about material changes.