Privacy policy

Bite Aid runs the Community Shark Bite Kits initiative and this website. We are a community-funded volunteer project based in Australia.

This policy explains what happens to your information when you use this site. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

You can read every page on this site, and put things in a cart, without telling us who you are. You only need an account to actually buy or sponsor a kit.

When you create an account

Your email address, a password, and a name if you give us one. We ask for an account before you buy because every kit is funded by someone and we need to be able to send you a receipt, tell you where your kit went, and credit you the way you asked to be credited. Your password is stored scrambled — we cannot read it, and neither can anyone who gets hold of our database. We record the date of the privacy policy you agreed to when you signed up. You can delete your account yourself at any time.

Details you ask us to remember

You can save a name, a phone number and one delivery address to your account, so checkout offers them back instead of asking again. Nothing is saved unless you tick the box for it, and the delivery address box is unticked by default — if you are posting a kit to somebody else, that address is theirs and we should not keep it against your name. You can see, change and remove any of it from your account at any time, and deleting your account removes all of it.

When you buy or sponsor a kit

What you ordered and what it cost. If something is being posted to you, the delivery address you give us. If you are sponsoring a kit, which beach you chose — or that you left it to us — and whatever you asked us to record about the sponsorship: a name to credit, a dedication, and whether we may name you publicly. Those last ones are optional, every one of them, and we ask for a name only so we know who funded the kit. Your phone number if you give it, which we only use if there is a problem with your order. We do not collect card details anywhere on this site — payment is arranged with you directly by email once the order is in.

When you email us

Whatever you put in the email — typically your name, your email address and your question. We only use it to answer you.

When you use a form on this site

The contact form collects your name, email address, an optional phone number and your message. The kit issue form collects the kit code, what is wrong with it, your description, and your name and email if you choose to give them — you can report a kit without identifying yourself at all. Submissions are stored in our enquiry system, Mobiddiction, which processes them on our behalf and stores them in Australia. We only use them to answer you and to get kits back into service. If you own a kit you can also report a problem with it from your account. That one is not anonymous — it is recorded against your account so we know the report came from the person responsible for the kit, which is the point of it.

When you visit a page

Our hosting provider records standard server logs: IP address, the page requested, the time, and your browser's user-agent string. These exist to keep the site running and to investigate abuse.

If you allow analytics

Anonymous usage statistics — which pages are visited, roughly where in the world from, and on what kind of device. See analytics below.

We do not buy personal information from anyone, we do not sell it, and we do not run advertising on this site.

Nothing that tracks you is set before you say yes. When you first arrive we ask whether you are happy for us to use Google Analytics. Until you answer, the only things stored on your device are the essential ones below, and the cart entry only exists once you have put something in a cart.

csbk-consent — cookie, 12 months

Remembers whether you accepted or declined analytics, so we stop asking. Essential; it is the record of your choice.

csbk-color-scheme — local storage, until you clear it

Remembers whether you chose the light or dark version of the site. It never leaves your browser.

csbk-cart — local storage, discarded 30 days after you last change it

What you have put in your cart: which kits, how many, and where you have chosen to have them installed. No prices are kept — every amount you see is worked out fresh by our ordering system each time you open your cart. When something in your cart is being posted to you, we may pre-fill state and postcode from your connection's approximate location (via our CDN) so we can estimate delivery cost. You can change or clear those before anything is priced. It stays on your device, is not shared between devices, and nothing is sent to us until you ask for a price or place an order. Emptying your cart removes it.

csbk-at, csbk-rt, csbk-session — cookies, only while you are signed in

How we keep you signed in. The first two are the keys to your session and are set so that no code running in the page can read them — only our server can. The third holds no personal information at all: just when the first two expire, so the site knows when to renew them. Signing out deletes all three.

_ga, _ga_* — cookies, up to 2 years

Set by Google Analytics, and only if you accept. Declining means these are never created.

cf_clearance and similar — cookies set by Cloudflare, up to 1 year

Set by the bot check on our forms, to remember that this browser already passed one. These are not analytics and are not affected by the choice above — a form cannot work without being able to tell a person from a script. See Checking you are a person.

You can change your mind at any time:

Change my cookie choice

If you accept, we load Google Analytics 4 to understand which pages are useful and where people give up. It tells us that a page was viewed; it does not tell us who you are, and we never combine it with anything you email us.

If you decline, no request is made to Google at all — the analytics code is not loaded, rather than loaded and told to stay quiet.

Google processes this data as our provider, and may store it outside Australia. See Google's privacy policy.

The training videos on our resources page are hosted on YouTube by Surfers Rescue 24/7. We do not embed them the usual way, because a normal YouTube embed contacts Google the moment the page opens, whatever you told our cookie banner.

Instead you see a still image stored on our own site and a play button. Nothing is requested from Google until you press play. When you do, YouTube may set its own storage on your device and its own privacy terms apply from that point.

The kit map on our locations page, the map on each kit's own page, the small confirmation map at checkout when you tell us a new place to install a kit, and the map on your account when you set where your kit is going, are drawn using map imagery supplied by CARTO, built on OpenStreetMap data. Unlike our embedded videos, these load as soon as the page opens — the map is the point of the page, so there is nothing useful to show behind a play button.

That means CARTO receives your IP address and which part of the map you are looking at, under their own privacy terms. We do not send them anything else about you, and we do not ask them who you are. If you would rather not load the map at all, the same kits are listed in full underneath it, and that list needs no map imagery.

The map does not track or store your location. If you scan the QR code on a kit, or press the locate button, your browser asks your permission first and your position is used only to move the map on your own device — it is never sent to us or to CARTO.

Address suggestions. When you type a delivery or install address at checkout, or when you set where your kit is going on your account, we look it up with Google's address service so we can offer suggestions and get the postcode right. Your browser does not talk to Google directly: the text you have typed is sent to our own system first, which asks Google on our behalf. Google therefore sees the partial address and our server, not your IP address and nothing that identifies you. Suggestions are optional in every sense — you can ignore them and type the whole address yourself, and the form works exactly the same way.

Our forms are protected by Cloudflare Turnstile, which works out whether a submission is coming from a person or from a script. Without it the enquiry and kit report forms would be filled in automatically, thousands of times, by people with no interest in shark bite kits.

It runs when a form is on the screen. It looks at how the browser behaves rather than asking you to identify traffic lights, so usually you will not notice it at all. Cloudflare receives your IP address, your browser and operating system version, and signals about how the page was interacted with. It may set a cookie so that a browser which has already passed is not asked again.

Cloudflare is a processor for this purpose and does not use what it sees here to build a profile of you or to show you advertising. This one is not optional the way analytics is: declining cookies does not switch it off, because a form that cannot tell a person from a script cannot be left open on a public website. If that is a problem for you, email us at infobiteaid@gmail.com instead and we will take it from there.

We use a small number of providers to run the site:

• Amazon Web Services — hosting and server logs.
• Google — analytics, only with your consent; YouTube video playback, only when you press play; and address lookup at checkout and on your account when you set where a kit is going, which reaches Google through our own system rather than from your browser.
• CARTO — map imagery on the kit locations pages and on your account when you set where a kit is going, built on OpenStreetMap data.
• Cloudflare — the bot check on our forms. See Checking you are a person.

Your account and your orders are held in Mobiddiction, the same system that stores enquiries, which processes them on our behalf and stores them in Australia.

If you report a kit, the person who owns it is told — but not who you are. Whoever paid for a kit can see, in their account, that a problem was reported, what kind of problem it was, the date, and whether we have dealt with it. They cannot see what you wrote or your name, and there is no setting that would let them. Our staff can, because somebody has to read it to fix the kit.

We do not disclose your personal information to anyone else, except where we are required to by law.

Donations are handled entirely by GoFundMe on their own site under their own privacy policy. We never see your payment details — and nor does this site, which takes no card details at any point.

Emails you send us are kept for as long as we need them to deal with your enquiry and to keep a sensible record of the conversation, then deleted.

Orders are different. An order is a financial record and we are required to keep one, so deleting your account does not delete the orders you placed — it disconnects them from an account you can sign into. What stays is the order itself: what was bought, what it cost, where it went and how you asked it to be credited. Your name and email address stay on it too, because a receipt with no one on it is not a record of anything.

Server logs are kept for a short period for security and troubleshooting. Analytics data, if you allowed it, is retained under Google Analytics' own retention settings.

If you have an account you can change your details, change your password, and delete your account yourself — no email required, and it takes effect immediately. Orders you have already placed are kept, for the reason set out under how long we keep it.

You can also ask us to:

• tell you what personal information we hold about you;
• correct anything that is wrong; or
• delete what we hold, where we are not required to keep it.

Email infobiteaid@gmail.com and we will respond as quickly as we reasonably can. There is no charge.

If you are unhappy with how we have handled your information, tell us first so we have a chance to fix it. If that does not resolve it, you can complain to the Office of the Australian Information Commissioner.

This site is aimed at the general public and we do not knowingly collect information from children. If you believe a child has sent us personal information, email us and we will delete it.

We will update this page when the site changes — in particular if we start taking card payments on the site itself, which would involve a payment provider we would name here. The date at the top of this page always reflects the current version.

Questions about this policy, or about your information, go to infobiteaid@gmail.com.