Barefoot Central is built for the community of Kenton-on-Sea, Bushmans, Boknes and Cannon Rocks. We hold ourselves to South Africa's Protection of Personal Information Act (POPIA). This page tells you what personal information we collect, why, how we store it, and what you can do about it.
1. What we collect
For the Tier-0 (no-signup) web surface — the one you're probably on right now — we collect nothing about you personally. Anonymous analytics (page views, search queries, click-throughs) flow to PostHog on its EU instance so they stay within POPIA-friendly jurisdiction.
When you sign in (Sprint 1.5+) we collect:
- Your phone number or email address (for sign-in)
- The display name you choose
- The suburb you tell us you're in
- Any property, business or event you create or claim
- Photos and videos you upload
- Location data, only when you actively request a “near me” feature
- Trust-tier signals (vouches, account age, verification records)
2. Why we collect it
- Sign-in — to authenticate you and link your activity to your account.
- Display name + suburb — so other community members know who they're talking to.
- Properties / businesses / events — to render the listings you create.
- Photos & videos — to show alongside your content.
- Location — only to rank “near me” results; not stored long-term.
- Trust tier — to gate moderation actions and prevent abuse.
3. How we store it
All personal information lives in our Supabase database, hosted in the European Union region. Sensitive fields (phone numbers, ID documents) are restricted by Postgres row-level security and column-level grants; ordinary members of the community cannot read them. ID images and rates-account documents are encrypted at rest.
Phone numbers are never returned to other users via the API. In-app messaging uses internal user IDs only.
4. Who we share it with
We do not sell your personal information. Period.
Third parties receive only the minimum needed for the function they perform on our behalf:
- OpenWeatherMap, WorldTides.info — coordinates only, never your identity.
- PostHog (EU) — anonymous analytics events.
- Sentry (EU) — anonymised error reports.
- Twilio — phone number only, for sign-in OTPs (once Sprint 1.5 lands).
- PayFast — payment details only, for transactions you initiate (Phase 3).
- BRAG and the Tourism Office — anonymised aggregate counts per suburb, never named users.
- Service providers — only the property and contact details needed for the job you ask them to do.
5. Your rights
You can, at any time:
- Access — download a complete export of your data as JSON plus your uploaded media.
- Rectify — edit anything you've provided (audit-relevant records stay append-only).
- Delete — close your account; we'll soft-delete your posts and comments (redacted to “[deleted user]”), hard-delete your personal data, transfer property manuals to a co-owner if any, and preserve bookings for the counterparty's record.
- Restrict — opt out of specific processing (notifications, location-based features).
- Object — withdraw consent for any specific processing at any time.
You can run access and deletion yourself, today, from your profile:
- Open your profile → “Your data” → Download my data streams a complete JSON export.
- Same panel → Delete my account closes the account, redacts your reviews, releases any business listings you claimed, and hard-deletes your personal data.
For anything else, email privacy@barefootcentral.co.za and we'll respond within 7 working days.
6. Retention
- Inactive accounts: you'll get a prompt at 18 months and we'll delete the account at 24 months unless you re-engage.
- Audit logs: 5 years.
- Payment records: 7 years (SARS).
- Verification documents: deleted 30 days after we've confirmed your tier.
- Booking records: 3 years.
7. Children
Barefoot Central is intended for adults (18+). We do not knowingly collect data from under-18s. If a guardian creates an account for a minor, the guardian is the responsible party.
8. Cookies + similar tech
We use a small number of strictly-necessary cookies for sign-in and session continuity, and we use localStorage for keeping your recent searches on your device only. Analytics are first-party; we do not use third-party ad cookies.
9. Changes to this notice
If we materially change how we handle personal information, we'll flag it in-app and email signed-in users at least 14 days before the change takes effect.
10. Contact
Barefoot Central is run by the Kenton-on-Sea community council in partnership with the Tourism Office. Reach us at hello@barefootcentral.co.za for any general enquiry or privacy@barefootcentral.co.za for privacy specifically.
You can also lodge a complaint with the South African Information Regulator at inforegulator.org.za.