plain English, no murky water

Joseph Carter is the data controller for Surfs Down. For privacy questions or requests, email surfs.down.dude@gmail.com or use the form at the bottom of this page

Account details: your email address, optional display name, authentication identity, account settings and 13+ confirmation

Home and paddle setup: the home-area label and precise latitude and longitude you select, favourite spots, watched days or windows, usual paddle times, caution preferences and onboarding choices

Support and feedback: support messages, feature suggestions and other feedback, including any message, optional name and reply email, source page, signed-in user ID where available and basic browser details used to investigate the issue. To prevent form abuse, a one-way keyed version of the requesting network address is kept briefly; the app does not store the original address in the support queue

Product analytics: only after you allow them, a random browser ID, session ID, user ID when signed in, pages viewed, app actions, referrer, device type, viewport width and limited event context. Email addresses, passwords, location coordinates and address fields are stripped from analytics properties

Public conditions data: forecasts, marine conditions, spot details and pollution or water-quality signals. This usually describes public places and conditions rather than you

We do not collect payment information, run advertising, sell personal information or track people across other companies' apps and websites

To provide the service: account, location and preference information lets us keep you signed in, show nearby spots, remember your setup and manage watched windows. Our lawful basis is performing the service you ask us to provide

To provide support and protect the app: support records and limited technical information help answer questions, investigate faults, prevent abuse and secure accounts. Our lawful basis is our legitimate interest in operating a reliable service and responding to users

To improve the product: product analytics helps us understand onboarding, forecasts and app journeys. Our lawful basis is consent, and analytics stays off until you choose to allow it

To meet legal duties: we may use or preserve information when reasonably required by law, regulation or a valid legal request

Supabase provides authentication and database storage, and Vercel hosts the web service

Resend sends metadata-only alerts when a support ticket arrives. The alert contains a ticket reference, time, source page and secure admin link, not your name, reply email or message body

Apple and Google process sign-in information when you choose their login options. Email/password sign-in remains available without those providers

Open-Meteo supplies forecast, marine and geocoding results. Location search words are sent to the geocoding service to return matching places. The Environment Agency and other named public sources may supply coastal, bathing-water or pollution information

Some providers may process information outside the UK. Where this happens, we use providers that offer contractual or other recognised safeguards for international transfers

We share personal information only with providers needed to run the service, when you direct us to, or when the law requires it

Account information and saved paddle preferences are kept while your account exists. Deleting your account removes the Supabase authentication account and user-owned app records, including saved home locations, favourite spots, watched items, preferences and user-linked analytics

Consent-based analytics events are deleted after 13 months. Declining or withdrawing analytics stops future collection and clears the analytics identifiers stored on that device

Resolved support records are normally deleted 12 months after resolution and no support record is kept for more than 24 months after submission unless it is needed for a documented security or legal reason

One-way support rate-limit keys are deleted after 24 hours

Public forecast, spot and source-run records may remain because they describe public conditions rather than an account. Short-lived provider logs are kept only for security and troubleshooting under the provider's configured retention

You can allow, decline or withdraw analytics from Stuff. The app works normally when analytics are off

You can update your home area, favourite spots and preferences in the app, or delete the whole account from Stuff

You may ask for access to your personal information, correction, deletion, restriction, objection or a portable copy where the right applies. You can also withdraw consent at any time without affecting processing that was lawful before withdrawal

Email surfs.down.dude@gmail.com to make a request. You can also complain to the Information Commissioner's Office

Surfs Down automatically combines forecast and water-quality information to produce paddle recommendations. These recommendations do not make legal or similarly significant decisions about you

They cannot guarantee conditions or safety, so check the actual sea, local signs, notices and your own ability before entering the water

Surfs Down accounts are for people aged 13 and over. We ask for a simple confirmation during account setup and do not collect your date of birth

If you believe someone under 13 has used the app or created an account, contact us so we can investigate and remove their personal information where appropriate

We will update this page when the app, its providers or its data use changes, and show the new date at the top