Privacy Policy

In a Nutshell

We built this app to help you track your surf sessions and enjoy your time in the water. At the same time, we take your privacy seriously. To make the app work, we need to collect some data – but only what is necessary to provide the core features, such as tracking your sessions, recording your routes, and showing your performance statistics.

Here is the simple version:

• We collect basic account information such as your email address to create and manage your account
• During active sessions, we record GPS data to track your surf sessions and generate statistics such as routes, speed, and waves
• If you choose to share it, we process heart rate data throughout the whole session (and in particular during waves) to enhance your session insights
• We collect anonymous, pseudonymous usage statistics (e.g. which screens you open) to improve the app — never linked to your location or heart rate
• If you respond to an optional feedback prompt, we store your answer to understand your experience
• We do not track you when you are not actively recording a session
• We do not sell your personal data
• We only share data with trusted service providers required to operate the app

You are always in control:

• You can delete your data at any time
• You can decide when tracking starts and stops
• You can unsubscribe from emails whenever you want

Privacy policies are usually long and difficult to read. This section is our attempt to explain the essentials in plain and simple language.

In short: we handle your data with care, keep things minimal, and follow privacy laws such as the GDPR.

Happy surfing 🌊

1. Controller

The controller responsible for data processing under applicable data protection laws is:

Janis Kropp
Clemensstraße 119
80796 Munich
Germany
Email: surftrackerwatch@gmail.com

2. General Information

We take the protection of your personal data seriously. Your data is processed confidentially and in accordance with applicable data protection laws, especially the General Data Protection Regulation (GDPR).

3. Hosting & Database

We use Supabase to operate our backend infrastructure.

• Server location: Frankfurt, Germany (EU)
• Data is stored in encrypted form

Processed data may include:

• Name
• Email address
• Session and tracking data

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

4. User Account & Login

To use the app, you must create a user account.

Processed data:

• Email address
• Password (securely hashed)

Purpose:

• Provide app functionality
• Manage your account

You can delete your account at any time. All related personal data will be removed.

5. Tracking During Surf Sessions

GPS Data

During an active session, location data is recorded.

• Tracking occurs only while a session is active
• Routes are stored
• GPS data is used to generate heatmaps

Session Data

The following data may be collected during sessions:

• Session duration
• Number of waves surfed
• Maximum speed
• Movement data based on GPS

Heart Rate Data

• Heart rate is recorded continuously throughout an active session, including during surfed waves
• No heart rate data is recorded outside of an active session

These data are necessary to provide the core functionality of the app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

6. Device Permissions

The app requires access to the following device features:

• Location (GPS)
• Heart rate
• Motion sensors

Access is only used to provide app functionality and only with your permission.

7. Anonymous Usage Statistics

We record anonymous, aggregated usage events (for example: which screens are opened, when onboarding or sign-up is completed, when a first session is synced) to understand how the app is used and to improve it.

• Events are pseudonymous — tied to your account identifier or, before sign-in, to a randomly generated installation identifier
• Events contain no precise location, no heart-rate values, and no free-text content
• Stored in our own Supabase backend (EU region)
• Not shared with any third-party analytics provider

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app). You have the right to object to this processing at any time, free of charge — see section 13.

8. Feedback

The app occasionally shows short, optional feedback prompts (a thumbs up/down rating and, if you choose to add one, a free-text comment).

• Responding is always optional
• If you respond, your answer is stored linked to your account so we can read and act on it
• Dismissing a prompt is recorded only as a counter (so we don't ask again too often) and contains no personal content
• Not shared with any third party
• Permanently deleted when you delete your account

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the app experience).

9. Newsletter

We use Brevo for sending newsletters.

• Double opt-in is used
• Only email addresses are stored
• No tracking such as opens or clicks

Legal basis: Art. 6(1)(a) GDPR (consent)

You can unsubscribe from the newsletter at any time.

10. External APIs

We use an external weather and tide API to display relevant information. We use OpenStreetMap for map and location visualization

• No personal data is transmitted to this API

11. Data Sharing

We do not share personal data with third parties, except for service providers required to operate the app, such as hosting and email services. Anonymous usage statistics (section 7) are processed only in our own Supabase backend and are not shared with any third-party analytics provider.

12. Data Retention & Deletion

• Data is stored only as long as necessary for app usage
• Users can delete their data at any time via the "Account" section in the app
• Data may also be deleted periodically if no longer needed
• When you delete your account, any usage events previously linked to your account identifier are unlinked (the identifier is set to null) so they can no longer be attributed to you
• Feedback you submitted (section 8) is permanently deleted along with your account

13. Your Rights

You have the right to:

• Access your stored data
• Request correction of inaccurate data
• Request deletion of your data
• Restrict processing
• Data portability
• Object to the processing of anonymous usage statistics (section 7) at any time, free of charge, without deleting your account

You also have the right to lodge a complaint with a supervisory authority.

14. Target Audience

The app is intended for users aged 16 and older.

15. App Distribution

The app is available via the Google Play Store. Additional privacy terms from the app store provider may apply.

16. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect legal, technical, or operational changes to the app.

last updated: September 2026