Privacy Policy

Who is responsible

SurfScanners is run by Luke Smith, who is responsible for your personal data. You can reach us at [email protected] about anything in this policy.

What we collect

When you create an account:

• Your email address and password (the password is stored encrypted, we can never see it).
• If you sign in with Google: your name, email address and profile picture from your Google account. We don't get access to anything else in your Google account.

What you add to your profile and the community, all optional:

• Display name, username, home city, surf level, bio and profile photo.
• Trip posts, photos, comments, reactions, follows and private messages with other surfers.
• Spots you save to your profile and spots you suggest (with a name and email if you choose to give them).

Automatically, when you use the site:

• With analytics cookies on: usage and device data through Google Analytics: pages visited, approximate location (country/city), browser and device type.
• With analytics cookies on: performance and error data through Datadog, including session recordings of how pages are used. Everything typed into form fields (such as emails, passwords and messages) is masked and never recorded.
• Your approximate country, from your connection, to suggest English or Spanish on your first visit.

How we use it

• To run your account and the features you use: trip planning, your profile, community posts, messages and notifications.
• To show your public profile and posts to other surfers. Your display name, photo, city, surf level, bio and posts are visible to other users; your email address is not.
• To send account emails, such as email verification and password reset. We don't send marketing emails to users.
• To understand how the site is used and to find and fix problems.
• To keep the community safe, for example by filtering offensive language.

We rely on: performing our service for you (account and features), our legitimate interest in running and securing the site (safety, fixing problems), and, in Europe, your consent for analytics cookies (Google Analytics and Datadog).

Who we share it with

We use these service providers to run the site. They process data on our behalf and only for that purpose:

• Supabase: database, sign-in and photo storage.
• Fly.io: hosting the website.
• Cloudflare: network delivery and security.
• Google: Google sign-in (if you use it) and Google Analytics.
• Datadog: performance monitoring and session recordings.
• Resend: sending account emails.

Some of these providers may process data outside your country, including outside the European Economic Area. Where that happens, they use safeguards such as the European Commission's standard contractual clauses. We don't sell or rent your personal data to anyone, and we only disclose it otherwise if the law requires it.

Cookies and similar storage

• Sign-in cookies, to keep you logged in. These are needed for your account to work.
• A language cookie, to remember the language we suggested on your first visit.
• Your browser's local storage, to remember your language and units (ft or m).
• Google Analytics and Datadog cookies, to measure usage and performance. These are optional. If you're in the EU, EEA, UK or Switzerland, they only run if you accept them in the cookie banner. Elsewhere they're on by default, and you can turn them off.

You can change your choice at any time with "Cookie settings" at the bottom of every page, and clear or block cookies in your browser settings. If you block sign-in cookies, you won't be able to stay logged in.

How long we keep it

We keep your account data, profile and posts for as long as you have an account. You can delete your account at any time from your account page; this permanently deletes your profile, posts, photos, comments and messages. Analytics and monitoring data is kept for a limited time by Google and Datadog under their own retention settings.

Your rights

You can edit most of your profile, and delete your whole account, directly on your account page. You can also ask us to:

• Give you a copy of your personal data.
• Correct or delete it.
• Restrict or object to how we use it, or move it to another service.

Email [email protected] from the address on your account and we'll reply within one month. If you're unhappy with how we handle your data, you can also complain to your local data protection authority (in Spain, the Agencia Española de Protección de Datos).

Children

SurfScanners isn't meant for children under 14, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update it on this page and change the date below. For significant changes, we'll let account holders know.