This page says what Surf Spoting does with your data, in plain words. Surf Spoting is run by the person who runs surfspoting.com, based in Portugal, who decides why and how your data is used (the “controller” in data protection law, GDPR). Last updated 2026-10-18.
The short version
You can use the forecasts, guides, maps and learning pages without an account, and we do not use cookies or advertising trackers.
With an account we keep what you add (sessions, favourites, alerts, plans) so the app can work for you. Nobody else sees it unless you share it.
We do not sell data, show ads or share it with advertisers.
You can download everything we hold about you and delete your account yourself, in your profile. Deleting is immediate and complete.
What we collect, and why
Account: your email address and a password (stored as a one-way hash, we cannot read it). Why: to sign you in and to email you the confirmation. Basis: the contract between us (you asked for an account).
What you save: sessions (spot, time, how it was, notes, the conditions at that time, optionally a GPS track or where you started), favourites, alerts, your own spots, preferences, where you surf, the board finder answers. Why: these are the features. Basis: contract.
Emails you switch on: forecast alerts, the Monday email, “forecast improved” heads-ups, plan and contest emails. They are off until you turn them on in your profile, and each can be turned off again there. Basis: your consent.
Surf buddies: the first name and email address of friends you add. Only you see this list. We do not email them. If a buddy has an account, they can see the sessions you tag them in (place, time, who else was there), nothing else. Please only add people who are happy to be added.
Teams and surf plans: your team nickname, what you choose to share with the team, the messages you write in a plan, and, if you tap the button, your live position and the meeting points you set. Live positions disappear after 15 minutes, and are deleted from the server after at most 3 hours. Basis: contract, and consent for the location.
Feedback: what you write, the page and device type (phone or computer, language, time zone), and, only if you choose to add them, a photo and your approximate location (rounded to about 100 m). Signed-in members’ feedback is linked to their account; visitors’ is not.
Visit statistics: our own server counts visits without cookies. A visit is a daily changing code made from your address and browser, so we can count visitors without recognising anyone from day to day. We see the country of your address (looked up on our server, not by an outside company) and the type of device.
Server logs: the web server keeps the address, time, page and browser of each request for 14 days, to keep the service secure and working, then deletes them. Basis: our legitimate interest in security and running the service.
Your location, if you allow it: used in your browser to show what is near you. It is not sent to us unless you start a session or share it in a plan.
How long we keep it
Your account and what you saved: until you delete the account.
Plans and their chats, meeting points: 60 days after the day of the plan, or sooner if the host deletes the plan.
Live positions: 15 minutes on screen, deleted within 3 hours.
Feedback and its photo: 12 months.
Sign-ups that never confirm the email address: 7 days.
Server logs: 14 days. Visit statistics: 30 days, as counts.
After you delete your account, backups held by our database provider rotate out within about 30 days.
Who else handles your data
These companies process data for us, under their data protection terms. We choose servers in the European Union.
Supabase (database and sign-in), a US company; our project runs on servers in Ireland (AWS eu-west-1).
Resend, a US company that sends our emails, through Amazon SES in Ireland. They see your email address and the message.
Our own server (web hosting, forecasts, satellite and webcam pictures), in France.
Map pictures: when you open a map, your browser fetches tiles directly from OpenStreetMap (OpenStreetMap Foundation, United Kingdom) or, for the satellite view, from Esri (United States). They see your IP address and which area you look at, as any website does. We set no cookies there. In Lite mode the map loads only when you tap it.
We use Open-Meteo data for forecasts, from our own copy of it: your data is not sent there.
If a provider is outside the EU, it is covered by the EU’s standard contractual clauses or an adequacy decision.
Cookies and what is stored on your device
We set no cookies. The app stores small things in your browser so it works: your sign-in, your chosen country and filters, the last forecast (so it opens offline), your answers in the board finder, whether you hid a banner. This is strictly needed for the features you use, so no consent banner is required. Clearing the site’s data in your browser removes all of it.
Your rights
See and take your data: Profile → Your data → Download my data (a JSON file of everything we hold).
Correct it: change your sessions, spots, preferences and profile in the app. For anything else, ask us.
Delete it: Profile → Your data → Delete my account. Everything linked to you goes at once: sessions, favourites, alerts, buddies, teams and plans you own, your messages, and the feedback you sent loses your name and address and its photo is removed.
Object, restrict, or withdraw consent: turn off emails and sharing in your profile, or ask us.
Complain: to the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or the data protection authority where you live.
Use the “Privacy request” button in the app (the round button at the bottom right, then Privacy request) for anything the profile cannot do. We answer within a month.
Children
Surf Spoting is for people aged 16 and over. If you are younger, please ask a parent or guardian to use it with you. We do not knowingly collect data from children, and will delete it if we find out.
Security
Everything is sent over HTTPS. Each account can only read its own rows (row level security in the database). Passwords are hashed. Photos are in a private store. No system is perfectly secure: tell us if you find a problem.
Changes
If we change what we collect or why, we update this page and its date, and tell signed-in users when the change matters to them.