Privacy

What we collect

Your email address. Needed to sign you in, with an emailed link or code.

What you put in your profile. Display name, username, and optionally a photo, short bio, home break, skill level, board quiver, stance, and favorite conditions. All optional except the name. Your name and photo are visible to other surfers; everything else follows your privacy setting (public, friends only, or private).

What you post. Reports, photos, video, chat messages, comments. Beach chat is public to anyone using the app. Your posts follow your privacy setting.

What you tap. Likes, follows, friend requests and friends, saved posts, saved spots, and anyone you block or mute.

Notifications. If you turn on notifications, we store a token from Apple (or your browser) that lets us send alerts to that device, and keep your notifications (friend requests, surf and hazard alerts, shark and closure reports) so you can see them in the app. Turn them off in Settings, or remove a device under Settings → Account → Connected devices.

Your settings. Units, timezone, alert heights, and your privacy, feed, and notification choices, so the app works the way you set it on every device.

Ordinary server logs. Our host records IP addresses and request times, as every web server does. We do not use these to build a profile of you.

What we deliberately don't collect

Your location, off your phone. The iPhone app can ask, once and only with your permission, to find the beach nearest to you. That calculation happens on your phone: your coordinates are never sent to us or stored. If you then save that beach as your home break, only the beach's name is saved. The website never asks for your location, and you can turn it off anytime in your phone's Settings.

Your password, in readable form. Passwords are optional. If you set one, our sign-in provider stores only a one-way hash of it, never the password itself.

Payment details. Nothing is for sale yet. If that changes, payment is handled by Apple or a payment processor and card numbers never reach us.

Advertising and tracking. No ad networks, no analytics trackers, no third-party cookies for advertising, and we do not sell or share your data with data brokers.

Who else sees it

We use a small number of services to run the app. They only get what they need to do their job.

Supabase stores accounts, posts, and uploads. Vercel hosts the site. Resend delivers your sign-in emails. All are in the United States.

Live cameras are embedded from their operators — YouTube for some spots, other camera hosts for others. When a page with a camera loads, that operator can see your IP address and may set their own cookies, under their privacy policy rather than ours. If you would rather not, avoid the spot pages that show a live camera.

Conditions data comes from NOAA, the National Data Buoy Center, and the National Weather Service. Nothing about you is sent to them.

Deleting your account

Open Settings → Account and tap Delete my account. That removes your profile, posts, chat messages, comments, and every photo and video you uploaded. It happens immediately and cannot be undone.

You do not have to email anyone or explain yourself. If the button fails, write to privacy@catchwaves.pro and we will do it by hand.

Your rights

You can download everything we hold about you from Settings → Account → Download my data. You can also ask us what we hold, correct it, or have it deleted. Depending on where you live — California, the UK, the EU and others — you may have a legal right to those things. We honour the requests regardless of where you live. Write to privacy@catchwaves.pro.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Other people's posts

Anything you post publicly can be seen, screenshotted, and remembered by other people. Deleting your account removes your content from Catch Waves; it cannot recall what someone else already saw or saved.

You can report any post, comment, chat message, or person, and mute or block a surfer from the ••• on their profile, message, or comment. If you hide your spot or session times, people who aren't your friends can't see which beach you posted from or when. Three reports hide something while it is reviewed. The rules for what can be posted are in our Terms of Use.

Children

Catch Waves is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has created an account, write to privacy@catchwaves.pro and we will remove it.

Safety

Conditions shown here come from offshore buoys and public forecasts. They can be wrong, delayed, or missing, and the ocean does not care what an app says. Never make a decision about paddling out based on this app alone.

Changes

If we change this policy we will update the date at the top. If the change is significant, we will say so in the app rather than hoping you re-read this page.

Contact

Questions about any of this: privacy@catchwaves.pro