Privacy Policy

1. Introduction

Surf Crew ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Surf Crew mobile application ("the App").

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). By using the App, you consent to the practices described in this policy.

2. Information We Collect

Account Information

When you create a Surf Crew account, we collect:

• Email address
• Username
• Full name

User-Generated Content

When you submit surf reports through the App, we collect:

• Wave rating (Poor, Fair, Good, or Epic)
• Crowd level
• Wind conditions
• Wave size
• Optional text notes

Surf Spot Data

The App uses a curated list of surf spots. We do not track your GPS location or collect real-time location data from your device.

Content Moderation Data

If you report another user or block a user, we collect information related to that action to maintain the safety of our community.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Display surf reports to members of your crew
• Enable private crew functionality (invitations, membership)
• Moderate content and enforce our community standards
• Improve and maintain the App
• Communicate with you about your account or the App

4. Data Retention

We retain different types of data for different periods:

• Surf reports automatically expire and are deleted after 4 hours. This is a core feature of the App -- only fresh, current conditions are shown.
• Profile and crew data (your account information, crew memberships, and preferences) are retained for as long as your account remains active.
• Moderation data (reports and blocks) is retained as long as necessary to maintain community safety.

When you delete your account, all your personal data is removed in accordance with Section 8 below.

5. Disclosure of Your Information

We do not sell, rent, or trade your personal information to third parties. Your information may be shared in limited circumstances:

• Within your crew: Surf reports and your username are visible to other members of the crews you have joined. Crews are private and invite-only.
• Service providers: We use Supabase as our backend, authentication, and database provider. Supabase infrastructure is hosted on Amazon Web Services (AWS). Supabase processes your data on our behalf and is bound by contractual obligations to protect your information.
• Legal requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

6. Data Security

We take reasonable steps to protect your personal information from misuse, interference, and loss, as well as unauthorised access, modification, or disclosure. Measures include:

• All data transmitted between the App and our servers is encrypted using HTTPS/TLS
• Authentication is handled securely through Supabase Auth
• Access to personal data is restricted to authorised personnel only

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading
• Request deletion of your personal information
• Complain about a breach of the Australian Privacy Principles

To exercise any of these rights, please contact us at privacy@surfcrew.app. We will respond to your request within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

8. Account Deletion

You can request full deletion of your account and all associated personal data at any time by contacting us at privacy@surfcrew.app. Upon receiving your request, we will:

• Delete your account and profile information
• Remove you from all crews
• Delete any active surf reports you have submitted
• Remove your moderation history

Account deletion is permanent and cannot be reversed.

9. Third-Party Services

The App uses the following third-party service:

• Supabase: Provides backend infrastructure, user authentication, and database services. Supabase is hosted on Amazon Web Services (AWS). For more information, see Supabase's Privacy Policy.

We do not use third-party analytics, advertising, or tracking services.

10. Children's Privacy

Surf Crew is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at privacy@surfcrew.app.

11. International Data Transfers

Our service infrastructure (Supabase on AWS) may store and process your data in locations outside of Australia. Where your data is transferred overseas, we take reasonable steps to ensure that the overseas recipient handles your personal information in accordance with the Australian Privacy Principles.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App. We encourage you to review this policy periodically. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us: