surfcal
← surfcal.app

Privacy Policy

Effective 24 June 2026 · Version 1.4

Short version: We collect your email to create your account, your chosen surf spots and skill level to personalise forecasts, and analytics data (including device identifiers) to improve the app. We don't collect your GPS location — you pick spots manually. We don't sell your data.

1. Who We Are

SurfCal is operated by Ariaxis Ventures, a business registered in Victoria, Australia (ABN: 17 684 317 477). When this policy refers to “SurfCal”, “we”, “us”, or “our”, it means Ariaxis Ventures.

Privacy contact: hello@surfcal.app
Postal: Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004, Australia

2. Scope

This policy applies to the SurfCal iOS and Android apps and the website at surfcal.app. It is incorporated by reference into our Terms of Service. The effective date and version number at the top of this page reflect the most recent revision.

3. Information We Collect

Account information

When you create an account we collect your email address. We use a one-time password (OTP) login — we never store a password on your behalf.

Profile and preferences

To personalise your forecasts we store your skill level (self-selected: Learning, Improver, Intermediate, Advanced, or Expert) and the surf spots you save to your watchlist.

Calendar access

If you grant calendar permission, the app writes surf sessions you save directly to your device calendar. Calendar data stays on your device — we do not receive, store, or transmit your calendar entries.

Analytics and usage data (mobile app)

We use PostHog to collect usage data in the SurfCal mobile app. This includes: screens visited, features used, session duration, app version, device type (iOS/Android), operating system version, IP address, and a persistent device identifier assigned by PostHog. This data is used to understand how the app is used, diagnose bugs, and improve the product.

Analytics data is associated with a PostHog-assigned identifier and is not directly linked to your name, but it may be linkable to your account in some circumstances (for example, if you sign in during the same session). We do not use this data to serve advertising.

In-app actions are also tracked as events. For example, when you use the Share feature, we record that a share occurred along with the spot name and session identifier — we do not receive any information about who you shared with or through which channel, as sharing is handled entirely by your device's operating system.

Website traffic (surfcal.app)

The surfcal.app website uses Cloudflare Web Analytics to measure traffic. Cloudflare Web Analytics operates at the network level — it does not use cookies, persistent identifiers, browser fingerprinting, or cross-site tracking. Data collected is limited to page views, approximate geography (country/region from IP address, which is not stored), referring site, and device type. No personal information is collected or transmitted to Cloudflare for this purpose.

Subscription information

Subscriptions are processed by Apple (App Store) or Google (Play Store). We use RevenueCat to manage subscription status. RevenueCat receives a device identifier and your subscription tier and renewal status. We do not receive or store your payment card details — those remain with Apple or Google.

Support communications

If you contact us by email, we retain that correspondence to respond to and resolve your query.

What we do not collect

We do not collect your GPS or precise physical location (surf spots are selected manually), photos, user-submitted reviews, voice data, biometric data, or any information about who you share content with or through which channel (sharing is handled by your device's operating system).

4. How We Use Your Information

  • Email — to authenticate your account via OTP and send service communications (e.g. account notices, material policy updates).
  • Skill level and saved spots — to deliver personalised, skill-aware surf forecasts for your chosen breaks, and to determine which spot announcements appear in your feed (no personal data is shared with sponsors to do this).
  • Analytics data — to understand feature usage, diagnose bugs, and improve the app and website.
  • Subscription status — to gate access to subscription features and manage renewals.
  • Support correspondence — to respond to your queries and maintain a record of support history.
  • Subscription and tax records — to meet our legal obligations under Australian tax law.

We will not use your information for any purpose materially different from those listed above without your consent.

5. Third-Party Services

We share data with the following third parties only to the extent necessary to operate the service:

  • Supabase (Oceania — Sydney, Australia) — database and authentication infrastructure. Stores your account data, saved spots, and skill level. Your account data is hosted in Australia and does not leave Australia.
  • Vercel (United States) — hosts the SurfCal website.
  • Cloudflare (United States) — CDN, security, and cookieless website traffic analytics. Cloudflare Web Analytics does not collect personal information.
  • PostHog (United States) — product analytics for the mobile app only.
  • RevenueCat (United States) — subscription management.
  • StormGlass (Sweden, European Union) — surf and ocean forecast data. We send surf spot coordinates (latitude and longitude of selected surf spots) to StormGlass to retrieve forecast data. No account information or personal identifiers are shared with StormGlass.
  • Apple / Google — app distribution and in-app payment processing. Subject to their own privacy policies.
  • Location & Break Sponsors — businesses that have entered into a sponsorship agreement with SurfCal and publish announcements via the SurfCal console. Sponsors are not data processors of your personal information. Sponsors have no access to your account details, email address, device identifiers, or any other personal information about you. Your saved spot selections determine which announcements appear in your feed; this matching is performed entirely within SurfCal's systems and no user data is passed to any Sponsor to enable it. SurfCal may have a commercial relationship with Sponsors, including receiving compensation for displaying their announcements.

We do not sell your personal information to any third party.

6. Cookies and Tracking Technologies

In the mobile app

The SurfCal mobile app uses the PostHog SDK, which assigns a persistent identifier stored in device secure storage. This identifier is used to track usage across sessions for analytics purposes. No advertising identifiers (IDFA/GAID) are accessed unless you have granted permission at the OS level.

On the surfcal.app website

The surfcal.app website does not use cookies, local storage, or persistent tracking technologies. Website traffic is measured using Cloudflare Web Analytics, which operates without cookies or identifiers of any kind. No consent banner is required and no cookie choices need to be made.

7. Overseas Data Transfers

Your account data is stored by Supabase in Sydney, Australia and does not leave Australia. However, some of our other service providers are based overseas:

  • United States — Vercel (website hosting), PostHog (mobile analytics), RevenueCat (subscription management), Cloudflare (CDN and website analytics).
  • Sweden (European Union) — StormGlass (surf forecast data; only surf spot coordinates are sent, no personal identifiers).

By using SurfCal, you acknowledge that some data may be processed by these overseas providers. We take reasonable steps to ensure they handle information consistently with the Australian Privacy Principles (APP 8) and seek to ensure appropriate contractual protections are in place with each provider.

8. Data Retention

  • Account and profile data — retained while your account is active, then deleted within 30 days of an account deletion request.
  • Analytics data — retained for up to 24 months before aggregation or deletion. Includes device identifiers held by PostHog.
  • Subscription and billing records — retained for 7 years to meet Australian tax record-keeping obligations. These records may be retained after account deletion.
  • Support emails — retained for 2 years after resolution.

9. Security

We use TLS encryption for all data in transit. Data stored with Supabase is encrypted at rest using industry-standard controls. Access to personal data is restricted to authorised personnel only. No system is completely secure; in the event of a notifiable data breach we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, as required by the Notifiable Data Breaches scheme under the Privacy Act 1988.

10. Your Rights and Account Deletion

Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the right to:

  • Access — request a copy of the personal information we hold about you. We will respond to substantive access requests within 30 days as required by APP 12.5.
  • Correction — request correction of inaccurate or out-of-date information.
  • Deletion — request deletion of your account and associated personal data (see below).
  • Withdraw consent — revoke calendar permission at any time via your device OS settings.
  • Objection — object to processing of your personal information where we rely on legitimate interests.
  • Complaints — if you believe we have breached the Australian Privacy Principles, you may lodge a complaint with the OAIC at oaic.gov.au.

EU and UK users have additional rights — see Section 13 (GDPR).

How to delete your account and data

You can delete your account directly from within the SurfCal app: go to Profile → Delete account. This removes your account and associated personal data. Billing records required for tax purposes are retained separately as required by law.

If you cannot access the app, email hello@surfcal.app with the subject “Account deletion request”. We will process your request within 30 days and confirm by reply.

Cancelling your subscription is separate from deleting your account. See subscription terms for how to cancel through Apple or Google.

11. Minimum Age

SurfCal is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at hello@surfcal.app and we will delete it promptly.

12. Automated Decision-Making

SurfCal uses your self-selected skill level and saved spot preferences to generate personalised forecast recommendations algorithmically. These recommendations are for informational and recreational planning purposes only — see our forecast disclaimer. These automated recommendations do not produce legal or similarly significant effects on you. In accordance with the Australian Privacy Principles (as amended, including anticipated December 2026 amendments), we disclose that your skill level and spot preferences are the personal information used as inputs to this system.

13. Additional Rights for EU and UK Users (GDPR)

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data. In addition to the rights in Section 10, you have the right to:

  • Portability — receive your personal data in a structured, machine-readable format and transfer it to another controller.
  • Restriction — request that we restrict processing of your data in certain circumstances.
  • Object to automated processing — object to decisions made about you by automated means.
  • Supervisory authority — lodge a complaint with your local EU data protection authority (e.g. the EDPB) or the UK ICO (ico.org.uk).

Legal bases for processing (GDPR)

  • Contractual necessity — processing your email, skill level, and saved spots is necessary to deliver the SurfCal service you signed up for.
  • Legitimate interests — analytics, security monitoring, bug diagnosis, and fraud prevention, balanced against your privacy interests.
  • Consent — any optional features you explicitly enable (such as calendar access).
  • Legal obligation — retaining billing records for tax compliance.

To exercise any GDPR rights, contact us at hello@surfcal.app. We will respond within 30 days. We do not currently have an appointed EU representative; if required by your local authority, contact us and we will designate one.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via in-app notification or email before taking effect. The effective date and version number at the top of this page reflects the most recent revision. Continued use of SurfCal after the effective date of a change constitutes acceptance of the updated policy.

15. Contact

For any privacy question, request, or complaint, contact us at:

Email: hello@surfcal.app
Post: Ariaxis Ventures, Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004, Australia

We aim to acknowledge all enquiries within 5 business days and resolve substantive requests within 30 days.