Privacy Policy

Last updated: February 2026

At Surfast ("we," "us," or "our"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

1. Information We Collect

Location Data (GPS)

When you track a surf session, we collect your precise GPS location to record your paddle-out point, wave catches, and session path. This data is stored locally on your device and optionally synced to your account for analytics and sharing.

Sensor Data

Your device's accelerometer and gyroscope data are processed locally to detect paddle strokes and wave riding. This raw data is not stored or transmitted.

Account Information

When you sign in with Apple or Google, we receive your name, email, and authentication token. We also store your profile preferences (skill level, favorite spots, etc.).

Usage Data

We collect analytics on which features you use, error logs, and crash reports to improve the app. This data is anonymized and does not identify you personally.

2. How We Use Your Information

• To provide core features: session tracking, wave forecasting, and analytics
• To show personalized coaching tips based on your performance
• To calculate metrics like max speed, paddle efficiency, and calories burned
• To send optional push notifications about good surf conditions
• To improve app stability and user experience
• To comply with legal obligations

3. Data Storage & Security

Your session data is stored on your device via SQLite (AsyncStorage). When synced to cloud:

• Backend: Firebase/Google Cloud (encrypted at rest, SOC 2 compliant)
• Passwords: Managed entirely by Firebase Auth (never stored by us)
• Encryption: HTTPS in transit, AES-256 at rest

4. Data Sharing & Disclosure

We do not sell your data. We may share information with:

• Service Providers: Firebase (Google Cloud), Apple App Store (subscriptions), Sentry (error tracking)
• Legal Requests: If required by law, subpoena, or court order
• Your Consent: If you explicitly share your session to social media or invite friends

5. Your Rights & Choices

• Access: Request a copy of all your data via support@surfast.app
• Delete: Delete your account anytime (all data permanently erased)
• Permissions: Revoke location or notification permissions in your device settings
• Marketing: Opt out of promotional emails in account settings

6. Children's Privacy

Surfast is not intended for users under 13. We do not knowingly collect data from children. If we learn we've collected data from a child under 13, we will delete it immediately.

7. International Data Transfers

Your data may be processed in the United States (Google Cloud infrastructure). We comply with GDPR, CCPA, and other regulations regarding cross-border data transfer.

8. Changes to This Policy

We may update this policy. We'll notify you of material changes via the app or email.

9. Contact Us

Questions about this policy?

• Email: privacy@surfast.app
• Website: surfast.app
• Support: support@surfast.app