SurfsUp Privacy Policy

SurfsUp is offered only in the United States and is currently available to surfers on the U.S. West Coast. The App is not intended for, directed to, or offered to residents of the European Union, the European Economic Area, the United Kingdom, or any other jurisdiction outside the United States. By using the App, you represent that you are located in the United States.

You must be at least 18 years old to use SurfsUp. The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it. (See Section 9.)

2.1 Information you provide

• Profile information: your first name (display name), surf experience level, an optional short bio, and an optional profile photo.
• User-generated content: messages you post in surf-session chats, and the surf sessions you join (the beach, session time, and date).
• Reports you submit: if you report a user or message, we collect the report reason, any optional comment, and the content/account you reported.

2.2 Information collected automatically

• Account identifiers: when you sign in with Sign in with Apple or Google Sign-In, we receive an authentication identifier and, depending on your settings, your email address. We use Firebase Authentication (Google LLC) to manage your account.
• Device and technical data: device model, operating system version, app version, language, IP address, and similar diagnostic data, collected by our backend providers for security, fraud prevention, and app-integrity (App Check / App Attest).
• Crash and diagnostic data: crash logs and related diagnostics via Firebase Crashlytics, used to find and fix bugs.

2.3 Information we do not collect

• We do not collect your precise device geolocation. Beach locations shown in the App are fixed reference coordinates, not your location.
• We do not use advertising identifiers (IDFA) and we do not track you across other apps or websites.
• We do not knowingly sell or "share" your personal information for cross-context behavioral advertising (see Section 6).

In the 12 months preceding the effective date, we may collect the following CCPA categories:

We do not collect Social Security numbers, financial account numbers, payment card data, government IDs, or precise geolocation.

We use personal information to:

• Create and manage your account and profile;
• Operate core features — joining surf sessions, showing who's going, and enabling session chat;
• Display your first name and profile photo to other surfers in sessions and chats you participate in;
• Maintain safety and integrity, including processing reports, enabling blocking, and detecting abuse;
• Diagnose crashes, debug, and improve the App;
• Protect against fraud, unauthorized access, and security threats;
• Comply with legal obligations.

• To other users: your first name, profile photo, surf experience, bio, the sessions you join, and the messages you post are visible to other users in those sessions. Do not share information in chat you don't want others to see.
• We do not send your personal information to them.
• For legal reasons: to comply with law, enforce our terms, or protect the rights, safety, and property of SurfsUp, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not disclose your personal information to third parties for their own marketing purposes.

SurfsUp does not sell your personal information, and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" opt-out is required, but you may still contact us with any request.

If you are a California resident, you have the right to:

• Know / Access: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it.
• Delete: request deletion of personal information we have collected, subject to legal exceptions.
• Correct: request correction of inaccurate personal information.
• Opt out of sale/sharing: we do not sell or share personal information, but you may confirm this status.
• Limit use of sensitive personal information: we do not collect sensitive personal information as defined by the CPRA.
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

How to exercise your rights

• In-app deletion: you can delete your account at any time from Profile → Delete Account. This removes your profile and sign-in credentials and removes you from the sessions you joined.
• Requests by email: contact us at Surfsupdevs@gmail.com with the subject "California Privacy Request." We will verify your request using your account credentials and respond within the timeframes required by law (generally 45 days, extendable by an additional 45 days with notice).
• Authorized agents: you may use an authorized agent to submit a request; we may require proof of authorization and verification of your identity.

"Shine the Light" (Cal. Civ. Code § 1798.83)

California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information for third-party direct marketing.

We retain personal information for as long as your account is active or as needed to provide the App. When you delete your account, we delete your profile and remove you from active sessions. Please note:

• Messages you posted in session chats may remain visible to other participants associated with your display name after deletion;
• Residual copies may persist in backups, logs, or our providers' systems for a limited period before being overwritten or deleted;
• We may retain certain information as required to comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements (for example, abuse reports).

The App is intended for users 18 and older and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. For California residents under 16, we do not sell or share personal information. If you believe a child under 13 has provided us personal information, contact us at Surfsupdevs@gmail.com and we will delete it.

We use industry-standard safeguards, including encrypted connections (HTTPS/TLS), Firebase Authentication, Firebase Security Rules, and Firebase App Check / Apple App Attest to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The App relies on third-party services that have their own privacy practices.

Google / Firebase: Firebase Authentication, Firestore, Crashlytics, and App Check are provided by Google LLC. See Google's Privacy Policy.

We are not responsible for the privacy practices of these third parties.

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, provide additional notice. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at: