DRAFT: not legal advice; have it reviewed before publishing. (Remove this banner when the page is final.)
Privacy policy
This policy explains what personal data the SurfKit app ("SurfKit", "the app") collects, why, who receives it and what your rights are. Items marked TO CONFIRM or TO FILL IN are still to be checked before this page is published.
1. Who we are
SurfKit is run by Oliver Edwards, trading as SurfKit, 22 Lysia Street, London SW6 6NG, United Kingdom. Oliver Edwards, trading as SurfKit, is the data controller of your personal data. ICO registration number: TO FILL IN: ICO registration number. If the business is later run through a limited company, this policy will transfer to it and we will tell you.
Contact for privacy questions: SurfKit.hello@gmail.com (the address shown in the app). We will always reply within one month.
We apply UK data protection law (UK GDPR and the Data Protection Act 2018).
2. What we collect and why
| Data | When | Why |
|---|---|---|
| Account details: email address, and a name if you give one. With Sign in with Apple or Google Sign-In we receive the email and name those services share with us. Passwords for email accounts are handled by Firebase Authentication; we do not see them. | When you sign up or sign in. | To create and run your account. |
| Profile and app data: account type (surfer or shop owner), favourite shops, history, onboarding answers, surf journal entries, surfer roadmap progress, saved boards, your boards (quiver) and saved surf spots. Stored in Cloud Firestore. | When you use those features. | To provide the features and keep your data on your account. |
| Photos: photos you choose or take for your boards, your journal or your shop, and photos of documents for shop verification or claims. Stored in Firebase Storage. | Only when you add a photo. The app asks for camera and photo library permission when needed. | To show your content and to check shop ownership. Verification documents are only used by us for that check. |
| Shop listing details if you own or claim a shop: shop name, address, contact details, opening hours, photos, and your verification or claim request. | When you create, claim or edit a shop. | To publish the listing (shop listings are public to all app users) and to verify ownership. |
| Location (precise): from your phone's location service, only while the app is open (foreground). We do not collect location in the background. | When you allow location permission and use the map, nearby shops, or location-based AI tools. | To show nearby shops and surf breaks. See section 4 for when a location goes to the AI service. |
| AI requests: see section 4. | Only when you ask for an AI answer. | To give you board, surf spot and (with Pro) trip, coaching and packing advice. |
| Purchase information: your account ID, which products you have bought, and subscription status. We do not receive your card or Apple ID/Google account payment details. | When you view the Pro screen, buy, or restore purchases. | To give you SurfKit Pro and to check it on our server. |
| Crash reports: technical information when the app crashes (device model, OS version, app version, stack trace). Collected only in the released app. | When the app crashes. | To find and fix bugs. |
| Device integrity token (Firebase App Check: Play Integrity on Android; Apple DeviceCheck on iOS). | With requests to our Firebase services. | To block abuse of our back end by anything other than the real app. |
| Daily AI usage counter against your account ID. | When you use AI tools. | To apply the free allowance and fair-use daily limits. |
| Requests you send us: for example shop hire or lesson requests, partner discount uses, and emails to support. | When you use those features. | To handle the request. |
What we do not do. We found no advertising, analytics or tracking tools in the app: no Firebase Analytics, no ad SDKs, and no tracking across other companies' apps or websites. We do not sell your data. The app does not collect a push notification token. The app does not use the microphone. TO CONFIRM: re-check this list against the final release build.
3. Legal bases (UK GDPR)
- Contract: running your account, journal, roadmap, saved items, shop listings, purchases and AI features you ask for.
- Consent: location, camera and photo access (you can withdraw it in your phone's settings at any time).
- Legitimate interests: crash reports, App Check, usage limits and security, fixing bugs and preventing abuse.
- Legal obligation: keeping records we must keep, if any (for example tax records for payments, which are held by Apple, Google and RevenueCat).
4. AI features and what is sent to OpenAI
Board AI, Surf Spots AI and the SurfKit Pro tools (trip planner, surf coach chat, packing list, arrival brief, roadmap tips) run through our own server (a Firebase Cloud Function in the europe-west1 region), which sends a request to OpenAI to produce the answer. Nothing is sent unless you ask for an AI answer. You must be signed in to use them. What is sent depends on the tool:
- Board AI: age, height, weight, the wave size you want to ride, your surf ability and your general athletic ability.
- Surf Spots AI: the place you typed and, if you allow it, your location as latitude and longitude rounded to four decimal places (both go into the request as text; if you only typed a place, our server matches it against its own list of surf places and sends those coordinates; it does not use a mapping service), your surfing level, and the current month. Nearby surf breaks from our own list are added to the request.
- Trip planner, packing list and arrival brief (Pro): destination or location, number of days, month or dates, first names or nicknames of people in your group (up to 20 characters each), where you are staying, optional notes you type (up to 300 characters), and choices such as wetsuit hire or bringing boards. Nearby verified shops from our database are added.
- Surf coach chat (Pro): the messages you type, plus context from your account: your surf ability, roadmap stage, weight, your boards (quiver), your recent journal sessions and your current trip destination and dates if you set one.
- Roadmap tips (Pro): your ticked roadmap skills, a summary of your journal (number of sessions, average waves caught, most common spot, and a short text up to 500 characters), your weight and your language.
We do not send your name, email address or account ID to OpenAI. Do not type personal details such as full names, addresses or health information into free-text boxes or the coach chat. The models used at the time of writing are OpenAI's gpt-4o (Board AI and Surf Spots AI), gpt-4.1 (trip planner) and gpt-4.1-mini (surf coach chat, packing list, arrival brief and roadmap tips). We do not keep your AI questions or answers on our server after the answer is returned, unless you save the result (for example a trip plan). Under OpenAI's API terms, data sent through the API is not used to train its models by default, and OpenAI may keep it for a limited period (currently up to 30 days) to check for abuse. TO CONFIRM: re-check OpenAI's current API data terms before publishing.
AI answers are generated automatically and can be wrong. See the terms of use.
5. Who we share data with (our service providers)
| Provider | What for | Data |
|---|---|---|
| Google (Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check, Crashlytics) | Accounts, database, files, our server, abuse protection, crash reports. | Everything in section 2 except purchases held by RevenueCat. |
| Google (Sign-In, Maps, geocoding) | Google Sign-In; maps in the app; turning addresses into map positions. | Your Google identity if you use Google Sign-In; map and address look-ups, As with any map service, Google receives your device's network (IP) address and the map area being loaded. |
| Apple (Sign in with Apple) | Sign-in. | Your Apple ID sign-in result, including a private relay email if you choose to hide yours. |
| OpenAI | AI answers. | See section 4. |
| RevenueCat | Managing SurfKit Pro purchases and checking whether you have Pro. | Your account ID, purchase and subscription status, device and store information needed to validate purchases. |
| Apple App Store / Google Play | Taking payment and managing subscriptions. | They hold your payment details; we do not. |
These providers act for us under their own terms and privacy policies. We do not sell personal data and we do not share it for advertising. We may disclose data if the law requires it, or to protect someone's safety.
Their privacy policies: Firebase, Google, Apple, OpenAI and RevenueCat.
6. Public information
Shop listings (name, address, contact details, opening hours, photos, tags) are visible to all users of the app. Your account, journal, roadmap, saved boards and quiver are private to your account. No feature in the app shows your journal, roadmap or boards to other users, and our database rules only let you read your own account data.
7. Where shop information comes from
Shop information comes from the shops' own websites, shop owners and Overture Maps Foundation data (CDLA-Permissive-2.0). Shop details never come from OpenStreetMap. Surf break information uses data © OpenStreetMap contributors (ODbL) and Wikidata (CC0). Offline maps use data © OpenStreetMap contributors (ODbL), with tiles by Protomaps. This is business and place information, not information about app users. The same credits are shown in the app.
8. Storage on your phone
The app stores some data on your device only: preferences (such as your language, onboarding progress and free AI tries counters), and a copy of shop information and, if you download them, offline map regions so the app works with a poor connection. This data stays on your phone and is removed when you delete the app or clear its data. Offline map regions are a SurfKit Pro feature; when you download one, the file comes from our storage server (Firebase Storage).
9. How long we keep data
- Account data, journal, roadmap, saved items, photos and shop listings you own: until you delete your account. See how to delete your account.
- Crash reports: up to 90 days (the Firebase Crashlytics standard period). We do not attach your account ID, name or email to them; Crashlytics adds a random identifier for the app installation.
- Server logs (from our Cloud Functions): up to 30 days (the Google Cloud standard period).
- AI questions and answers: not kept on our server after the answer is returned, unless you save the result. The daily AI usage counter is kept until you delete your account.
- Backups: we take a backup of our database before major changes, for safety. Deleted data can remain in a backup until that backup is deleted, after at most 90 days.
- Purchase records: Apple and Google keep their own purchase and tax records under their own rules. RevenueCat keeps a record of your purchases linked to your account ID. It is not deleted automatically when you delete your account; email us and we will ask RevenueCat to delete it.
- Support emails: kept for 12 months after our last reply, then deleted.
10. Deleting your account
You can delete your account in the app (Account tab, then Delete Account) or by emailing us. Deleting your account removes your profile, journal, roadmap, saved boards, quiver, saved spots, uploaded photos and documents, shop verification and claim requests, partner and rental requests, AI usage record, and any shop listings you own (including their boards and photos), and then the sign-in account itself. Full details are on the delete your account page.
11. International transfers
Our Firebase back end runs in Google Cloud. The database (Cloud Firestore) is in the EU (Google's eur3 multi-region), our server (Cloud Functions) is in Belgium (europe-west1), and photos and files (Cloud Storage) are in the United States (us-central1). Google, OpenAI, RevenueCat and Apple may also process data in the United States and other countries outside the UK. Where they do, we rely on the UK-US Data Bridge (for providers certified under it), or on the UK International Data Transfer Addendum or Agreement in their data processing terms, which require protection equivalent to UK law. Ask us for details.
12. Security
Traffic between the app and our services uses HTTPS. Access to your data is limited by Firebase security rules so that you can read and change your own account data. Our AI endpoint requires you to be signed in, and the app uses App Check to help block abuse. No system is perfectly secure.
13. Children
SurfKit is not for children under 13, and you must be 13 or over to create an account. The app does not ask for your age; we rely on the age rating in the App Store and Google Play. If we learn that someone under 13 has an account, we will delete it. If you are a parent or carer and think your child has signed up, contact SurfKit.hello@gmail.com.
For users aged 13 to 17 we follow the ICO's Age Appropriate Design Code. SurfKit has no public profiles, messaging or social features, collects location only while the app is open, and uses no advertising or tracking. Note that the Board AI form accepts ages from 5 to 100, so a parent can ask for board advice for a child; the age is used only for that answer.
14. Your rights
Under UK GDPR you have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to some processing; data portability; and withdraw consent. You can erase most of your data yourself in the app. For anything else, email SurfKit.hello@gmail.com. We aim to reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first. If you live in the EU or elsewhere you may have similar rights. TO CONFIRM: EU representative needed or not.
15. Changes
If we change this policy we will update the effective date above and, for significant changes, tell you in the app.
16. Contact
Oliver Edwards, trading as SurfKit
22 Lysia Street, London SW6 6NG, United Kingdom
SurfKit.hello@gmail.com