BommieSurf

Privacy Policy

Version 2.1 · Effective 16 October 2026 · Bluegrass Pastoral Pty Ltd ACN 699 118 226 (ABN 27 699 118 226)

1. Overview

(a) Bluegrass Pastoral Pty Ltd (ACN 699 118 226) trading as BommieSurf (Bluegrass, we, our and/or us) provides a personalised surf forecasting app to individuals (Services) through the BommieSurf website, web application and mobile applications (together, BommieSurf). References in this Policy to the Business are to our BommieSurf business, and not to any other business carried on by us.

(b) We handle Personal Information in line with the Australian Privacy Principles, which are set out in the Privacy Act 1988 (Cth) (Privacy Act), and we take reasonable steps to protect the privacy of individuals (you, your and/or yourself) while providing Services, in connection with BommieSurf and otherwise in relation to the operation of our business.

(c) This Policy contains information about:

  • (i) how we collect, store and use Personal Information;
  • (ii) how long we keep Personal Information;
  • (iii) how you may access your Personal Information held by us;
  • (iv) how to seek the correction of your Personal Information held by us; and
  • (v) how to make complaints about any privacy-related concerns.

(d) If we change this Policy, we will display the updated Policy on our website and in BommieSurf, and we may also advise you in writing. If you object to any changes, you may contact us, and we will attempt to resolve your complaint within a reasonable time.

(e) By using our Services or BommieSurf or otherwise supplying us your Personal Information, you consent to our collection, use, disclosure, storage, destruction and otherwise handling of Personal Information, in accordance with the terms of this Policy.

(f) If you provide a pseudonym to us or wish to remain anonymous, you can browse and view the public pages of BommieSurf without restrictions; however, you cannot create an account or use the application without providing the Personal Information described in section 3.

(g) We do not sell your Personal Information, and we do not sell, publish or share your saved breaks.

2. How do we collect your Personal Information?

We may collect Personal Information through the following avenues:

(a) where you create an account, including where you do so using a third-party sign in service such as Google or Apple;

(b) where you save a break, set or change your preferences, alert settings or app settings;

(c) where you allow BommieSurf to send you notifications, in which case your device provides a notification token (see section 3(b)(v));

(d) where you start a Free Trial or take out a Subscription, in which case the Store tells us, through RevenueCat, the status of your Subscription;

(e) where you have inquired or otherwise communicated with us, including by email;

(f) where you are interacting with BommieSurf, through server logs and the use of cookies and browser storage (see section 11); and

(g) where you use a third-party sign in service, from that service (see section 4(f)).

3. What Personal Information do we collect?

(a) The kinds of Personal Information we may collect from you will depend on who you are (e.g. a current, former or prospective user, a supplier, or a prospective employee or contractor) and the nature of your interaction with us.

(b) We collect, use and store the following types of Personal Information about current, former and prospective users:

  • (i) Account and sign in information: email address and password, which is stored only as a secure hash, held by our authentication provider Supabase, and never in a readable form. Where you sign in using Google or Apple, we receive the name, email address (which, for Apple, may be a private relay address) and profile picture link held by that account, and a link to it. We do not receive your Google or Apple password.
  • (ii) Breaks and preferences: the name and map coordinates of each break you save, and the preferences you set for it, including swell size and direction, wind directions, tolerance and maximum strength, tide stage, flow and window, tide station and offset, and alert settings and thresholds. Because a break is a location, your saved breaks show the places you surf.
  • (iii) App settings: the display settings you choose, such as units and theme, your device's time zone, and when and on which platform (web, Android or iOS) you last used BommieSurf.
  • (iv) Location: we do not track your device's location. When you open the map to place a break, BommieSurf asks your device for its current location to centre the map. That location is used on your device and is not stored by us, other than as the coordinates of any break you then save.
  • (v) Notifications and alerts: your alert settings and, where you allow notifications, your device's notification token and platform (Android or iOS), and a record of the alerts sent to you (the break and its name, the session window, score, type of alert and time sent), which is shown to you as your alert history.
  • (vi) Plan and subscription information: whether your account is on the free plan, a Free Trial or a Subscription, the Free Trial dates, and the subscription status and references reported to us by the Store through RevenueCat, which knows you only by your BommieSurf account ID. We do not see, handle or store your card number or security code.
  • (vii) Contact and support information: your name, email address, and the content of your message.
  • (viii) Technical information: standard server logs, including your IP address, browser or device type and the pages or services you access, which may also include your account ID and the coordinates of your breaks, together with sign in times and account status, which we use to operate the Services. We count forecast and tide requests in total, not per person, to manage their cost.
  • (ix) Install ID: a random identifier that BommieSurf creates the first time it runs on a device. On iOS it is kept in the device's Keychain, so it survives the app being deleted and reinstalled; on Android and on the web it lasts until the app's or the website's data is cleared. We use it only to stop a Free Trial being claimed more than once on the same device.
  • (x) Free Trial record: to stop the same person claiming a Free Trial more than once, we keep a one-way marker derived from your email address (a hash of it), a one-way marker derived from your Store purchase (added only if you take out a Subscription), the install ID of the device on which the Free Trial was first used, which Store you used, the Free Trial dates, the date you first paid (if you did), and a short note where a Free Trial was ended early because it used a disposable email address or a device that had already had one. The markers cannot be reversed to reveal your email address or Store account, and cannot be used to contact you, although we can tell whether an email address given to us later matches the marker. This record is retained after account deletion (see section 6(i)).

(c) We also collect, use and store:

  • (i) for current, former, and prospective suppliers: contact details, details about representatives, business information such as banking details, pricing and payment details, and other Personal Information that you may voluntarily provide to assist us to engage in a business relationship with you;
  • (ii) for prospective employees or contractors: contact details, dates of birth, titles and qualifications, photographs, voice and video recordings, background and reference information, and other Personal Information relevant to employment considerations;
  • (iii) information about our staff and representatives as required in the normal course of human resource management and business operations; and
  • (iv) other Personal Information that you may voluntarily provide to us to assist us to conduct our Business and provide our Services.

(d) We do not ask for, and BommieSurf is not designed to collect, sensitive information as defined in the Privacy Act. We will only collect sensitive information with your consent and through secure methods.

4. What do we do with your Personal Information?

(a) We will not sell or trade your Personal Information to any third party, organisation or individual without your consent, except as part of a transfer of our business described in section 13.

(b) Subject to the terms of this Privacy Policy, we may use and disclose your Personal Information for the following purposes:

  • (i) to create and operate your account and allow you to sign in;
  • (ii) to store and display your breaks and preferences, and allow you to edit and delete them;
  • (iii) to request forecasts and tide predictions for the coordinates of your breaks, and to score each hour against your preferences;
  • (iv) to send the surf alerts you have turned on, and to show you your alert history;
  • (v) to administer your plan, Free Trial and Subscription, and to prevent a Free Trial being claimed more than once;
  • (vi) to send account emails, including sign up confirmation and password resets;
  • (vii) to contact you in connection with the Services, to respond to feedback and complaints, and to provide support, which may include accessing your account as described in section 5(b)(vii);
  • (viii) to keep the Services and BommieSurf operating, secure and free from misuse;
  • (ix) for direct marketing purposes with your consent (see section 9 below);
  • (x) to notify you of important changes to BommieSurf or this Policy;
  • (xi) to understand usage trends and patterns, using totals and patterns that do not identify any individual, so we can improve the Services; and
  • (xii) for any other purpose for which you give your consent.

(c) Subject to the terms of this Privacy Policy, we may also disclose your Personal Information:

  • (i) to third parties used by us to assist us to provide you with our Services, including our contractors, bookkeepers and professional advisors;
  • (ii) to technology and hosting providers and technology service providers, notification services, email delivery providers and subscription management providers, who may store or process data on our behalf. The providers we currently use are named in section 7, and what each receives is described in sections 4(e) and 4(g);
  • (iii) to lessen or prevent serious threats to the health and safety of an individual or the general public;
  • (iv) to assist in locating missing individuals;
  • (v) to any duly authorised law enforcement officer, or any other person, authorised by any law to receive your Personal Information from us; and
  • (vi) where otherwise permitted or required by law.

(d) We will not disclose sensitive information to any third party unless we have your consent or are otherwise permitted or required by law to do so.

(e) For clarity, forecast and tide requests are made by our servers, not by your device. When we request a forecast or tide prediction, we send our forecast providers, Open-Meteo and WorldTides, the coordinates of a break and the time range requested, and nothing else. When you search for a place, we send Open-Meteo the text you typed, and nothing else. We do not send them your name, email address, account identifier, device identifier or IP address. We do not publish your breaks, add them to a public or shared spot list, or show them to other users.

(f) Google user data. Where you sign in with Google, we request only the basic profile scope needed to create and identify your account. We use the information Google provides solely to create, identify and secure your BommieSurf account, and we handle it as any other account information under this Policy. We do not request or receive access to your Google contacts, calendar, Drive files, photos or any other Google service data, we do not use Google user data for advertising, and we do not transfer it to others except as needed to provide the Services or as required by law. You can revoke BommieSurf's access at any time from your Google Account permissions page; doing so does not delete your BommieSurf account (see section 6(b)).

(g) Our other providers receive only what they need:

  • (i) Google Firebase Cloud Messaging and Apple Push Notification service receive your device's notification token and the content of each alert, which includes break names, session times and scores;
  • (ii) RevenueCat receives your BommieSurf account ID and the purchase information the Store provides about your Subscription. It does not receive your email address;
  • (iii) the map tile providers, OpenStreetMap, Esri and OpenTopoMap, receive your IP address and the area of the map you view, because your device downloads the map images directly from them;
  • (iv) Resend, which sends our sign-in and account emails, receives your email address to send you sign-in codes, confirmations and password resets;
  • (v) VentraIP, which hosts our support mailbox, handles the emails you send us; and
  • (vi) Supabase, which holds our database and runs sign in, and Vercel, which hosts BommieSurf, process your information on servers in Sydney (see section 7(b)).

5. How do we hold your electronic information?

(a) Where we hold your Personal Information, we will hold it by storing it electronically, by exporting it onto a computer or in hard copy.

(b) We take reasonable steps to protect your Personal Information from misuse, interference and loss, as well as unauthorised access, modification or disclosure, through the use of secure systems, restricted access, encryption and other safeguards appropriate to the nature of the information. Those steps include:

  • (i) encryption of all data transmitted between your device and the Services using TLS;
  • (ii) row level security on the database, so that your breaks, preferences and alert history can be read only by your account;
  • (iii) hashing of passwords, which are never stored in a readable form;
  • (iv) authenticated sessions with short lived tokens for access to the interface behind the application;
  • (v) restriction of administrative database access to server side functions;
  • (vi) encryption of data at rest by our database provider; and
  • (vii) restriction of internal access to user accounts to authorised people within our business. They access an account only to provide support, to review or adjust the account's plan or Free Trial status, to investigate a problem, to maintain the database, or where required by law, and only as far as that purpose needs. We keep a record of the actions taken in our admin panel, including viewing or searching for an account and each change we make to an account's plan, Free Trial status or settings. We do not edit your breaks or preferences.

6. How long do we keep your Personal Information?

(a) We keep your account details, breaks, preferences and alert history for as long as your account remains open.

(b) You may delete your account at any time, from Settings in the app or by emailing us from the address at which your account is registered. Deletion is permanent and removes your login, profile, breaks, preferences, alert settings, alert history and notification tokens. When you delete your account, we also ask RevenueCat to delete its record of you. Deleting your account does not cancel a Subscription, which you must cancel with the Store.

(c) Deletion inside the app takes effect immediately. A deletion request sent by email is actioned within seven days of the request being verified.

(d) After deletion, Personal Information may remain in routine backups, which are kept for a limited period, up to 30 days, until those backups roll over.

(e) The Store keeps its own customer and payment records, and we retain payment and taxation records for the period required by law, generally seven years.

(f) We retain support emails for up to two years after our last contact with you, unless a longer period is required for a legal reason.

(g) We keep server logs for a limited period, typically no more than 30 days.

(h) The record described in section 5(b)(vii) of actions taken in our admin panel is retained after account deletion. It identifies the account by its account ID and records the action taken, and the admin log may contain an email address an administrator searched for. It does not contain your breaks or preferences, and we keep it for as long as we need it to show what support actions were taken. Where an administrator reviews an install ID that appears on more than one Free Trial record, we also keep that install ID and the administrator's note about it.

(i) The Free Trial record described in section 3(b)(x) is retained after account deletion, so that deleting an account and opening a new one does not start a new Free Trial. It is used only for that purpose, and it is not linked to your breaks, preferences or alert history.

(j) We may retain totals and patterns that do not identify you, such as the number of breaks saved across all users. Where we no longer require Personal Information and we are not required to retain it, we destroy it or de-identify it.

7. Where is your Personal Information held, and do we send it outside Australia?

(a) From time to time, we use third-party service providers for digital cloud storage, web hosting, notification delivery, email delivery, subscription management, maps, forecast data or other technology-related services in connection with providing our Services. We may disclose your Personal Information to these third-party service providers who may operate outside Australia or operate in Australia with servers located outside Australia (International Operators). We currently use Supabase (database and authentication), Vercel (application and website hosting), Google and Apple (sign in, app distribution and subscription billing), RevenueCat (subscription status), Google Firebase Cloud Messaging and Apple Push Notification service (notifications), Resend (sign-in and account emails), VentraIP (our support mailbox), OpenStreetMap, Esri and OpenTopoMap (map tiles), Open-Meteo and WorldTides (forecast and tide data, which receive coordinates only, as described in section 4(e)) and, for our marketing website only, Google Fonts (website typography).

(b) Our database, which holds your account, breaks, preferences and alert history, is hosted by Supabase in its Sydney region (ap-southeast-2), in Australia, and BommieSurf's servers run on Vercel in its Sydney region. Vercel's network may first receive your request at a location near you, which can be outside Australia, before passing it to Sydney. If we change the region in which the database or the servers are hosted, we will update this Policy.

(c) The providers that may store or process Personal Information outside Australia are RevenueCat, Resend, Google (including Firebase Cloud Messaging), Apple (including Apple Push Notification service), Open-Meteo, WorldTides and the map tile providers. As some of our third-party service providers operate globally, we cannot say with certainty where their servers are located or the countries out of which they operate at any given time. Further, these locations may be subject to change without notice to us.

(d) Australian Privacy Principle 8.1 requires us to take reasonable steps, before disclosing Personal Information to an overseas recipient, to ensure that the recipient does not breach the Australian Privacy Principles. We take reasonable steps of that kind when selecting our providers. It is not always possible for us to ensure that multinational companies will not handle Personal Information in a manner that would be inconsistent with the Australian Privacy Principles.

(e) BommieSurf is used outside Australia. This Policy is governed by Australian law. That does not displace any right you have under a data protection law of your own country that cannot be excluded, restricted or modified by agreement. If you are not comfortable with your Personal Information being collected and held as described above, please do not use the Services.

8. Are we responsible for third parties' websites and social media links?

(a) This Policy applies solely to Personal Information collected with regard to providing our Services, the operation of BommieSurf and otherwise in connection with the operation of our business.

(b) We are not responsible for the collection of information or privacy practices of third-party websites that may be linked to from BommieSurf from time to time, or social-media platforms that may be accessed via links in BommieSurf or in our emails.

(c) We refer you to the privacy policies and terms of use of the operators of any linked third-party websites.

9. Will we send direct marketing communications to you?

(a) We send you communications that form part of the Services, including sign up confirmation, password resets and notices of changes to BommieSurf or to this Policy. You cannot opt out of those communications while you hold an account, because they form part of the Services. Surf alerts are sent only where you have turned them on, and you can turn them off at any time in the app or in your device settings.

(b) Your Personal Information may also be used to offer you new goods and services, notify you of new developments to our existing goods and services, or any other promotional communication related to our goods and services or other matters relating to our business.

(c) Where we send you a marketing communication, we will only do so where you have requested it or consented to it, each message will identify us and how we can be contacted, and each message will contain a functional unsubscribe facility. If you unsubscribe we will cease sending within five working days.

(d) If you do not wish to receive direct marketing communications from us, you may opt out at any time by clicking the unsubscribe link on email communications sent to you (if available) or by contacting us (see section 15). You may also ask us at any time to tell you the source from which we obtained your details.

(e) Advertising. We do not show advertising in BommieSurf, and we do not give your information to any advertising provider.

10. Use of artificial intelligence (AI) systems

(a) BommieSurf does not use AI Systems to process your Personal Information in the app. Scores and alerts are calculated by fixed rules from forecast data and the preferences you set.

(b) We will not use Personal Information for Data Training of public or third-party AI Systems.

(c) BommieSurf does not make an automated decision about you that could significantly affect your rights or interests. Scores, sessions and alerts are reference outputs about surf conditions for you to act on, and they are not decisions about you.

(d) You may contact us at any time to inquire about our use of AI Systems and how your Personal Information may be processed by them.

11. Do we collect Personal Information through cookies and analytics tools?

(a) We collect device information, including information about your web browser, IP address, the individual pages or screens that you view, and information about how you interact with BommieSurf, using server logs.

(b) BommieSurf uses strictly necessary first-party cookies to keep you signed in, and your browser's local storage to retain your preferences, such as your theme, and, on the web, the install ID described in section 3(b)(ix). We do not use tracking cookies, and we do not use any analytics or crash-reporting software development kit (SDK) or other third-party analytics. BommieSurf shows no advertising.

(c) Our marketing website sets no cookies of its own. It loads web fonts from Google Fonts, which is subject to Google's own privacy policy. The BommieSurf app does not load anything from Google Fonts.

(d) You can modify your browser to prevent the use of cookies or browser storage, but if you do this, our Services and BommieSurf may not work properly.

12. How do we keep Personal Information secure?

(a) You should be aware that there are inherent risks associated with the transmission of information via the Internet. Data-security measures can never be guaranteed. This means that while we take steps to protect your Personal Information, we cannot guarantee its security.

(b) If you suspect any misuse, loss, unauthorised access, modification, or disclosure of your Personal Information, please contact us immediately.

(c) If Personal Information we hold is lost, or is accessed or disclosed without authorisation, and that is likely to result in serious harm to you, we will notify you as soon as we reasonably can, tell you what has occurred and what information was involved, and tell you what steps you can take in response. We will also notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

13. Will we transfer your Personal Information?

If we are involved in a sale, merger, consolidation, change in control, transfer of substantial assets, reorganisation, or liquidation, we may, in our sole discretion, transfer, sell or assign your Personal Information collected by us to one or more relevant third parties. This section is the exception referred to in section 4(a).

14. Children

BommieSurf is not directed at anyone under 16, and we do not knowingly collect Personal Information about any individual under the age of 16. If you believe that a person under 16 has provided us with Personal Information, please contact us and we will delete it.

15. What if you have questions or complaints?

(a) If you:

  • (i) have any questions about this Policy;
  • (ii) wish to request access to any Personal Information that we hold;
  • (iii) wish to be de-identified or have your Personal Information deleted;
  • (iv) wish to correct or update your Personal Information; or
  • (v) wish to make a complaint or discuss any other privacy concerns you may have,

please contact us at:

Email: Attention: The Privacy Officer, support@bommiesurf.com
Post: Attention: The Privacy Officer, PO Box 772, Cowes VIC 3922, Australia

(b) Much of your Personal Information is available to you within BommieSurf, and you can change your breaks, preferences, alert settings and app settings yourself.

(c) We will respond to a request for access or correction within 30 days. If we are unable to provide what you have asked for, we will tell you why in writing. If Personal Information we hold about you is inaccurate, out of date or incomplete, we will correct it, and if we do not agree that it is inaccurate we will record your view alongside the record.

(d) We reserve the right to charge for reasonable expenses that we may incur in preparing and sending you a copy of your Personal Information.

(e) If you believe we have breached our obligations under this Policy or the Australian Privacy Principles, please give us the opportunity to resolve matters by contacting us first, in writing by email or by post. Once we have received a complaint, we will acknowledge it within 5 business days and will try to work with you to resolve the matter within 30 days. If we require longer we will tell you why and when you can expect an answer. The steps we may take to resolve the matter include:

  • (i) we may request further information from you. This will enable us to investigate the complaint and determine an appropriate solution;
  • (ii) we will discuss options for resolution with you. If you have suggestions about this matter, please raise these with our Privacy Officer; and
  • (iii) where necessary, we will conduct an investigation and endeavour to do so within a reasonable time. We may need to consult others to progress the investigation.

(f) If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

(g) Where the UK GDPR or the EU GDPR applies to you, you also have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out on the basis of legitimate interests, and you may complain to your local supervisory authority.

16. Definitions

  • Artificial Intelligence (AI) means a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs (such as text, images, content, recommendations or decisions) that can influence physical or virtual environments.
  • AI Systems means software, platforms or tools using artificial intelligence, including generative AI, image generators, transcription tools or data-analysis assistants.
  • Data Training means the process of using data (including text, images or other content) to train, refine or improve an AI System's performance.
  • Free Trial, Store and Subscription have the meanings given in the BommieSurf Terms of Use.
  • Personal Information has the meaning as defined in the Privacy Act.

Contact

Bluegrass Pastoral Pty Ltd ACN 699 118 226
Support and notices: support@bommiesurf.com
Postal address: PO Box 772, Cowes VIC 3922, Australia