BommieSurfBack to sign in

Privacy Policy

Effective 1 September 2026 · Last updated 1 September 2026 · Version 1.0

1. Who we are

BommieSurf is an Australian app. We are the entity responsible for the personal information described here, and you can reach us at hello@bommiesurf.com.

This policy explains what we collect, why, who else handles it, how long we keep it and what you can ask us to do about it. It is written to be read, not to be survived.

2. What we collect

  • Your email address. Given when you sign up.
  • A hash of your password. We never see or store the password itself.
  • Your saved spots — the name you gave each one, its coordinates, and the tide, swell and wind preferences you set.
  • Your settings — units, home time zone, theme.
  • A one-way hashed store-account identifier, where the platform provides one, used only to enforce one trial per person.
  • Device and usage analytics — screens opened, errors and crashes, rough device and browser type.
  • Approximate location, only when you grant it, and only to centre the map on you while you are adding a spot or finding your nearest one. It is used in the moment and not stored.

We do not collect your contacts, your photos, your precise location history, or anything else the app does not need in order to work.

3. Why we collect it

| Data | Purpose | Basis | |---|---|---| | Email address | Identify your account, sign you in, contact you about the service | Necessary to provide the service you asked for | | Password hash | Authenticate you | Necessary to provide the service | | Saved spots and preferences | Produce a forecast scored against your break — this is the product | Necessary to provide the service | | Settings | Present the app the way you chose | Necessary to provide the service | | Hashed store-account identifier | Enforce one free trial per person | Our legitimate interest in offering a trial at all | | Device and usage analytics | Find crashes, fix faults, see which parts are used | Our legitimate interest in a working app | | Approximate location | Centre a map when you ask it to | Your consent, which you can withdraw in your device settings |

4. Who processes it on our behalf

  • Supabase — database, authentication and storage. Holds your account, your spots and your settings.
  • Vercel — hosting. Processes requests as they are served.
  • Open-Meteo — forecast data. We send coordinates snapped to a grid cell of roughly one kilometre. We send nothing that identifies you.
  • Apple and Google — subscription billing and entitlement status.
  • RevenueCat — subscription management, once it is added.
  • An advertising network, on the free tier only. It will be named here when one is selected, before it goes live.

Each is bound to handle the information only for the purposes we set.

5. What we don't do

We do not sell your personal information, rent it, or trade it.

We do not share your saved spots with anyone. We do not build a profile of you for advertising beyond the standard behaviour of the ad network on the free tier, which will be named and linked here before it is enabled — and which Pro removes entirely.

6. Retention and deletion

Your account data — email, spots, preferences, settings — is kept while your account exists. Delete your account from Settings, or ask us at hello@bommiesurf.com, and it is deleted.

One thing survives that deletion, and we would rather say so than have you discover it. The trial record persists. It contains a one-way hash of your email address, where available a one-way hash of your store account, and the dates the trial ran. It does not contain your name, your email address in readable form, your spots, your settings or anything you did in the app, and it cannot be reversed to recover any of them.

It exists for one reason: so that deleting an account and signing up again does not issue a second free trial. Without it we could not offer a trial at all.

7. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may ask us to give you access to the personal information we hold about you, correct it if it is wrong or out of date, and delete it. Email hello@bommiesurf.com. We will respond within a reasonable period and in any case within 30 days, and we will not charge you for a request unless it is excessive and we tell you first.

If you are unhappy with how we have handled a privacy matter, tell us first so we can try to fix it. If you are still unhappy you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Where the UK GDPR or the EU GDPR applies to you, you also have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out on the basis of legitimate interests, and you may complain to your local supervisory authority.

8. Children

BommieSurf is not intended for anyone under 16 and we do not knowingly collect their personal information. If you believe a child under 16 has given us information, contact us and we will delete it.

9. Cookies and local storage

We set a session cookie so you stay signed in, and use browser local storage for small interface preferences. We do not set tracking cookies of our own. The advertising network on the free tier may set its own cookies or identifiers; its policy will be linked here when it is selected.

10. Security

Passwords are hashed and never stored in a readable form. Traffic is encrypted in transit. Database access is restricted by row-level security, so one account cannot read another's spots even if it tries. Administrative access is limited to those who need it.

No system is perfectly secure. If a breach occurs that is likely to cause you serious harm we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.

11. International transfers

Some of the services in section 4 store or process data outside Australia, including in the United States and the European Union. Where we transfer personal information overseas we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

12. Changes to this policy

We may update this policy. The "Last updated" date at the top will change, and where a change materially affects you we will tell you in the app.

13. Contact

hello@bommiesurf.com