Privacy Policy

Shaka Surf is an open surf-forecast app ("the App") powered by free, public ocean data from Open-Meteo and NOAA. The App is operated by the developer listed in the App Store / Google Play ("we", "us", "our"). Contact information is in §9 below.

If you never sign in: no personal information at all. Forecasts, cams, the globe and search all work anonymously.

If you choose to sign in (via Apple, Google, or email, through Clerk), we store:

• Your email address — used only to sign you in and to contact you about your account. Held by our authentication provider, Clerk. Supabase, our database provider, stores only your profile, sessions, and kudos below — it does not handle sign-in.
• Your profile — the username and emoji avatar you pick.
• Your surf sessions and kudos — the sessions you log and the kudos you give, which appear in the public feed and leaderboard under your username.
• Subscription status — if you subscribe to Pro, we store whether your subscription is active and when it renews.

Payments: card details are handled entirely by Stripe and never reach our servers. See Stripe's privacy policy.

Device location (optional) — When you tap the locate-me button, the App requests your device's coarse location to center the globe near you and surface nearby breaks. The coordinate is used only in-memory for that single request; it is never stored on our servers, never logged, and never shared with any third party beyond the routing needed to return a forecast for those coordinates. You may deny this permission at any time without losing any app functionality.

App preferences (device only) — Favorite spots, recently viewed spots, and unit preferences (imperial/metric) are stored in your browser's localStorage or the Capacitor app's local storage. They never leave your device.

Usage analytics — We use PostHog to collect anonymous product-analytics events: page views, feature interactions, and session duration. Events are tied to a randomly-generated anonymous device ID — not to any name, email, or personal identity. No advertising profile is built from this data, and it is never sold. You can opt out by enabling your device's “Limit Ad Tracking” setting or using a content blocker.

• No advertising identifiers, and no third-party ad tracking
• No sale or rental of your data to anyone, ever
• No card numbers or payment details on our servers
• No contacts, photos, health, or financial data
• No background location — location is read only when you tap the locate button

The App loads content from the following third-party services. Each is governed by its own privacy policy. Requesting tiles, forecasts, or analytics causes your IP address to be visible to those services.

• Open-Meteo — marine and weather forecast data. open-meteo.com
• NOAA (NDBC / CO-OPS) — buoy observations and tide predictions. noaa.gov
• Esri / ArcGIS — satellite imagery basemap tiles (no account required).
• CARTO — dark-label map overlay tiles.
• NASA EOSDIS GIBS — Blue Marble satellite imagery shown at globe zoom levels.
• Apple Maps (MapKit JS) — the detail map shown when you zoom into a break. Apple receives your IP address and the map area you view. See Apple's privacy policy.
• PacIOOS (University of Hawaiʻi) — ocean-model wave-map frames. Usually served through our own servers; if our server can't finish in time your browser fetches the frame directly from PacIOOS, which then sees your IP address. pacioos.hawaii.edu
• MapLibre demo glyphs — map text-rendering assets served from demotiles.com.
• YouTube (google-nocookie.com) — embedded public live webcam streams. YouTube's privacy policy applies to those embeds; Shaka Surf does not operate camera hardware.
• Clerk — authentication (sign-in via Apple, Google, or email) when you choose to sign in. Clerk stores your email address and manages your session. clerk.com/legal/privacy
• Supabase — storage for your profile, surf sessions, kudos, and subscription status when you choose to sign in. Supabase does not handle authentication. supabase.com/privacy
• Stripe — payment processing for the optional Pro subscription. Card details are handled entirely by Stripe. stripe.com/privacy
• PostHog — anonymous product analytics. posthog.com/privacy

The App does not set tracking cookies. Signing in sets a first-party auth session token (via Clerk) so you stay signed in. PostHog may set a first-party cookie or use localStorage to persist its anonymous session ID across visits. No third-party advertising cookies are set.

The App is rated 4+ (iOS) / Everyone (Google Play) and contains no content harmful to children. Forecasts, cams, the globe and search all work anonymously with no account. Children under 13 (or the applicable age in your jurisdiction) should not create an account; we do not knowingly collect personal information from children through account sign-in.

If you never sign in, we store no personal data server-side, so there is nothing to delete or export on request. Local preferences (favorites, unit settings) can be removed at any time by clearing the app's storage in your device settings or clearing site data in your browser.

If you sign in, your email, profile, surf sessions, kudos, and subscription status are retained until you ask us to delete your account. Contact us at the address below and we will delete your account data. Deleting your account removes your profile and future visibility from the feed and leaderboard; sessions and kudos already surfaced to other users may not be retroactively erased from their view.

PostHog retains anonymous analytics events for up to 1 year by default. To request deletion of PostHog's records, contact us at the address below with your approximate device-ID if known, or contact PostHog directly.

If we make material changes we will update the effective date at the top of this page and, where required by applicable law, provide notice within the App.

Questions about this policy? brian.boler340@gmail.com