Surf Crew Get on the list

The fine print

Privacy Policy

What we collect, why, and how to get it deleted. Short version: only what the app needs, never sold, never used for ads.

Effective date: 8 September 2026 · Updated 24 October 2026

1. Introduction

Surf Crew ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Surf Crew mobile application ("the App").

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). By using the App, you consent to the practices described in this policy.

2. Information We Collect

Account Information

When you create a Surf Crew account, we collect:

  • Email address
  • The display name you choose

User-Generated Content

When you submit surf reports through the App, we collect:

  • Wave rating (Poor, Fair, Good, or Epic)
  • Crowd level
  • Wind conditions
  • Wave size
  • Optional text notes
  • An optional photo, taken with your camera or chosen from your photo library. The App only sees the photo you pick.

Surf Spot Data

The App uses a curated list of surf spots. A crew can also add its own spots (a name and an optional area); these are visible only to members of that crew. We do not track your GPS location or collect real-time location data from your device.

Planned Sessions

When you plan a surf session, we collect the spot, the day and time, and any note you add. When you answer a session, we record whether you are in, maybe or out. On the day you can say you are on your way, and a check-in from the session marks you as at the beach. Before it starts, crewmates can suggest another spot or time and say "Me too" to a suggestion. After a session you can rate it from 1 to 5 and add photos, taken with your camera or chosen from your photo library. Your crew sees all of these.

Shakas and Comments

You can give a crewmate's check-in a shaka and write short comments on it (up to 280 characters). We store who gave the shaka or wrote the comment, its text and when. Only members of the check-in's crew see them, and they are permanently deleted together with the check-in, 4 hours after it was posted. If you report a comment, its text is included in the report sent to our support inbox.

Push Notifications

If you allow notifications, we store your phone's push address (a code Apple issues so a notification reaches your device), your phone's time zone (so reminders arrive at the right local time) and which kinds of notification you have switched on in Settings. Notification text names the crewmate, the spot and the rating or session time; a comment notification also shows the start of the comment.

Forecasts

Forecasts are fetched by our server for the surf spot only. No information about you is sent to the forecast provider.

Content Moderation Data

If you report another user or block a user, we collect information related to that action to maintain the safety of our community.

3. How We Use Your Information

We use the information we collect to:

  • Create and manage your account
  • Display surf reports, sessions, ratings and photos to members of your crew
  • Enable private crew functionality (invitations, membership)
  • Moderate content and enforce our community standards
  • Improve and maintain the App
  • Communicate with you about your account or the App

4. Data Retention

We retain different types of data for different periods:

  • Surf reports, including any photo, shakas and comments attached to them, are hidden from every member 4 hours after they are posted and are permanently deleted by an automatic job shortly after that. Only fresh conditions are ever shown.
  • Planned sessions that nobody rated or added a photo to are permanently deleted, with their answers, 3 days after the session's start time. A session with a rating or a photo is kept as part of your crew's log of past sessions until the people in it delete their accounts.
  • Session photos are permanently deleted 90 days after they are added, or straight away when you delete one yourself.
  • Suggested changes to a session, and the "Me too" answers to them, are deleted when the plan changes or the session starts. "On my way" is cleared if the plan changes.
  • Push addresses are deleted when you sign out, delete your account, or when Apple tells us the address no longer works.
  • Profile and crew data (your account information, crew memberships, spots your crew has added, and preferences) are retained for as long as your account remains active.
  • Moderation data (reports and blocks) is retained as long as necessary to maintain community safety.

When you delete your account, all your personal data is removed in accordance with Section 8 below.

5. Disclosure of Your Information

We do not sell, rent, or trade your personal information to third parties. Your information may be shared in limited circumstances:

  • Within your crew: Surf reports and your username are visible to other members of the crews you have joined. Crews are private and invite-only.
  • Service providers: We use Supabase as our backend, authentication, and database provider. Supabase infrastructure is hosted on Amazon Web Services (AWS). Supabase processes your data on our behalf and is bound by contractual obligations to protect your information.
  • Legal requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

6. Data Security

We take reasonable steps to protect your personal information from misuse, interference, and loss, as well as unauthorised access, modification, or disclosure. Measures include:

  • All data transmitted between the App and our servers is encrypted using HTTPS/TLS
  • Authentication is handled securely through Supabase Auth
  • Access to personal data is restricted to authorised personnel only

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

  • Access the personal information we hold about you
  • Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading
  • Request deletion of your personal information
  • Complain about a breach of the Australian Privacy Principles

To exercise any of these rights, please contact us at privacy@surfcrew.net. We will respond to your request within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

8. Account Deletion

You can delete your account at any time from inside the App: open Settings and tap Delete Account. Deletion happens immediately and:

  • Deletes your account, email address and display name
  • Removes you from all crews
  • Hands any crew you started to another member, so the other members keep the crew and their reports
  • Deletes every surf report you have submitted, and every shaka and comment you have given
  • Deletes your block list and any content reports you filed

Account deletion is permanent and cannot be reversed. If you cannot access the App, email privacy@surfcrew.net and we will delete the account for you within 7 days.

9. Third-Party Services

The App uses the following third-party services:

  • Supabase: Provides backend infrastructure, user authentication, and database services. Supabase is hosted on Amazon Web Services (AWS). For more information, see Supabase's Privacy Policy.
  • Apple Push Notification service: Delivers notifications to your iPhone. Apple receives your phone's push address and the notification text. See Apple's Privacy Policy.
  • WillyWeather: Provides surf forecasts. Our server sends it the location of the surf spot only, never anything about you.
  • Cloudflare: Hosts our website. When you report content, Cloudflare delivers the report (your display name, the reported person's display name, the report and your reason) to our support inbox by email. See Cloudflare's Privacy Policy.

We do not use third-party analytics, advertising, or tracking services.

10. Children's Privacy

Surf Crew is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at privacy@surfcrew.net.

11. International Data Transfers

Our service infrastructure (Supabase on AWS) may store and process your data in locations outside of Australia. Where your data is transferred overseas, we take reasonable steps to ensure that the overseas recipient handles your personal information in accordance with the Australian Privacy Principles.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App. We encourage you to review this policy periodically. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Surf Crew Privacy
Email: privacy@surfcrew.net