Privacy Policy

Surflink ("Surflink", "we", "us") is an AI-powered surf coaching platform available at surflink.ai and through our iPhone, Apple Watch, and Apple TV apps. This policy explains what we collect, why, where it lives, who can see it, and how to get it deleted. Questions or requests: admin@surflink.ai.

• Account data — name, email address, password (stored as a salted hash by our authentication provider), optional phone number for SMS notifications, profile photo, timezone, and home surf break.
• Coaching content — session videos and clips you upload or film, AI analysis derived from them (surfer tracking, pose, maneuver classification), coach annotations, drawings, voice notes and their transcripts, guided reviews, training plans, drills, goals, journals, wellness check-ins, competition results, and messages between coaches and athletes.
• Health and workout data (Apple Watch) — with your explicit HealthKit permission, the watch app records surf workouts: heart rate, active energy, GPS location and speed, and high-rate motion data. We use it solely to produce your surf metrics (waves, speeds, effort) and to sync with session video. Health data is never used for advertising, never sold, and never shared with third parties for marketing. It is not stored in iCloud; it syncs to our own backend only after you consent.
• Precise location — GPS during a recorded surf session (to map waves and speeds) and the surf spots you attach to sessions.
• Payment data — subscriptions and coaching payments are processed by Stripe. We never see or store full card numbers; we keep the subscription status, plan, and invoice history Stripe reports to us.
• Usage and diagnostics — product analytics (PostHog) and crash/error reports (Sentry) tied to your user ID, used to fix bugs and improve the product. We do not use cross-app tracking and we do not sell data to data brokers.

Data is stored with Supabase (database, authentication, and file storage) in the United States, with video processing on our own inference infrastructure and, for some clips, Cloudflare Stream. Access inside the platform is enforced with database-level row security: coaches see only the athletes assigned to them, athletes see their own data, and public athlete profiles exist only if you explicitly publish one (with a minor-protection guard).

Athlete accounts for surfers under 16 require a parent or guardian invitation and consent before activation. Guardians can request their child's data or its deletion at any time via admin@surflink.ai.

• In-app deletion — sessions, clips, wearable recordings, messages, and athletes can be deleted inside the product; deleting a wearable session removes both the database record and the raw sample file in storage.
• Account deletion — available in the iOS app (Profile → Account) and by email. It removes your profile, sign-in, and buffered device data; coaching content you created for an organization may be retained by that organization where it is their business record.
• Backups — encrypted database backups roll off automatically within the retention window (currently 7 days).

We share data only with the service providers that run the platform — Supabase (data), Stripe (payments), Cloudflare (video delivery), Resend (email), Twilio (SMS), Apple (push notifications), PostHog (analytics), Sentry (crash reporting), and our AI processing providers (video analysis and coaching text generation) — each bound to process it only on our instructions. We also share competition results with the ranking bodies you connect (e.g. WSL, LiveHeats) only where those results are already public. We do not sell personal data.

You can access, correct, export, or delete your personal data, and object to or restrict certain processing. Email admin@surflink.ai and we will respond within 30 days. If you are in the EU/UK you may also lodge a complaint with your supervisory authority.

If we materially change this policy we will update the date above and notify active accounts by email or in-app notice before the change takes effect.