Privacy

Controller and contact

SurfBuddy by Sebastian Herrig · Carrer Anfos 7 · 07609 Tolleric · Spain

Use the email below for questions about your data and to exercise your rights.

Data we process

We process your user identifier, chosen name, optional avatar and profile details, sessions and participation, buddy relationships, messages, favourites, settings and content reports. Optional location access provides nearby spots and arrival estimates. During a selected recording, the Watch uses GPS and motion sensors to estimate speed, duration and jumps.

Visibility

Public profile details, public sessions and spot chats are accessible to other users. Hidden profile fields are removed before sharing. Buddies-only sessions use private CloudKit records and CloudKit shares; recipients must accept invitations. Messaging is limited to public spot chats; there are no private buddy or session chats. Content already read or copied cannot be recalled. Complete profile settings remain private.

Storage and providers

Data is stored locally and in Apple iCloud/CloudKit for storage, sync and sharing. Apple provides sign-in. No advertising or tracking SDKs are used. This support website uses no analytics cookies. Apple and the hosting provider process necessary connection data under their own terms.

Health and permissions

A Watch workout session may keep recording while the display is off. We do not read other Health data or save workouts to Apple Health. You can revoke location, photo, notification and Health permissions in system settings.

Purposes and legal bases

Necessary service processing is based on contract performance (GDPR Article 6(1)(b)). Optional features and sharing rely on consent where required (6(1)(a)). Abuse handling and service security rely on legitimate interests (6(1)(f)); legally required processing relies on 6(1)(c). No automated decisions with legal effects are made.

Retention and deletion

Account content is retained for service use until you request content or account deletion. Local pruning does not automatically delete server data. Account deletion inventories older server records; incomplete deletion is shown as an error. If legal retention is required, ask us for the reason and duration.

Your rights

You can request access, correction, erasure, restriction and, where applicable, portability; object to legitimate-interest processing; and withdraw consent for the future. Email us to exercise these rights. You may complain to a supervisory authority, including Spain’s AEPD. Apple or hosting storage may involve international processing under their applicable privacy terms and safeguards.