Privacy Policy

SurfVault, LLC (“SurfVault”, “we”, “us”, or “our”) operates the SurfVault website at surf-vault.com (including the SurfVault store at surf-vault.com/store), the SurfVault web app at app.surf-vault.com, and the SurfVault mobile application (collectively, the “Service”). This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

1.1 Information you provide directly

Account information. When you sign up, we collect your email address and name through our authentication provider (Auth0). If you sign in with Apple or Google, we receive your email, name, and (from Google) your profile photo, which we use as your initial public profile picture until you change it.

Profile information. You choose an account type (surfer, photographer, shaper, or brand) and can add a handle (username), profile picture, banner, bio, status note, social links (Instagram, YouTube, website), tags, and home surf break. You can also mark your profile as Public or Private. Photographers, shapers, and brands can add payment handles (such as Venmo, PayPal, Cash App, or Zelle) to their profile; these are shown publicly so other people can pay them directly. SurfVault does not process those payments.

Content. You can upload photos and videos and create sessions and board galleries tied to surf breaks, dates, and locations. Along with each file we store its file name and the information embedded in it, such as the date and time it was captured and, where the file carries one, the location it was captured at; we use this to help you sort and file your media. You can write captions, tag other users in sessions and in individual photos, organize media into groups, and add media to the Highlights shown on your profile. When you let someone download an original file, it keeps the information embedded in it, such as when and where it was captured.

Comments and mentions. You can comment on sessions and on individual photos, and mention other users in comments and captions. Comments are visible to anyone who can see the session.

Direct messages. When you message another user, we store the message content (including any payment request you send) so it can be delivered, displayed, and retrieved by the recipient. If you message the official @surf_vault account, your messages are read and answered by authorized SurfVault staff for support purposes. When you finish setting up your account, @surf_vault sends you one welcome message so you know where to reach us; it is not marketing.

Access requests and share links. If you request access to another user’s photos, we store the request and its status. Approved requests grant you time-limited access to view and download specified photos. If you create a private share link, we store which media it covers, its settings, and a protected (hashed) copy of its access code, and we count incorrect code attempts to stop the code being guessed.

Reports and blocks. If you report content or block another user, we store the report or the block. Reports are reviewed by authorized SurfVault staff. If someone reports a message you sent, staff can see that message to review the report.

Films. If you link a YouTube channel to your profile, or are tagged in a film, we store that link or tag.

Store orders. If you buy merchandise from the SurfVault store, checkout is handled by Shopify. We receive your name, email address, shipping address, and order details so we can produce, ship, and support your order. We do not receive or store your payment card number. You do not need a SurfVault account to place an order.

Contacting us. If you email us or use the contact form on our website, we receive whatever you send us, including your email address.

1.2 Information collected automatically

Location. With your permission, we collect your device’s precise location to show you nearby surf breaks, photographers, and sessions on the map and discover feed. You can revoke this permission at any time in your device settings. If you haven’t shared your precise location, the web app estimates your approximate area (city level) from your IP address so the map and nearby lists start in the right place. This estimate isn’t saved to your account.

Device and push information. When you enable notifications, we collect an Expo push token that identifies your device for the purpose of delivering notifications. We store that token with an identifier for your device, its platform (iOS or Android), and when it was last used, and we receive standard device information (operating system, app version) with normal API requests.

Usage and interaction data. We collect information about how you interact with the Service, including:

Pages, sessions, profiles, boards, films, and surf breaks you view (used to surface “popular” and “recently viewed” content, and to provide view counts to photographers). Views are counted against your account if you are signed in, or against a random identifier stored on your device if you are not.
Where you stopped each film you play while signed in, so we can show “Continue watching” and start the film where you left off. Only you can see it, and you can clear it at any time in Settings › Preferences.
Search queries (used to show your recent searches and improve discovery). When you search by description (“natural-language search”), the text you type (and, if you have enabled location, your approximate area) is sent to our AI provider (Anthropic) to translate it into search filters. See § 3.2.
Follow, favorite, and access-request events
When you were last active: when you open the app or website while signed in, we record the time and which day it was (at most once every 15 minutes)

Session replay and diagnostics (web app only). On the web app at app.surf-vault.com we use LogRocket to record how the app is used so that we can reproduce and fix problems. A recording captures the pages you visit, your clicks and scrolling, what is displayed on your screen, and technical information such as console messages and network requests. If you are signed in, recordings are associated with your user ID, name, handle, and email address. Because a recording captures what is on screen, it can include content you view or type in the web app, including messages. The mobile app and the surf-vault.com website do not use session replay.

Error and request logs. When something fails, we log the error together with your user ID if you are signed in, or a salted hash of your IP address if you are not; these error logs and our other server logs are deleted after 90 days. Our API keeps standard request logs (including IP address) for 30 days, and the network that delivers photos and videos keeps standard request logs (including IP address and the file requested) for 30 days.

Billing information (web only). If you subscribe to a paid plan on the web app, our billing provider (Chargebee) collects and processes your payment information directly. We do not store or collect payment card numbers ourselves. The mobile app does not accept payments.

1.3 Cookies and on-device storage

We do not use advertising cookies or cross-site tracking. We use your browser’s local storage, and similar storage on your device, to:

Keep you signed in (sign-in tokens issued by Auth0)
Count a view once per visitor, using a random identifier that is not linked to your identity when you are signed out
Remember your choices, such as dismissed banners and guided-tour progress
Hold photos and videos on your own device while they finish uploading
Keep your cart in the SurfVault store

Some of our service providers load on the web app or set their own cookies or on-device storage: Auth0 (sign-in), Chargebee (subscription checkout), Google (sign-in and Google Drive import), Shopify (store checkout), LogRocket (session replay on the web app), and YouTube (when you play an embedded film).

1.4 Information from other sources

We receive sign-in details from Auth0, Apple, and Google; public video and channel information from YouTube; and information other users add about you, such as tags and mentions. For some shaper and brand accounts, SurfVault staff set up the profile using publicly available business information, which can include a business phone number.

2. How We Use Your Information

We use the information we collect to:

Create and maintain your account
Display your profile and content to other users according to your privacy settings
Deliver messages, notifications, and access request updates
Find and display surf breaks, sessions, and photographers near you
Operate subscription and billing features (via Chargebee)
Produce, ship, and support store orders
Keep the Service secure and prevent abuse
Diagnose and fix problems, including by reviewing session replays and error logs from the web app
Improve the Service through internal analytics on how features are used
Provide photographers with insights about engagement with their profile and sessions
Understand which accounts are active and help people who get stuck setting up. Authorized SurfVault staff can review an individual account’s activity to provide support and improve the Service: when it was last active, which days it was active, and the actions it took (such as uploads, published sessions, photo requests and grants, follows, and how many messages it sent or sessions it viewed). Staff see counts of the sessions you viewed, never which ones, and this activity review never includes the content of your messages. When staff view the Service as your account to fix a problem, your direct messages stay hidden from them. (Session replay on the web app is separate and is described in § 1.2.)
Communicate with you about your account, service updates, and support requests

We do not use your information for advertising and we do not share your data with third-party advertising networks or data brokers.

We share your information only as described below:

3.1 With other users

Your public profile, handle, profile picture, verification status, tags, and, if your profile is Public, your sessions, photos, videos, boards, captions, and Highlights are visible to other users of the Service. If you make your profile Private, your sessions and photos are only visible to users who have been granted access. Comments you post are visible to anyone who can see the session they are on. Anyone you give a private share link to can view the media that link covers. Photos and videos from Public profiles, with the poster’s handle and surf break, may also be featured on surf-vault.com.

Your active status (“currently shooting at [break]”) and status note, if set, are visible to other users.

When you request a photographer’s photos, message them, or follow and comment on their sessions, that photographer can see your handle, name, and profile picture in their dashboard, together with which of these actions you took (and any of their sessions they’ve tagged you in), how many, and when. This helps them respond to requests and follow up with surfers who have engaged with them. People you’ve blocked, or who have blocked you, and accounts pending deletion are not shown. Views of profiles, sessions, and photos are shown to photographers only as approximate aggregate counts, never as a list of who viewed.

3.2 With service providers

We share limited information with the following third-party processors that help us operate the Service:

Auth0 (Okta, Inc.): authentication, sign-in, and identity management
Amazon Web Services (AWS): hosting of our API, database (RDS), and photo and video storage (S3), content delivery (CloudFront), and transactional email
Chargebee, Inc.: subscription billing (web only)
Pusher Ltd.: real-time delivery of notifications and messages (WebSockets)
Expo (650 Industries, Inc.): push notification delivery (through Apple’s and Google’s push services) and delivery of app updates
LogRocket, Inc.: session replay and error diagnostics on the web app (see § 1.2)
Geoapify: geocoding for location search
ipapi.co (Kloudend, Inc.): estimates your approximate area from your IP address on the web app
Anthropic, PBC: natural-language search (“search by description”). The text of your search, and your approximate area if location is enabled, is sent to Anthropic’s API to translate it into structured search filters. Under Anthropic’s commercial API terms, this input is not used to train their models and is retained only for a limited period before deletion. We also send the public title, channel name, and description of films to Anthropic to suggest film categories.
Google LLC (YouTube): films on SurfVault are YouTube videos. We use YouTube API Services to retrieve public information about videos and channels (such as titles, descriptions, and thumbnails), and we show films using YouTube’s embedded player. When you play a film, YouTube may collect information from your device under the Google Privacy Policy.
Google LLC (Google Drive): if you import from Google Drive, we access only the files you pick, copy them into your SurfVault account, and store each file’s Drive ID to avoid duplicates. Your Drive access token stays in your browser tab and is not stored on our servers. SurfVault’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google LLC (Google Fonts) and unpkg: deliver fonts and map code to the web app; your browser contacts them, which shows them your IP address
Apple Inc.: Sign in with Apple and App Store services
Map providers (Esri, Apple, and Google): the maps in the Service load map imagery directly from these providers, which shows them your IP address and the area of the map you are viewing
Shopify Inc.: checkout, payment, and order management for the SurfVault store
Tapstitch: production and shipping of store orders; receives the name, shipping address, and contents of your order
Netlify, Inc.: hosting of the surf-vault.com website

Each processor handles data only for the purposes described, subject to their own privacy policies and, where available, data processing terms.

3.3 For legal reasons

We may disclose your information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of SurfVault, our users, or the public.

3.4 Business transfers

If SurfVault is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

4. Data Retention

Account data is retained for as long as your account is active.
Photos, videos, and uploads are retained while your account is active and follow the lifecycle we’ve configured for storage costs (originals move to lower-cost storage tiers after 30 days and 90 days).
Trash. When you delete a photo or video, it moves to your Trash. It is taken off your profile, feeds and shares straight away, only you can see it, and you can restore it. It is permanently deleted when you empty your Trash, delete it from your Trash, or when the auto-delete time you choose passes (7, 30 or 90 days, 30 by default; if you choose Never, it stays until you empty your Trash). Items in your Trash still count toward your storage. If a session or board an item was deleted from has an open report, the item stays in your Trash until the report is resolved.
Share and request records keep a list of the photos and videos they contained after those items are deleted, so a share or request still shows what was sent and how many items are no longer available. The list holds no copy of the media, and it is removed when either account is permanently deleted.
Messages are retained indefinitely for both participants. If one participant deletes their account, the messages remain visible to the other participant but the deleted user is shown as “Deleted User”.
Support messages: your conversation with the official @surf_vault account is deleted when your account is deleted (after the 30-day recovery period, unless you cancel the deletion).
Notifications are deleted automatically after 12 months if you’ve read them, or after 18 months if unread, measured from when they were sent. Notifications generated by another user’s activity are removed when that user’s account is permanently deleted.
Watermarked previews and download archives are temporary and expire within 7 days.
Daily activity records (which days you were active) are deleted automatically after 13 months. Your most recent “last active” time is kept while your account is active. Both are deleted when your account is permanently deleted, and your views of sessions and profiles are unlinked from your account so they remain only as anonymous counts.
Film watch history (where you stopped each film) is deleted automatically 30 days after you last played that film, when you clear it in Settings › Preferences, or when your account is permanently deleted.
Search history: we keep only your 10 most recent searches and the last 100 results you picked, and delete them when your account is permanently deleted.
Error logs and server logs are deleted after 90 days. API request logs (including IP address) and media request logs are deleted after 30 days.
Views you make while signed in stay linked to your account while it is active and become anonymous counts when it is permanently deleted.
Session replays are kept by LogRocket for a limited period and then deleted.
Backups. When a photo or video is permanently deleted, its original stays recoverable for up to 30 days, and copies in our off-site disaster-recovery backup are removed within 90 days. Database backups are kept for 14 days, so deleted account data can remain in them for up to 14 days after deletion.
Store orders are kept for as long as we need them for customer support, tax, and accounting.

5. Account Deletion

You can delete your SurfVault account at any time from within the app or on the website:

Mobile: Profile → Account → Close Account
Web: Settings → Billing & Plans → Close account

When you request deletion:

Your account is immediately scheduled for permanent deletion in 30 days
Your active status is cleared and push notifications stop. Your profile and published content stay visible until the 30-day period ends. If you want them hidden sooner, unpublish your sessions or set your profile to Private before closing your account
Any paid subscription is set to cancel at the end of your current billing period
You can log back in during the 30-day window to cancel the deletion and restore your account

After the 30-day grace period ends, we permanently delete:

All of your uploaded photos and videos, including board media and anything in your Trash, from every storage bucket (originals, previews, thumbnails, and watermarked variants)
Your profile picture, banner, and custom watermark logo
Your sessions, uploads, favorites, follows, access requests, share links, notifications, search history, film watch history, and download job records
Your comments and captions, your Library groups and Highlights, and tags and mentions of you on other people’s photos, comments, and films
Your device push tokens and your activity records
Your Auth0 identity

Your user record is then anonymized: your name is set to “Deleted User”, your handle is replaced with a non-identifying string, your email is removed, and all profile fields are cleared. This anonymization preserves conversation integrity for other users you may have messaged, but nothing personally identifying you remains. Your support conversation with @surf_vault is not kept; it is deleted entirely.

We keep a limited record of reports you made, reports about your content, and actions staff took on your account, so we can handle abuse and keep the Service secure. These records are not shown to other users.

Copies of your original photos and videos held in our off-site disaster-recovery backup are removed automatically within 90 days of the deletion.

Store orders are separate from your SurfVault account. Closing your account does not delete records of orders you placed, which we keep as described in Section 4.

This deletion is permanent and cannot be undone after the 30-day grace period.

6. Your Privacy Rights

Depending on where you live, you may have the following rights:

Access: Request a copy of the personal information we hold about you
Correction: Correct information that is inaccurate or incomplete (most profile fields can be edited directly in the app)
Deletion: Delete your account and associated data (see Section 5)
Portability: Receive your personal information in a portable format
Opt-out of communications: Turn off message notifications in the app (Settings → Push notifications → Messages) or disable push notifications in your device settings; we do not send marketing email

To exercise any of these rights, or to ask questions about your data, contact us at the email below. We will respond within 30 days.

California residents (CCPA/CPRA)

California residents have the right to know, delete, correct, and opt-out of the sale or sharing of their personal information. We do not sell or share personal information as those terms are defined under California law.

If you are in the EEA, UK, or Switzerland, our legal basis for processing your personal information is:

Contract: to provide the Service you signed up for, and to fulfil store orders
Legitimate interests: to operate, secure, diagnose, and improve the Service
Consent: for location access and push notifications

You may also lodge a complaint with your local data protection authority.

7. Security

We use industry-standard security measures to protect your information, including:

Encrypted connections (HTTPS/TLS) for all network traffic
Encrypted storage for sensitive tokens on your device (expo-secure-store / iOS Keychain)
Signed JWT access tokens for authenticated API requests
Presigned S3 URLs for direct, scoped photo access
Automated backups of our primary database

No method of transmission or storage is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

8. Children’s Privacy

SurfVault is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, please contact us and we will delete the account.

9. International Users

SurfVault is operated from the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

10. Third-Party Links and Content

The Service may contain links to third-party websites or services (for example, social media links you add to your profile) and embedded third-party content (for example, YouTube videos on film pages). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service and update the effective date at the top of this page. Your continued use of the Service after a change means you accept the updated Policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@surf-vault.com
Mail: SurfVault, LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702
Website: https://www.surf-vault.com