Privacy Policy

← Back

1. Data Controller

2. What Data We Collect

2.1 Account Data

There are three ways to create an account:

• With an email address and password. We store your email address; your password is kept in encrypted form only and cannot be read by us.
• With Sign in with Apple. Apple shares your name and email address with us, unless you choose “Hide My Email”. In that case we receive a relay address from Apple and do not know your actual mailbox.
• With Google Sign-In. Google shares your name and email address with us.

You enter your first and last name yourself in your profile afterwards. With Apple and Google they are pre-filled; you can change them at any time.

2.2 Profile Data

Optionally, you may provide the following information:

• Sport(s): windsurfing, kitesurfing, wing foiling
• Gear data: sail size, board volume, kite size, wing size
• Body weight
• Gender
• Date of birth
• Nationality

Weight serves two purposes. It is shown with your sessions and with your rig on the map, and is therefore visible to others (see section 5.1). It also feeds the sail recommendation: RigSize Live calculates from all users' sessions which sail suits which wind strength, comparing surfers within the same weight class (your weight plus or minus 5 kilos). That recommendation only ever shows averages and counts, never who surfed the underlying sessions.

Gender and date of birth are used for the leaderboard filters (age category, gender). Your age and gender are therefore available to the app when compiling those leaderboards; your date of birth itself is not. Nationality is used only to display your flag.

This data is never shared with third parties without your consent.

2.3 Location Data

RigSize Live uses your location in four ways, each with different consequences:

• When you open the app we estimate your country from your IP address, so the map does not default to the Netherlands. This happens at our map provider MapTiler (see section 5.2) and works at country level. No GPS is involved and we do not store the result.
• When you press the location button yourself, on the spot map or the wind map, we request your GPS position to move the map there. That position stays on your device; we do not send it to our servers.
• During an active session we do store your position. This happens once, when you start the session, and gives us your starting point. We do not track you afterwards: the app does not measure your position again while your session is running.
• For a session without a known spot we send that session's starting point to MapTiler (see section 5.2) to show the nearest town. We keep the result only temporarily on your device, not in our database.

We store the coordinates of your starting point with your session. If your starting point is near a known surf spot, we store that spot's coordinates. If there is no spot nearby, we store your own starting coordinates.

2.4 Chat Data

RigSize Live has two kinds of chat: the Spot Chat, open to everyone with an account, and group chats, which you create yourself with the people you invite. For both we store, per message:

• The text of your message
• Your photo, if you attach one (resized locally to a maximum width of 1200 pixels)
• The time it was sent
• Your nickname and your user ID

Spot Chat: messages and their photos are kept for as long as the spot exists in the app. They disappear in two ways: you delete your own message, or you delete your account — in which case your messages are removed from every chat.

Group chats: messages are kept for as long as the group exists. They disappear in three ways: you delete your own message, the group's creator deletes the group, or you delete your account — in which case your messages are removed from every chat.

2.5 Session Data

For every session you save we keep:

• Start and end time, and the duration
• The surf spot, or your starting coordinates if no spot was nearby (see section 2.3)
• The sport and the gear you used: sail or kite size, brand and model, board volume, board type and fin type
• Your weight at that time
• The wind data RigSize Live retrieves from the weather service itself: wind speed, wind direction and gusts
• Your rating of whether the gear suited the conditions
• Your note on the session, including any hashtags
• Your session photo, if you add one

If you connect a sports watch or Apple Health, measurement data is added. Section 2.6 sets out exactly what that is.

2.6 Integrations with sports watches and health apps

You can connect RigSize Live to an external platform so that your sessions arrive automatically and you do not have to enter them by hand. Connecting always happens on your initiative and you can undo it at any time.

2.6.1 Garmin Connect™

After your authorisation we receive from Garmin, per activity:

• GPS tracks: latitude, longitude and elevation, as a series of measurement points through your session
• Start and end time, total duration and moving time
• Distance and speed, including your best speeds over short distances
• Heart rate (average and maximum) and calories burned, if your device measures them
• Jumps: height, hang time and distance, if your device measures them
• Lap times and the activity type
• The name of your Garmin device and your Garmin user ID

Data transfer to Garmin: when connecting, your authorisation is processed through the servers of Garmin International, Inc. Technical data about your authorisation request is shared with Garmin as part of the OAuth 2.0 process.

You can disconnect via Settings → Garmin Connect in the app or directly in your Garmin Connect™ account. Your access tokens are then deleted immediately and we also report the disconnection to Garmin. Sessions already imported remain in your account until you delete them yourself. If you delete your account, all data originating from Garmin Connect™ is erased completely: GPS tracks, speed, distance, session duration, heart rate and calories. What is retained anonymously is solely what you entered yourself (spot, gear, weight class) plus the wind data RigSize Live retrieves itself.

2.6.2 Suunto

After your authorisation, Suunto notifies us as soon as you save a new activity. We then retrieve:

• A summary of the activity: start time, duration, distance, average and maximum speed, energy consumption, average and maximum heart rate, and the coordinates of your starting point
• The activity file with the measurement points: time, latitude, longitude, speed, heart rate, elevation and distance covered
• Lap times, the sport type and the name of your Suunto device
• Your Suunto username, which we use to link the activity to your account

We only import windsurf and kitesurf activities recorded on a Suunto watch. A few general water-sport types are imported only if you had a RigSize Live session running at the same time. For all other activities (such as running or cycling) and for recordings made with the phone app, we do not download the activity file and no session is created; only Suunto's notification remains in the processing queue described below.

If you choose "Fetch earlier sessions" in the app, we also request from Suunto the list of your activities from the past 30 or 90 days and import the windsurf and kitesurf sessions among them. To tell watch and phone recordings apart we have to open the activity file; phone recordings are then discarded without being stored. This only happens at your request.

We keep Suunto's notification in a processing queue for up to 30 days, so that we can retry a failed import and investigate what went wrong.

You can disconnect in the app. Your access tokens are then deleted immediately. Suunto offers no way for us to revoke the connection on Suunto's side; if you want that too, do it in your Suunto account. Sessions already imported remain in your account until you delete them yourself; on account deletion the same applies as for Garmin.

2.6.3 Apple Health (iOS only)

In the iOS app you can give RigSize Live access to Apple Health. We request read access only, to four categories: workouts, workout routes, heart rate and distance covered. We write nothing back to Apple Health.

From a workout we read the start time, duration, sport type, distance, energy consumption, source app, and — if present — the route (latitude, longitude, time, speed, elevation and accuracy per point), your average and maximum heart rate and your lap times. We only read workouts of the water sports or surfing sports type; everything else in your Apple Health stays out of view.

2.6.4 Manual import of an activity file

You can upload a TCX file from another platform yourself. From it we read the start time, lap times, distance, speeds, heart rate, calories and the measurement points with coordinates, elevation and speed. We do not keep the file itself: it is read in your browser and then discarded. Only the values read from it end up in your session.

2.7 Push Notifications

When you grant permission for push notifications, we store the following:

• FCM/APNs token (device-specific push token from Google or Apple)
• Device ID (locally generated UUID, so you can receive notifications on multiple devices simultaneously)
• Platform (iOS, Android or web)
• Language setting and app version (to compose the correct notification)

A push token that has not been refreshed for 30 days — for example because you removed the app from that device — is automatically deleted from our database.

Push notifications are used for features you opt into yourself: wind alerts, chat messages, kudos on your sessions, leaderboard notifications and other social features. You can disable push notifications at any time via your device settings or via the notification preferences in the app.

2.8 Camera Usage (native app)

In the iOS and Android app you can take photos or select existing ones for your profile picture and session photos. The following applies:

• Camera and photo library access is used only at the moment you actively choose or take a photo
• Photos are resized and compressed locally on your device before they are uploaded
• We have no background access to your camera or photo library

Uploaded photos go through the same route as photos uploaded via the web version (see section 2.4 for chat photos and section 5.2 for storage location).

2.9 Reports

When you report a chat message, we store: the reported message, the text of that message, the sender's nickname and user ID, the chat it appeared in, the reason for your report, your user ID and the time. We also send an email to the administrator of RigSize Live containing the same data, so that a report does not go unnoticed. We send that email via EmailJS (see section 5.2).

We use reports solely for moderation and keep them for a maximum of 90 days.

2.10 Marketing emails (optional)

If you opt in to marketing emails in your profile settings (the toggle is off by default), we store the following in a separate table:

• Your email address (from your account data)
• Your first and last name, gender, date of birth and preferred sport (to make emails relevant to your discipline and demographic)
• Date and time you gave or withdrew consent (audit trail)
• The source of your opt-in (e.g. profile settings)

We use this data exclusively to send you, at most 1 to 2 times per month, an email with tips for your sport and offers from RigSize Live and carefully selected partners (such as surf shops, gear brands and watersports event organisers). A current list of partners is available on request via the contact details in section 15.

You can withdraw your consent at any time via the toggle in your profile settings or via the unsubscribe link at the bottom of every marketing email. After withdrawal, no further marketing emails will be sent, but the audit trail (opt-in/opt-out timestamps) is retained for a limited period to fulfil our GDPR proof obligation.

2.11 Feedback and spot requests

If you send us feedback through the app, we receive your message together with your email address, the version of the app and the platform you are using. If you request a new surf spot, we receive the name and coordinates of that location, any notes you add, and your name or email address.

In both cases an email goes to the administrator of RigSize Live, sent via EmailJS (see section 5.2). We also keep feedback in our own database so that we can find suggestions again. We use this data solely to answer your message and to improve the app.

3. Legal Basis for Processing

Processing	Legal Basis (GDPR)
Account and authentication	Performance of the contract (Art. 6.1.b)
Location sharing and session tracking	Consent (Art. 6.1.a)
Spot Chat messages	Performance of the contract (Art. 6.1.b)
Leaderboards and statistics	Performance of the contract (Art. 6.1.b)
External integrations (Garmin, Suunto, Apple Health)	Consent (Art. 6.1.a) — you consciously connect your account
Reports and moderation	Legitimate interest (Art. 6.1.f) — user safety
Demographic profile data (gender, date of birth, nationality)	Consent (Art. 6.1.a) — optional, used for leaderboard filters
Own communications about features and updates	Legitimate interest (Art. 6.1.f) — always opt-out available
Offers from selected partners	Consent (Art. 6.1.a) — separate opt-in required, always revocable
Feedback and spot requests	Legitimate interest (Art. 6.1.f) — improving the app
Push notifications (wind alerts, chat, social notifications)	Consent (Art. 6.1.a) — opt-in via device settings, per type adjustable in the app

4. Purposes of Processing

We use your data exclusively for:

• Providing and improving the RigSize Live service
• Displaying your location and gear data to others on the real-time map, including visitors without an account
• Storing and displaying your session history and statistics
• Facilitating the Spot Chat feature
• Compiling leaderboards
• Automatically importing session data from external platforms (such as Garmin, Suunto and Apple Health) when you have given consent
• Compiling the sail recommendation: from all users' sessions we calculate which sail suits which wind strength and weight class. That recommendation contains only averages and counts, no names
• Handling reports and enforcing the code of conduct
• Ensuring the safety and integrity of the app

We do not sell your data to third parties.

Own communications: RigSize Live may inform you about new features, updates, and its own offers. We do this on the basis of legitimate interest. You can unsubscribe at any time via your account settings.

Partner offers: In the future, we may collaborate with carefully selected partners to show you relevant offers for surf-related products and services. We will only do this based on your explicit, prior consent (opt-in). You can withdraw this consent at any time via your profile settings in the app, without any consequences for the other services provided.

5. Sharing of Data

5.1 With Other Users

While your session is running, others see on the map:

• Your nickname and your starting position
• Your gear: sail or kite size, brand and model, board volume, board type and fin type
• Your weight and your sport
• Whether you have the safety feature switched on and what time you are expected back, if you use that feature

For a saved session, others see in the feed, on your profile and on the leaderboards:

• Your name, the spot, the date, the duration and your gear
• Your weight and the wind conditions
• Your note and the hashtags you attached to it
• Your session photo
• Your speeds and distance, and — if your session comes from a sports watch or Apple Health — also your route on the map and your lap times

Also visible: who you follow and who follows you, the kudos and comments you leave on other people's sessions (with your name attached), and your messages and photos in the Spot Chat and in the groups you belong to.

Not visible to others: your email address, your date of birth, your password, your gear library, your notification settings and your connected accounts.

Your weight also counts towards the sail recommendation other users see (section 2.2). That contains only averages and counts — never who surfed the underlying sessions.

5.2 With Service Providers

We use the following external service providers (processors):

Service Provider	Purpose	Location
Supabase	Authentication, database, storage of sessions and profiles	EU (Ireland)
Google Firebase	Chat messages and push notifications; the servers handling the sports watch integrations and processing your photos	Database and photo storage: EU (multi-region Europe, resp. Belgium). Servers: USA (Iowa). SCCs apply
Vercel	Application hosting; weather requests are routed through servers in Frankfurt	EU (Frankfurt) and worldwide CDN
Cloudflare R2	Storage of chat photos, session photos, group photos and profile photos	Western Europe
MapTiler	Map material, estimating your country from your IP address when you open the app, and looking up a place name for a session without a known spot	Switzerland (adequacy decision), with a worldwide CDN
Open-Meteo	Wind, wave and weather forecasts per surf spot	Switzerland (adequacy decision)
KNMI and Rijkswaterstaat	Weather station and water level measurements; only station numbers are sent, no data about you	Netherlands
Resend	Sending the confirmation email on account deletion; only your email address goes to this service	EU (Ireland); the company itself is based in the USA
EmailJS	Sending reports, feedback and spot requests to the administrator of RigSize Live. This sends the content of your message, your email address in the case of feedback, and the text and sender of the reported message in the case of a report	Singapore, outside the EEA
Garmin Connect	Importing session and GPS data (optional)	USA (SCCs apply)
Suunto	Importing session and GPS data (optional)	EU (Finland)
Apple	Sign in with Apple, and distribution of the iOS app with associated technical telemetry. Data from Apple Health does not leave your device via Apple	USA / EEA (SCCs apply)
Google	Google Sign-In, and distribution of the Android app with associated technical telemetry	USA / EEA (SCCs apply)
unpkg and jsDelivr	Delivering the software libraries the app runs on in your browser. They see your IP address when the app loads, but receive no data about you	Worldwide CDN

We do not share your data with any other parties unless legally required by a court order or competent authority.

Marketing partners: When you have given consent for marketing emails (see section 2.10), your email address and profile data are not shared with our partners. RigSize Live sends the emails on behalf of partners ourselves; partners do not receive access to our contact list or any personal data about you. At present we do not work with any partner; as soon as that changes, the current list is available on request via the contact address in section 15.

6. Data Retention Periods

Data	Retention Period
Account data	As long as your account is active
Demographic profile data (gender, date of birth, nationality)	As long as your account is active, or until you delete it yourself
Location data (real-time)	During your session. Deleted immediately when you end it; if a session stays open due to a fault, an automatic cleanup removes the position no later than 12 hours after the start
Session history	As long as your account is active. After account deletion: anonymised (without name, photo, or identification, and without watch measurements or GPS tracks) and retained indefinitely for app statistics
Spot Chat: messages and photos	For as long as the spot exists. They disappear when you delete the message yourself or when you delete your account
Group chat: messages and photos	For as long as the group exists. They disappear when you delete the message yourself, when the group is deleted, or when you delete your account
Push notification tokens	Automatically deleted after 30 days without use
Suunto notifications about new activities	Up to 30 days in the processing queue
Externally imported session data, GPS tracks and session photos	As long as your account is active, or until you delete them yourself. There is no automatic cleanup
External access tokens (Garmin, Suunto)	Until you disconnect the integration, then immediately deleted
Feedback and spot requests	For as long as needed to handle your message and to retrieve the suggestion
Reports	Maximum 90 days
Blocked users	Stored locally on your device
Marketing opt-in and associated profile data	As long as your opt-in is active. After opt-out: contact details are removed from the mailing list; opt-in/opt-out timestamps are kept for up to 3 years as GDPR evidence

7. Your Rights (GDPR)

7.1 Account Deletion and Session Anonymisation

You can delete your account at any time via Settings → Profile → “Delete my account”. Upon deletion:

• Permanently deleted: your profile (name, photo, date of birth, gender, nationality, email address), gear library, friend relationships, kudos, comments, chat messages, photos, push notification settings, and your integrations with Garmin and Suunto. All measurements from your sports watch (speed, distance, session duration, heart rate and calories) and all GPS tracks are erased as well.
• Retained anonymously: only what you entered in RigSize Live yourself, plus the weather data we retrieve ourselves: the spot, your gear (sail or kite size, board volume, brand and type), your weight class and the wind conditions. Of the date, only the day remains. Name, photo, email, and all other identifying information are erased, as are all watch measurements and GPS tracks. Anonymous sessions contribute to app statistics and benchmarks (such as “average wind strength for a 5.4 sail”) but no longer appear in the feed, leaderboards or Insights.

Legal basis for anonymous retention: legitimate interest (Art. 6.1.f GDPR). Anonymous aggregates are essential for the operation of RigSize Live as a community app for other users, and no longer contain personal data.

You will receive a confirmation email once your account has been deleted.

Under the GDPR, you have the following rights:

• Right of access — you can request to see what data we process about you
• Right to rectification — you can have incorrect data corrected
• Right to erasure — you can request deletion of your data
• Right to restriction — you can have the processing of your data restricted
• Right to data portability — you can request your data in a structured format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw previously given consent (e.g., location sharing, or the integration with Garmin, Suunto or Apple Health) at any time

To exercise any of these rights, please contact us at info@rigsizelive.com. We will respond to your request within 30 days.

You also have the right to file a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).

8. Security

We take appropriate technical and organisational measures to protect your data:

• All communication takes place over encrypted connections (HTTPS/TLS)
• Passwords are stored in hashed form (never in plain text)
• Database access is restricted through security rules (Row Level Security)
• Chat photos are stored with security rules that limit uploads to verified users
• Spot Chat messages and their photos are deleted when you delete the message or your account
• Third-party integrations use industry-standard OAuth 2.0 authentication; we never store your third-party passwords

9. Cookies and Local Storage

RigSize Live uses:

• Local storage (localStorage) — here the app keeps your settings (language, units, map style, favourite spots), your authentication tokens, your list of blocked users, a locally generated device ID (UUID, for push notifications across multiple devices) and a copy of your profile data (name, date of birth, gender, nationality, weight, profile photo and gear), so that the app also works when you are briefly offline. This data stays on your own device and is erased when you log out or clear the app's data.
• Session cookies — for authentication with Supabase and Firebase.

We do not use tracking cookies or advertising cookies. For analytics: see section 5.2 (Firebase Analytics is only active in the native app, not in the web version).

10. Children

RigSize Live is not intended for children under the age of 16. We do not knowingly collect data from children under 16. If we discover that we have collected data from a user under 16, we will delete this data and the associated account as soon as possible.

11. International Data Transfers

Your account, your sessions and your photos are held within the European Economic Area (EEA): the database in Ireland, the chat data in a European multi-region (Belgium and the Netherlands), and the chat photos and the session and profile photos in Western Europe. Older Spot Chat photos remain in Belgium until they are deleted along with their message.

Part of our infrastructure, however, is located in the United States. The servers that send push notifications, handle the Garmin and Suunto integrations and process your photos before they are stored run in the us-central1 (Iowa) region of Google Cloud. In addition, Garmin, Apple, Google and the services we use to send email process data outside the EEA.

Most of these transfers are covered by appropriate safeguards: the European Commission's Standard Contractual Clauses (SCCs), or an adequacy decision — such as the one for Switzerland, where our map and weather services are located.

One exception: EmailJS, the service used to email reports, feedback and spot requests to our administrator, processes in Singapore and therefore outside the EEA. We have no data processing agreement with this party. It concerns a limited flow that you initiate yourself: the content of your message, your email address in the case of feedback, and the text and sender of the reported message in the case of a report. We are in the process of replacing this route with our own servers.

12. App Store Distribution

RigSize Live is available as a Progressive Web App (PWA) at www.rigsizelive.com and as a native app via the Apple App Store and Google Play Store. When you download the app via an app store:

• The App Store terms of Apple or Google apply to the download process
• Apple and Google may receive technical and statistical data in accordance with their own privacy policies
• At this time, RigSize Live does not offer in-app purchases or paid subscriptions. Should this change in the future, we will inform you clearly via the app and update this privacy policy before such features are activated.

This privacy policy applies to the use of the app itself, regardless of the platform through which you downloaded it.

13. Device Permissions (native app)

The iOS and Android app requests the following permissions. None of them are required for the basic functionality of the app — you can decline them individually or revoke them later via your device settings.

Permission	Used for
Location	When you press the location button yourself to move the map to you (that position stays on your device), and once when you start a session to record your starting point
Camera	Take photos for profile picture or session photo, only at the moment you actively initiate this
Photo library	Pick a photo from your existing library for profile or session photo, only when you actively initiate this
Apple Health (iOS)	Read access only to workouts, routes, heart rate and distance, and only if you switch the integration on yourself. We write nothing back to Apple Health
Push notifications	Wind alerts, chat messages, social notifications — only for the types you activate yourself in the notification settings
Vibrate (Android)	Tactile feedback when starting and stopping a session

14. Changes to This Privacy Policy

We reserve the right to modify this privacy policy. In the event of significant changes, we will notify you via the app. The most recent version is always available on this page.

15. Contact

For questions about this privacy policy or to exercise your rights: