Privacy Policy

← Back

1. Data Controller

2. What Data We Collect

2.1 Account Data

Upon registration, we collect:

• Email address
• Password (stored in encrypted form)
• First name and last name

2.2 Profile Data

Optionally, you may provide the following information:

• Sport(s): windsurfing, kitesurfing, wing foiling
• Gear data: sail size, board volume, kite size, wing size
• Body weight
• Gender
• Date of birth
• Nationality

These demographic data points are used exclusively for leaderboard filters (e.g. filtering by age category or gender) and are never shared with third parties without your consent.

2.3 Location Data

During an active session, we collect:

• GPS coordinates (latitude and longitude)
• Selected surf spot

2.4 Chat Data

When using the Spot Chat feature:

• Text messages
• Photos (compressed to a maximum width of 1200px)
• Time of sending
• First and last name of the sender

Chat messages and photos are automatically deleted after a fixed retention period.

2.5 Session Data

• Start and end time of sessions
• Selected surf spot
• Gear used

2.6 Garmin Connect™ Integration

You can connect RigSize Live to Garmin Connect™. By authorizing the connection, you explicitly give RigSize Live permission to retrieve activity data from your Garmin Connect™ account. The following data is received with your consent:

• GPS tracks (latitude, longitude, altitude)
• Session duration and time
• Speed data
• Heart rate (if available via your device)
• Activity type (windsurf, kite, wing, etc.)
• Device information (model of your sports watch or GPS device)

Data transfer to Garmin: When connecting your account, your authorization is processed via Garmin's servers. This means that certain technical data (such as your authorization request) is shared with Garmin International, Inc. as part of the OAuth2 connection process.

You can disconnect the integration at any time via Settings → Garmin Connect in the app, or directly through your Garmin Connect™ account. Upon disconnection, the access tokens are immediately deleted. Previously imported session data will remain in your account until you delete it or cancel your account.

2.7 Reports

When you report a chat message, we store: the reported message ID, the reason for the report, and your user ID.

3. Legal Basis for Processing

Processing	Legal Basis (GDPR)
Account and authentication	Performance of the contract (Art. 6.1.b)
Location sharing and session tracking	Consent (Art. 6.1.a)
Spot Chat messages	Performance of the contract (Art. 6.1.b)
Leaderboards and statistics	Performance of the contract (Art. 6.1.b)
External integrations (Garmin)	Consent (Art. 6.1.a) — you consciously connect your account
Reports and moderation	Legitimate interest (Art. 6.1.f) — user safety
Demographic profile data (gender, date of birth, nationality)	Consent (Art. 6.1.a) — optional, used for leaderboard filters
Own communications about features and updates	Legitimate interest (Art. 6.1.f) — always opt-out available
Offers from selected partners	Consent (Art. 6.1.a) — separate opt-in required, always revocable

4. Purposes of Processing

We use your data exclusively for:

• Providing and improving the RigSize Live service
• Displaying your location and gear data to other active users on the real-time map
• Storing and displaying your session history and statistics
• Facilitating the Spot Chat feature
• Compiling leaderboards
• Automatically importing session data from external platforms (such as Garmin) when you have given consent
• Handling reports and enforcing the code of conduct
• Ensuring the safety and integrity of the app

We do not sell your data to third parties.

Own communications: RigSize Live may inform you about new features, updates, and its own offers. We do this on the basis of legitimate interest. You can unsubscribe at any time via your account settings.

Partner offers: In the future, we may collaborate with carefully selected partners to show you relevant offers for surf-related products and services. We will only do this based on your explicit, prior consent (opt-in). You can withdraw this consent at any time via your profile settings in the app, without any consequences for the other services provided.

5. Sharing of Data

5.1 With Other Users

The following data is visible to other users of the app:

• Your first and last name
• Your location on the map (only during an active session)
• Your gear data (only during an active session)
• Your chat messages and photos in the Spot Chat
• Your session statistics on leaderboards

5.2 With Service Providers

We use the following external service providers (processors):

Service Provider	Purpose	Location
Supabase	Authentication, database, session storage	EU (Frankfurt)
Firebase / Google Cloud	Chat, photo storage	EU (Belgium)
Garmin Connect	Importing session and GPS data (optional)	USA (SCC applicable)
Cloudflare R2	Storage of chat photos and profile photos	EU
Vercel	Application hosting	Worldwide (CDN)

We do not share your data with any other parties unless legally required by a court order or competent authority.

6. Data Retention Periods

Data	Retention Period
Account data	As long as your account is active
Demographic profile data (gender, date of birth, nationality)	As long as your account is active, or until you delete it yourself
Location data (real-time)	Only during an active session; removed from the map immediately after
Session history	As long as your account is active
Chat messages and photos	Automatically deleted after a fixed retention period
Externally imported session data	As long as your account is active, or until you manually delete it
External access tokens (Garmin)	Until you disconnect the integration, then immediately deleted
Reports	Maximum 90 days
Blocked users	Stored locally on your device

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access — you can request to see what data we process about you
• Right to rectification — you can have incorrect data corrected
• Right to erasure — you can request deletion of your data
• Right to restriction — you can have the processing of your data restricted
• Right to data portability — you can request your data in a structured format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw previously given consent (e.g., location sharing, Garmin connection) at any time

To exercise any of these rights, please contact us at info@rigsizelive.com. We will respond to your request within 30 days.

You also have the right to file a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).

8. Security

We take appropriate technical and organisational measures to protect your data:

• All communication takes place over encrypted connections (HTTPS/TLS)
• Passwords are stored in hashed form (never in plain text)
• Database access is restricted through security rules (Row Level Security)
• Chat photos are stored with security rules that limit uploads to verified users
• Chat messages are automatically deleted after a fixed retention period
• Third-party integrations use industry-standard OAuth 2.0 authentication; we never store your third-party passwords

9. Cookies and Local Storage

RigSize Live uses:

• Local storage (localStorage) — for storing your session settings, authentication tokens, and list of blocked users. This is necessary for the app to function.
• Session cookies — for authentication with Supabase and Firebase.

We do not use tracking cookies, advertising cookies, or third-party analytics.

10. Children

RigSize Live is not intended for children under the age of 16. We do not knowingly collect data from children under 16. If we discover that we have collected data from a user under 16, we will delete this data and the associated account as soon as possible.

11. International Data Transfers

We strive to keep your data within the European Economic Area (EEA). Where service providers process data outside the EEA (such as Vercel's CDN or Garmin's servers), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCC) or an adequacy decision.

12. App Store Distribution

RigSize Live is available as a Progressive Web App (PWA) at www.rigsizelive.com and as a native app via the Apple App Store and Google Play Store. When you download the app via an app store:

• The App Store terms of Apple or Google apply to the download process
• Apple and Google may receive technical and statistical data in accordance with their own privacy policies
• RigSize Live contains no in-app purchases or paid subscriptions

This privacy policy applies to the use of the app itself, regardless of the platform through which you downloaded it.

13. Changes to This Privacy Policy

We reserve the right to modify this privacy policy. In the event of significant changes, we will notify you via the app. The most recent version is always available on this page.

14. Contact

For questions about this privacy policy or to exercise your rights: