Privacy Policy

Surflink ("Surflink", "we", "us") is an AI-powered surf coaching platform available at surflink.ai and through our iPhone, Apple Watch, and Apple TV apps. This policy explains what we collect, why, where it lives, who can see it, and how to get it deleted. Questions or requests: admin@surflink.ai.

• Account data — name, email address, password (stored as a salted hash by our authentication provider), optional phone number for SMS notifications, profile photo, timezone, and home surf break.
• Coaching content — session videos and clips you upload or film, AI analysis derived from them (surfer tracking, pose, ride segmentation), coach annotations, drawings, voice notes and their transcripts, guided reviews, drills, competition results, and messages between coaches and athletes.
• Health and workout data (Apple Watch) — with your explicit HealthKit permission, the watch app records surf workouts: heart rate, active energy, GPS location and speed, and high-rate motion data. We use it solely to produce your surf metrics (waves, speeds, effort) and to sync with session video. Health data is never used for advertising, never sold, and never shared with third parties for marketing. It is not stored in iCloud; it syncs to our own backend only after you consent.
• Precise location — GPS during a recorded surf session (to map waves and speeds) and the surf spots you attach to sessions. Athletes choose how much of this a coach sees (see "Athlete privacy settings" below).
• Camera files — when a coach connects a camera to the iPad (a Sony camera on a cable, or a RED camera over its own Wi-Fi), Surflink reads the camera's recordings and uploads a review copy of each ride, exactly like a ride filmed in the app. The camera's original never leaves the iPad unless the coach keeps it there on purpose. A camera's sign-in details, if it needs any, stay in the iPad's keychain and are never sent to us.
• Guardian contact details — for an athlete aged 13 to 17 who holds their own login, the name and email address or mobile number of the parent or guardian who approves the account, and the child's date of birth if the parent gives it. A parent who chooses to see their child's coaching also has a Surflink login: their name, email address and password (see "What a parent can see").
• Payment data — club subscriptions are processed by Stripe. We never see or store full card numbers; we keep the subscription status, plan, and invoice history Stripe reports to us. Surflink does not handle payments between athletes and coaches.
• Usage and diagnostics — product analytics (PostHog) and crash/error reports (Sentry) tied to your user ID, used to fix bugs and improve the product. We do not use cross-app tracking and we do not sell data to data brokers.

A coach can film on an iPhone and see each ride, and a live picture, on an iPad nearby. That link runs directly between the two devices over the local network or peer-to-peer Wi-Fi; nothing in it touches our servers. What crosses the link is the ride video, a live picture while the camera screen is open, and camera state — never health data, location, sign-in tokens or contacts. Every packet is encrypted with keys the two devices agree on when they pair (confirmed by a number read off the iPad); the live picture is never recorded, and ride copies on the iPad are deleted after seven days and on sign-out.

Athletes control what their coaches see of their watch data, from the app (You → Privacy): whether speed and distance numbers are shared, whether heart rate is shared (calories go with it: the two are shared or withheld together), and how precise the location is — the exact GPS track (the default), the surf spot only, or nothing. Until an athlete changes them, a coach sees the numbers, the heart rate and calories, and the exact GPS track. These choices are enforced on our servers, so a coach's app, a parent's app, the website and the TV all show the same thing, and if our servers cannot read an athlete's choices they withhold all of that data rather than fall back to the defaults.

Messages between coaches and athletes are stored so the people in the conversation can read them (and a parent of an athlete under 18 can read the child's one-to-one messages with their coaches — see "What a parent can see"). Before a message is saved, our database checks its words against a list of slurs, explicit sexual words and severe profanity; a message that matches is not sent, and the sender is told why so they can change it. The check is automatic — no person reads messages to run it — and photos and other attachments are not scanned. A conversation can also be reported or blocked from the app.

A parent or guardian who approves a 13-to-17 athlete's account can see what the child's coach sees of the child, read only, in the Surflink iPhone app: sessions and rides, drills and progress, heart rate and calories, the GPS track, reviews, and the one-to-one messages between the child and their coaches. The child's privacy settings apply to a parent exactly as they apply to a coach, and the child and their coaches are told that a parent can see.

• What a parent never sees — group chats, the other surfers in a group lesson, and the child's own marks (what they have watched, "Got it", and read receipts). A parent reading something never marks it as read or watched, so no one is ever shown that a parent read it.
• Who — the parent who approved the account, and at most one more parent they invite by email. A parent can't reply to anyone or change anything.
• Notifications — a parent is told about new reviews and new one-to-one messages, and can turn either off.
• How it ends — each parent can end their own access at any time. It ends for every parent on the child's 18th birthday; we tell the parents and the child 30 days before. A parent's login is deleted the day after it has no child left, unless the same login is also used for something else, such as coaching.

Data is stored with Supabase (database, authentication, and file storage) in the United States, with video processing on our own inference infrastructure and, for some clips, Cloudflare Stream. Access inside the platform is enforced with database-level row security: coaches see only the athletes assigned to them and athletes see their own data. A parent sees only their own child, and only through our servers after we check that the parent's access is still open. There are no public athlete profiles.

Three age rules apply, and all three fail closed — an athlete whose age we do not know is treated as a minor:

• Under 13 — the athlete cannot hold their own login. A parent or guardian must accept the coach's invitation and be the primary account holder.
• 13 to 17 — an athlete may hold their own login, but the account is marked as pending until a parent or guardian approves it. When the athlete accepts a coach's invitation they name their guardian, who receives an approval link by email or text message. Deleting such an account also asks the guardian first. We keep the guardian's name and contact details as the record of that approval. The guardian can also choose to see their child's coaching until the child turns 18 (see "What a parent can see").
• Under 16 — nothing about the athlete is published to a public, unauthenticated page. Any shareable report about them stays behind sign-in or requires the guardian's action.

Guardians can request their child's data or its deletion at any time via admin@surflink.ai.

• In-app deletion — sessions, clips, wearable recordings, and athletes can be deleted inside the product. Deleting a clip or a session removes its video and analysis files from storage too, and deleting a wearable session removes both the database record and the raw sample file. Messages cannot be deleted one by one in the app; to have them removed, email us (see "Your rights").
• Account deletion — available in the iPhone app (You → Privacy → Delete my account; a coach: You → your profile → Privacy and account → Delete my account) and by email. It removes your profile, sign-in, and buffered device data; coaching content you created for an organization may be retained by that organization where it is their business record.
• Export — you can request a copy of your data from the app (You → Privacy → Export my data), once a day. We build an archive of your profile, sessions, watch recordings, reviews and messages and email you a download link that expires after seven days.
• Backups — encrypted database backups roll off automatically within the retention window (currently 7 days).

We share data only with the service providers that run the platform — Supabase (data), Stripe (payments), Cloudflare (video delivery), Resend (email), Twilio (SMS), Apple (push notifications), PostHog (analytics), Sentry (crash reporting), and our AI processing providers (video analysis, and transcription of the voice notes coaches record in reviews) — each bound to process it only on our instructions. We also share competition results with the ranking bodies you connect (e.g. WSL, LiveHeats) only where those results are already public. We do not sell personal data.

You can access, correct, export, or delete your personal data, and object to or restrict certain processing. Export and deletion are available in the app; for anything else, email admin@surflink.ai and we will respond within 30 days. If you are in the EU/UK you may also lodge a complaint with your supervisory authority.

If we materially change this policy we will update the date above and notify active accounts by email or in-app notice before the change takes effect.