Privacy Policy

Freediver · Version 2026-07-10 · Effective 10 July 2026

Template notice. This is a general, plain-language privacy policy assembled from widely-recognized data-protection standards (EU/UK GDPR, the California CCPA/CPRA, and the Apple App Store and Google Play data-disclosure requirements). It is a starting point, not legal advice. Before public launch, have it reviewed by a qualified privacy professional and fill in the bracketed placeholders: the data controller [COMPANY_LEGAL_NAME], contact address [CONTACT_EMAIL], and governing jurisdiction [GOVERNING_JURISDICTION].

This policy explains what personal data the Freediver app ("Freediver", "we", "us") collects, why we collect it, how we use and share it, how long we keep it, and the rights you have over it. It applies to the Freediver mobile app and its backend service.

The data controller responsible for your personal data is [COMPANY_LEGAL_NAME]. For any privacy question or to exercise a right below, contact us at [CONTACT_EMAIL].

1. Who can use Freediver

Freediver is not directed to children. You must be at least 16 years old to create an account. We ask you to confirm your age at sign-up. If we learn we have collected data from someone under the minimum age, we will delete it.

2. What we collect and why

We practise data minimization: we collect only what the app needs to work. The categories are:

Category	Examples	Why	Lawful basis (GDPR)
Account & identity	Email address, and a username you choose	To create and secure your account, and let friends find you by username	Contract
Dive & training logs	Depths, times, disciplines, breath-hold data, ratings, notes, and any dive-computer files you import	The core logbook: to store, display, and chart your own activity	Contract
Location	An optional home location, and coordinates of dive sites you add	To center your map and record where you dived — only when you provide it	Consent
Social	Friends, friend requests, blocks, and messages you send	To provide friend and chat features you choose to use	Contract
Consent records	Which policy version you accepted and when	To prove lawful consent	Legal obligation / legitimate interest
Technical & diagnostic	App version, device/OS type, and error logs	To keep the app working and fix bugs	Legitimate interest

A note on health-related data

Freediving logs describe physical performance (depth, breath-hold duration, heart rate from an imported device). Depending on where you live, some of this may be treated as health-related or otherwise sensitive data. We use it only to provide the logbook and the statistics you ask for. We do not use it for advertising, and we do not sell it. Where the law requires explicit consent for such data, your use of the logging features and your acceptance of this policy constitute that consent, which you may withdraw at any time by deleting the data or your account.

3. How we use your data

We use your data to: operate the logbook and statistics; provide the map, events, and social features you choose to use; secure your account and prevent abuse; respond to your requests; and meet legal obligations. We do not sell your personal data, and we do not use it for third-party advertising or cross-context behavioural advertising. We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. When we share data

We share personal data only in these limited cases:

With other users, at your direction. Your username is visible to people who can find you; content you explicitly share (a message, or an item you share into a chat) is visible to the people you share it with. You control this through the app's privacy and sharing controls.
Service providers that operate the app on our behalf — for example our cloud hosting and authentication provider — under contracts that restrict them to processing data only for us. We use Supabase for authentication and database hosting and a cloud platform for the API.
Legal and safety — where we must comply with the law, enforce our Terms, or protect the rights and safety of users. Messages that are reported for abuse may be retained and reviewed for this purpose.
Business transfer — if the service is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this policy.

5. International transfers

Your data may be processed in countries other than where you live, including where our service providers operate. Where required, we rely on recognized transfer mechanisms (such as the European Commission's Standard Contractual Clauses) to protect it.

6. How long we keep it

We keep your account and log data for as long as your account is active. When you delete your account, we erase your private logbook and social graph promptly. Some data is kept longer where we have a legal basis: content reported for abuse may be retained for moderation and legal-claims purposes, and shared community content you contributed may remain visible but is disassociated from your identity. Backups are cycled out on a rolling schedule.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or the California CCPA/CPRA), you have some or all of these rights:

Access / know — get a copy of the data we hold about you. The app provides a one-tap Download my data export.
Deletion / erasure — delete your account and data. The app provides Delete account.
Correction — fix inaccurate data; most of it you can edit directly in the app.
Portability — receive your data in a portable format (the export is JSON).
Object / restrict — object to or restrict certain processing.
Withdraw consent — where we rely on consent, withdraw it at any time.
Opt out of sale/sharing — we do not sell or share personal data for advertising, so there is nothing to opt out of, but you retain the right.
Non-discrimination — we will not treat you differently for exercising a right.
Complain — lodge a complaint with your local data-protection authority.

To exercise a right you can use the in-app tools or contact [CONTACT_EMAIL]. We will respond within the time the law requires.

8. Security

We protect your data with encryption in transit and at rest, access controls, and least-privilege practices. Authentication is handled by our identity provider; we never store your password. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires.

9. Changes to this policy

We may update this policy. When we make a material change we will update the version and effective date above and, where appropriate, ask you to review or re-accept it. Continued use after an update means you accept the revised policy.

10. Contact

Questions or requests: [CONTACT_EMAIL]. Data controller: [COMPANY_LEGAL_NAME]. Governing jurisdiction: [GOVERNING_JURISDICTION].