SaltRiders privacy policy
Last updated: July 2026
The short version
SaltRiders is a safety-first surf-coordination app, not a social network. We collect the minimum needed to run your account and the features you use. No advertising, no data sale, no tracking across other apps or websites, no engagement analytics. Your safety signals are never used for marketing — or anything except safety.
What we collect
Account: your email address and password credentials (managed by Supabase Auth). Your date of birth, which you tell us once when you join: SaltRiders is for surfers 16 and over, we keep what you declared as the record that we asked, and no other member can see it. Profile: the display name, handle, pronouns, stance, skill level, home region, and avatar you choose. Content you create: sessions, pulses, crew messages, session-log entries, marketplace listings and messages, reports, and photos you upload. Safety records: your safety-quiz result, Respect Code acceptance, blocks, and reports. Device: if you enable push notifications, a push token for your device.
Location is region-level only
SaltRiders never collects or stores precise GPS coordinates. Places are represented at region level (for example “Perth Metro”). Photos are stripped of embedded location metadata on our servers before they become visible. There are no crowd maps and no spot-level tracking, by design.
How we use it
To run the app: showing your profile to other members per your settings, coordinating sessions and crews, delivering notifications you have enabled, and keeping the community safe (reports, blocks, restriction decisions — always with human review for consequential decisions). We do not build advertising or engagement profiles, and feeds are chronological.
Crash reports, not our analytics
We run no product-analytics or tracking SDK of our own, and there is no advertising identifier. The app sends anonymous crash reports (via Sentry) so we can fix defects; these are scrubbed of personal data, are not linked to your identity, and never include your safety signals. The third-party components we build on do report their own diagnostics: Stripe records product-interaction events for its own analytics, and Google's sign-in library reports a device identifier and a coarse, network-derived location. We never ask your device for your location, and none of this is used for advertising.
Who processes your data
Supabase (authentication, database, and file storage), Stripe (card payments, and — if you sell gear or coach — identity and bank details you provide directly to Stripe to be paid; we never see your card number), Apple and Google (sign-in, and push-notification delivery via APNs and Firebase Cloud Messaging if you enable push), and Sentry (anonymous crash diagnostics). These providers process data only to run SaltRiders. We do not sell or share your data for advertising.
Buying, selling, and lessons
When you buy gear or book a lesson we store the order — what it was for, the amount, its status, and Stripe's reference for the payment — so both sides can see what was agreed. Card details go straight to Stripe and never touch our servers. Sellers and coaches complete Stripe's own onboarding, which asks Stripe (not us) for legal name, date of birth, address, government ID and bank details in order to pay them out.
Who can see what
Access is enforced row-by-row in the database. Other members see only what the app's rules allow: region-level activity, profiles per your visibility, and opt-in spaces (like women-only sessions) restricted to verified eligibility. Blocking someone hides you from each other everywhere. Precise meetup details are revealed only to approved participants.
Your rights: export and deletion
From Settings you can export your data (GDPR Art. 20) and permanently delete your account and personal data (GDPR Art. 17) — immediately, from within the app, no support ticket required. Deletion removes your account and personal records; an anonymized erasure record is retained as a legal audit trail.
Retention
We keep your data while your account exists. When you delete your account, personal data is erased or de-identified. Safety records that must survive for legal or community-protection reasons (for example reports about conduct) are retained in de-identified form.
Children
SaltRiders is not directed at children. You must be at least 16 to create an account.
Changes and contact
We will update this policy as the product evolves and note the date above. Questions or requests: privacy@saltriders.com.