OceanLog — Privacy Policy

⚠️ DRAFT / PLACEHOLDER. This is a working summary of how OceanLog handles your data, pending review by our legal counsel (María, Letslaw — meeting 18 Jun 2026). It will be replaced with the finalised, GDPR-reviewed policy before public launch. It reflects our genuine intent today.

Who we are

OceanLog is an AI multi-sport coaching & logging service operated by a Spanish company (SL). Contact: xisco@oceanlogapp.com.

What we collect

Account: email, and what you choose to add (name, sports, home base).
Sessions you log: spot, conditions, gear, your written reflections.
Special-category data (only what you provide): health (heart rate / effort from a watch or manual entry) and precise location (surf/kite spots, GPS tracks). We process these only with your explicit consent, given at sign-up.
Photos: any you upload. We strip EXIF/GPS metadata on upload so a photo can't leak where you surf.

How we use it

To run the service: store your log and generate your AI coaching reports.
During beta: the operator may review your logged sessions and AI-generated reports to test and improve the service. You consent to this at sign-up; it is limited to improving OceanLog.
Coaches: if you link a coach, they can see the sessions/reports you've shared with them — including special-category data — only because you consented to that sharing. You control it and can stop it.
We do not sell your data. The AI never receives your photos (display-only).

Secret spots

Any session or spot you mark secret is location-hidden — never shown to a coach or friend, never surfaced by the AI, and its photos never leak the location.

Your rights (GDPR)

You can access, correct, export or delete your data, and withdraw consent, at any time — in the app or by emailing us. Health and body data are kept to you alone unless you explicitly approve sharing.

Storage & security

Data is stored on Supabase (EU) with per-user row-level security. See our security contact.