Privacy Policy

Last updated: September 2026

1. Data Controller

Responsible for the operation of SurfDiary (app and website):

Mathias Meyer
18057 Rostock, Germany
Email: mail@balticstudio.com

2. What is SurfDiary?

SurfDiary is a private Android app for logging kite, wing and surf sessions, along with a website providing wind forecast features for kitesurfers, wingsurfers and windsurfers.

3. Data in the Android App

The app stores all entered data (sessions, spots, equipment) exclusively on the device. This data never leaves the device.

Optional Wind Forecast Feature

The Wind Forecast feature is disabled by default. As long as it is disabled, no data is transmitted to any external service.

When you explicitly enable the feature in the app under Menu → Wind Forecast, the following data is transmitted:

• Anonymous device identifier (Device ID): A device-specific identifier (Android ID) used solely to limit the number of linked forecast spots. It is stored in our database. Legal basis: Art. 6(1)(a) GDPR (consent).
• IDs of your linked spots and current map area: Technically necessary for the forecast request. Not stored permanently.

You can disable the feature at any time. Your spot links are kept locally. To delete the stored device identifier from our server, please use the deletion form.

4. Data on the Website

Server Logs

The hosting provider (flatbooster.com, Germany) stores technical access logs (IP address, time, page accessed). Logs are deleted after 7 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

Spot Requests

When submitting a spot request or change suggestion, the following data is collected:

• Email address: used solely for spam prevention (double opt-in) and deleted after the request is processed. Legal basis: Art. 6(1)(b) GDPR.
• Spot data (name, coordinates, wind settings, safety notes, local tips): published publicly after approval. Spot data contains no personal data and is available to all users — deletion by the submitter after publication is not provided for.

Usage Log (log_usage)

Our server logs API requests for usage and capacity analysis. Two categories are distinguished:

• App requests (personal data): When you have enabled the Wind Forecast feature, app requests are logged with your UUID. Data stored: request type (e.g. map loaded, forecast refreshed), UUID, spot ID, timestamp. No IP address is stored. Legal basis: Art. 6(1)(a) GDPR (consent by enabling the feature).
• Anonymous requests (not personal data): Accesses via the web browser (map on this website) and automated crawls by search engines are logged without UUID. These entries contain no personal data.

Retention: 90 days, then automatically deleted.
Deletion on request: Upon a data deletion request (Art. 17 GDPR), your UUID is anonymised in all log entries (set to NULL). The time series is kept for statistical purposes but can no longer be linked to your device.

Feature Usage Summary (log_forecast_user_summary)

In addition to the 90-day log, we store a permanent summary per device if you have enabled the Wind Forecast feature:

• Data stored: UUID, date of first use, date of last request, total request count. No content of individual requests.
• Purpose: Long-term feature adoption and retention analysis (e.g. how many devices use the feature on an ongoing basis).
• Retention: Permanently until a deletion request — no automatic expiry.
• Deletion: Upon a data deletion request (Art. 17 GDPR), this entry is completely and irreversibly deleted.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest — product analysis and capacity planning).

Maps (OpenStreetMap / Nominatim)

The map uses tiles from OpenStreetMap. The map search (magnifying glass) in the app and in the location picker uses the Nominatim service of the OpenStreetMap Foundation (OSMF) — your IP address and search text are transmitted to OSMF servers. The search is available independently of the Wind Forecast feature and does not require consent. Legal basis: Art. 6(1)(b) GDPR (necessary to perform the requested function). See the OSMF Privacy Policy.

Cookies

• lang (functional): stores your language preference (DE/EN) for 1 year. No tracking.
• Session cookie (technically necessary): admin area only, expires when the browser is closed.

5. Weather Data

Forecast data is provided by the free Open-Meteo API (no personal data transmitted).

6. Your Rights

You have the following rights:

• Access (Art. 15 GDPR): What data we have stored about you.
• Rectification (Art. 16) and erasure (Art. 17): For the stored device identifier, use the deletion form. For other data, contact us by email.
• Withdrawal of consent: You can disable the Forecast feature at any time in the app (Menu → Wind Forecast). Data transmission stops immediately.
• Complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Contact: mail@balticstudio.com

7. Hosting

The server is operated by flatbooster.com, hosted in Germany.