Privacy Policy

The short version

Windmaster is a wind & wave forecast app for kitesurfers, windsurfers, and surfers. We collect the minimum data required to run the service: your sign-in email, your rider profile (gear, name, country — what you tell us), and the spots you save. Your rider profile + saved spots sync across devices via Supabase. We do not sell your data, and you can delete your account at any time from the Account page. Windmaster Pro is an optional paid subscription; payments are handled by Apple or Stripe, and we never see your card number.

Who we are

Windmaster is operated by Swipe Up B.V.(the “company”, “we”, “us”), a company registered in Amsterdam, the Netherlands (KvK 89034309). Swipe Up B.V. is the data controller for the personal data described in this policy. Full company details are on our Imprint. For privacy questions, reach out to hello@windmaster.app.

Information we collect

Account information

When you create an account, we collect your email address and a password (stored only as a salted hash by our auth provider, Supabase). We never see your raw password.

Rider profile (you choose what to share)

You can optionally fill in: first name, weight, height, gender, date of birth, country, kite/windsurf skill level, and gear quiver. These power gear-size recommendations and the saved view of your profile. Everything is optional — none of it is sold or shared with third parties.

Saved spots + UI preferences

We store the spots you save (slug, name, coordinates) along with your home-page ordering and unit preferences. Used solely to render your personalised home page on every device you sign in to.

Diagnostic logs

When something goes wrong (a failed save, an auth error), our servers log the error message + a generic identifier — never your password or rider data. Logs are retained for 30 days.

Subscription & billing data

If you subscribe to Windmaster Pro, we process your subscription status, the plan you chose, and the purchase identifiers needed to keep your access in sync across the web and the app. We never see or store your full payment card number: card payments on the web are handled by Stripe, and in-app purchases are handled by Apple. For purchases made in the iOS app we use RevenueCat to validate the receipt and manage your entitlement, linked to your Windmaster account ID.

Things we do NOT collect

• Your precise GPS location (you tell us spot coordinates explicitly)
• Photos, microphone, contacts, or any device-level data
• Browsing history outside the Windmaster app
• Behavioural advertising identifiers
• Your full payment card number (handled entirely by Apple or Stripe)

How we use your information

• To operate the forecast service and personalise your view
• To sync your data between devices when you sign in
• To recommend kite/sail sizes based on your gear + body data
• To provide and manage your Windmaster Pro subscription and access
• To send essential email confirmations (account verification, password reset)
• To debug failures via short-lived server logs

We do not use your data for advertising, profiling, or automated decision-making.

Third parties we use

Windmaster relies on a small number of vendors to operate. Each processes a specific slice of data on our behalf and is contractually bound by their own privacy commitments.

• Supabase — auth (email + password hash) and Postgres database (your rider profile + saved spots). EU / US hosted.
• Vercel — hosting + serverless functions. Receives standard request metadata (IP, user agent) for routing and rate limiting.
• Apple App Store — processes in-app purchases on iOS under your Apple ID. We receive only your resulting subscription status, never your card details.
• RevenueCat — manages iOS subscriptions. Receives your Windmaster account ID and Apple purchase data to validate receipts and track your Pro entitlement. No card details.
• Stripe — processes card payments for web subscriptions. Receives your email and payment details to complete the charge; we never receive your full card number.
• MapTiler— satellite imagery on spot detail pages. Receives the lat/lon of the spot you’re viewing in tile URLs. No personal identifiers.
• OpenFreeMap — basemap tiles on the map page. Open-source, receives no personal identifiers.
• Open-Meteo — wind / wave / temperature forecasts. Receives the lat/lon of forecast queries, no personal identifiers.

Data retention

Your account and rider data are retained as long as your account exists. When you delete your account from the Account page, every row tied to your user_id is removed from our database via cascading foreign keys — we don't keep a shadow copy. Server-side error logs are kept for up to 30 days and then auto-purged. Subscription and payment records may be retained by our payment processors (Apple, Stripe, RevenueCat) and by us for as long as tax and accounting law requires, even after you delete your account.

Your rights

Under GDPR / CCPA you have the right to:

• Accessthe data we hold on you — email us and we'll send you an export
• Correct any inaccurate data — most fields are editable directly on your Account page
• Deleteyour account + all associated data — self-serve via the “Danger Zone” on the Account page
• Portability — your saved spots and rider profile can be exported on request
• Object to processing — sign out + delete your account

Children's privacy

Windmaster is not directed at children under 13. We don't knowingly collect data from children. If you believe a child has provided us with information, contact us and we'll delete it.

Changes to this policy

When we materially change this policy, we'll bump the “Last updated” date at the top and notify signed-in users via email if the change affects how we process your data.

Contact

Questions, requests, or concerns? hello@windmaster.app.