Privacy Policy
Nederlandse samenvatting
Breeza verzamelt: een anonieme account-UUID (geen naam of e-mail tenzij je dat zelf kiest), je rijdersprofiel (gewicht, discipline, niveau, gear) en optionele sessie-feedback.
We vragen toestemming voor je locatie om de dichtstbijzijnde spots te tonen; je kunt dit weigeren. Je exacte coördinaten blijven op je toestel — naar onze server gaat alleen een grofmazig gebied (een begrenzingsvak) om nabije spots op te halen, nooit je precieze positie.
We verkopen je data nooit. Je kunt je account inclusief alle persoonlijk gekoppelde data verwijderen via Instellingen > Account > Account verwijderen.
Vragen? Mail naar hello@breeza.io.
1. Introduction
Breeza ("we", "our", "the app") is a kitesurf session assistant. Based on your rider profile (weight, skill level, gear) and a chosen time window, Breeza shows you which curated spots have rideable conditions right now or in the next hours.
This Privacy Policy explains which personal data we collect, why, how we store and protect it, and your rights under the General Data Protection Regulation (GDPR) and applicable Dutch/EU law. By using Breeza you agree to the practices described here.
2. Data We Collect
We collect the minimum data necessary to deliver the service.
2.1 Account Identifier
What: An anonymous UUID assigned by our authentication provider (Supabase anonymous auth) when you first open the app. No name, no email address, no phone number is collected at this stage.
Why: To link your rider profile and session feedback to a single, deletable account without requiring personal registration data.
Linked to identity: The UUID is linked to your profile data (see 2.2) but is not inherently tied to any real-world identity you have not voluntarily provided.
Optional email: If you choose to upgrade your anonymous account by linking an email address (optional feature), that email is stored and used solely for account recovery and authentication.
2.2 Rider Profile
What: Weight (kg), discipline (twin-tip / surfboard / kite foil / wing foil), skill level (beginner / intermediate / expert), and kite or wing sizes in m² (quiver).
Why: To calculate whether wind conditions at a spot are suitable for you specifically. Without a profile the core scoring function cannot run.
Storage: Stored server-side in your account row, hosted on Supabase in the EU region.
2.3 Session Feedback
What: After a suggested session window you can optionally submit feedback — the verdict the app predicted, your outcome, a minimal conditions snapshot, the spot identifier and time window evaluated, and the kite or wing size you actually used (optional, nullable).
Why: To calibrate and improve the accuracy of future recommendations.
Linked to identity: Each feedback row is linked to your account UUID at insert time. If you delete your account, the user identifier is set to NULL — the calibration signal is preserved anonymously; the link to your account is severed permanently.
2.4 Device Location
What: Breeza requests your device's foreground location permission (the standard iOS/Android system prompt) so it can rank our curated list of spots by distance from you. You can decline this prompt at any time; the app still works with the full spot list, just unsorted by distance.
Where it stays: Your device coordinates are read on-device via the OS location API and cached locally in the app's on-device storage, so the app doesn't need to re-prompt every time you open it. Your exact coordinates are never uploaded to or stored on our servers.
What we do send: To fetch nearby spots, the app sends a coarse bounding box derived from your location (a rectangular area, not your exact coordinates) to our spot catalog. That request returns public spot data (name, region, coordinates, timezone) — the same data any visitor to breeza.io can see — and is not logged or linked to your account.
Spot coordinates (the fixed lat/lon of each surf spot, not your device location) are used separately to fetch forecast data from the weather service.
2.5 Usage Analytics
The Breeza website (breeza.io) uses Google Analytics 4 (GA4) to understand how visitors use the site. Analytics data is only collected after you explicitly accept cookies via the consent banner.
What is collected: page views, referral source, and waitlist sign-up conversions. IP addresses are anonymised before processing. No advertising profiling.
Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing your browser cookies or by declining the banner on a new visit.
Opt-out: Use the Google Analytics Opt-out Browser Add-on.
The mobile app does not collect usage analytics in the current release.
3. Third Parties
We do not sell your data. We share data only as follows:
| Processor | What is shared | Purpose |
|---|---|---|
| Supabase | Account UUID, profile, feedback, coarse location (bounding box, only to fetch nearby spots — see 2.4) | Database and authentication hosting (EU region) |
| Open-Meteo (via our own edge function) | Spot coordinates (fixed lat/lon, not your device location) | Wind/weather forecast retrieval. No personal data shared; spot coordinates are public geographic data. |
| Apple / Google | Standard store and crash telemetry | Platform operation, governed by Apple/Google privacy policies |
Open-Meteo is accessed via Breeza's own backend edge function; raw responses are not forwarded to the client and are not stored.
4. Legal Basis (GDPR Art. 6)
| Data | Legal Basis |
|---|---|
| Account UUID | Contract performance (Art. 6(1)(b)) — needed to link profile and enable deletion |
| Rider profile | Contract performance — core to service delivery |
| Session feedback | Legitimate interest (Art. 6(1)(f)) — service calibration; balanced against minimal data |
| Optional email | Consent (Art. 6(1)(a)) — only if user chooses to link email |
| Device location (coarse bounding box) | Consent (Art. 6(1)(a)) — permission-gated via the OS location prompt; revocable at any time in your device Settings |
5. Data Retention
| Data | Retention |
|---|---|
| Account UUID + rider profile | Until you delete your account |
| Session feedback (linked) | Until you delete your account; after deletion: anonymised permanently (user link removed) |
| Anonymous feedback rows | Retained indefinitely as anonymised calibration data; cannot be re-linked to you |
| Optional email (if provided) | Until you delete your account |
| Device location (exact coordinates) | Never leaves your device — cached locally, not sent to or retained on our servers |
| Device location (coarse bounding box, sent to fetch nearby spots) | Not stored server-side; the request is stateless and not logged against your account |
After account deletion, all personally linked data is removed within 30 days. Anonymised aggregate data (calibration rows with no user link) may be retained permanently as it cannot be traced back to you.
6. Your Rights (GDPR)
- Access: Request a copy of the data we hold about you.
- Rectification: Correct inaccurate profile data directly in the app (Settings > Profile).
- Erasure: Delete your account and all linked personal data via Settings > Account > Delete account, or by contacting us.
- Portability: Request your data in a machine-readable format.
- Restriction: Request restriction of processing in specific circumstances.
- Object: Object to processing based on legitimate interest.
- Withdraw consent: If you linked an email address, you may remove it or request deletion at any time.
Contact us at: hello@breeza.io
We respond within 30 days. You may also lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.
7. Account and Data Deletion
You can delete your Breeza account directly from the app:
Settings > Account > Delete account
This permanently removes your rider profile (weight, discipline, level, quiver), your account UUID, and the profile row (cascade delete). Session feedback rows are anonymised: the user identifier is set to NULL; the calibration data itself is retained but permanently unlinked from you.
You can also request deletion by emailing hello@breeza.io. We process the request within 30 days.
Web deletion alternative (required by Google Play): breeza.io/account/delete.
8. Data Security
- Row Level Security (RLS): users can only read and write their own rows.
- Session feedback is insert-only for authenticated users; no read-back via client API.
- HTTPS/TLS for all data in transit.
- Anonymous-auth tokens, not plain passwords.
- Device location is permission-gated and processed on-device (see section 2.4). Only a coarse bounding box — never your exact coordinates — is sent to fetch nearby spots, and it is not stored server-side.
9. Children's Privacy
Breeza is not directed at children under 13 (or under 16 in EU member states where a higher minimum age applies). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately.
10. Changes
We may update this Privacy Policy. Material changes will be communicated via an in-app notice or, if email is linked, by email. Continued use after the effective date of changes constitutes acceptance of the updated policy. The "Last updated" date at the top reflects the most recent revision.
11. Contact
Breeza
Email: hello@breeza.io
Website: breeza.io