Privacy Policy
Nederlandse samenvatting
Breeza verzamelt: een anonieme account-UUID (geen naam of e-mail tenzij je dat zelf kiest), je rijdersprofiel (gewicht, discipline, niveau, gear) en optionele sessie-feedback.
We verzamelen geen device-locatie — de app werkt met een vaste lijst van spots.
We verkopen je data nooit. Je kunt je account inclusief alle persoonlijk gekoppelde data verwijderen via Instellingen > Account > Account verwijderen.
Vragen? Mail naar privacy@breeza.io.
1. Introduction
Breeza ("we", "our", "the app") is a kitesurf session assistant. Based on your rider profile (weight, skill level, gear) and a chosen time window, Breeza shows you which curated spots have rideable conditions right now or in the next hours.
This Privacy Policy explains which personal data we collect, why, how we store and protect it, and your rights under the General Data Protection Regulation (GDPR) and applicable Dutch/EU law. By using Breeza you agree to the practices described here.
2. Data We Collect
We collect the minimum data necessary to deliver the service.
2.1 Account Identifier
What: An anonymous UUID assigned by our authentication provider (Supabase anonymous auth) when you first open the app. No name, no email address, no phone number is collected at this stage.
Why: To link your rider profile and session feedback to a single, deletable account without requiring personal registration data.
Linked to identity: The UUID is linked to your profile data (see 2.2) but is not inherently tied to any real-world identity you have not voluntarily provided.
Optional email: If you choose to upgrade your anonymous account by linking an email address (optional feature), that email is stored and used solely for account recovery and authentication.
2.2 Rider Profile
What: Weight (kg), discipline (twin-tip / surfboard / kite foil / wing foil), skill level (beginner / intermediate / expert), and kite or wing sizes in m² (quiver).
Why: To calculate whether wind conditions at a spot are suitable for you specifically. Without a profile the core scoring function cannot run.
Storage: Stored server-side in your account row, hosted on Supabase in the EU region.
2.3 Session Feedback
What: After a suggested session window you can optionally submit feedback — the verdict the app predicted, your outcome, a minimal conditions snapshot, the spot identifier and time window evaluated, and the kite or wing size you actually used (optional, nullable).
Why: To calibrate and improve the accuracy of future recommendations.
Linked to identity: Each feedback row is linked to your account UUID at insert time. If you delete your account, the user identifier is set to NULL — the calibration signal is preserved anonymously; the link to your account is severed permanently.
2.4 Device Location
Not collected. Breeza uses a curated list of spots with fixed coordinates defined in the app. The app does not request device GPS, does not call any location permission API, and does not transmit or store device location coordinates. Spot coordinates are used only to fetch forecast data from the weather service.
2.5 Usage Analytics
The Breeza website (breeza.io) uses Google Analytics 4 (GA4) to understand how visitors use the site. Analytics data is only collected after you explicitly accept cookies via the consent banner.
What is collected: page views, referral source, and waitlist sign-up conversions. IP addresses are anonymised before processing. No advertising profiling.
Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing your browser cookies or by declining the banner on a new visit.
Opt-out: Use the Google Analytics Opt-out Browser Add-on.
The mobile app does not collect usage analytics in the current release.
3. Third Parties
We do not sell your data. We share data only as follows:
| Processor | What is shared | Purpose |
|---|---|---|
| Supabase | Account UUID, profile, feedback | Database and authentication hosting (EU region) |
| Open-Meteo (via our own edge function) | Spot coordinates (fixed lat/lon, not your device location) | Wind/weather forecast retrieval. No personal data shared; spot coordinates are public geographic data. |
| Apple / Google | Standard store and crash telemetry | Platform operation, governed by Apple/Google privacy policies |
Open-Meteo is accessed via Breeza's own backend edge function; raw responses are not forwarded to the client and are not stored.
4. Legal Basis (GDPR Art. 6)
| Data | Legal Basis |
|---|---|
| Account UUID | Contract performance (Art. 6(1)(b)) — needed to link profile and enable deletion |
| Rider profile | Contract performance — core to service delivery |
| Session feedback | Legitimate interest (Art. 6(1)(f)) — service calibration; balanced against minimal data |
| Optional email | Consent (Art. 6(1)(a)) — only if user chooses to link email |
5. Data Retention
| Data | Retention |
|---|---|
| Account UUID + rider profile | Until you delete your account |
| Session feedback (linked) | Until you delete your account; after deletion: anonymised permanently (user link removed) |
| Anonymous feedback rows | Retained indefinitely as anonymised calibration data; cannot be re-linked to you |
| Optional email (if provided) | Until you delete your account |
After account deletion, all personally linked data is removed within 30 days. Anonymised aggregate data (calibration rows with no user link) may be retained permanently as it cannot be traced back to you.
6. Your Rights (GDPR)
- Access: Request a copy of the data we hold about you.
- Rectification: Correct inaccurate profile data directly in the app (Settings > Profile).
- Erasure: Delete your account and all linked personal data via Settings > Account > Delete account, or by contacting us.
- Portability: Request your data in a machine-readable format.
- Restriction: Request restriction of processing in specific circumstances.
- Object: Object to processing based on legitimate interest.
- Withdraw consent: If you linked an email address, you may remove it or request deletion at any time.
Contact us at: privacy@breeza.io
We respond within 30 days. You may also lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.
7. Account and Data Deletion
You can delete your Breeza account directly from the app:
Settings > Account > Delete account
This permanently removes your rider profile (weight, discipline, level, quiver), your account UUID, and the profile row (cascade delete). Session feedback rows are anonymised: the user identifier is set to NULL; the calibration data itself is retained but permanently unlinked from you.
You can also request deletion by emailing privacy@breeza.io. We process the request within 30 days.
Web deletion alternative (required by Google Play): breeza.io/account/delete.
8. Data Security
- Row Level Security (RLS): users can only read and write their own rows.
- Session feedback is insert-only for authenticated users; no read-back via client API.
- HTTPS/TLS for all data in transit.
- Anonymous-auth tokens, not plain passwords.
- No device location data collected or transmitted.
9. Children's Privacy
Breeza is not directed at children under 13 (or under 16 in EU member states where a higher minimum age applies). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us immediately.
10. Changes
We may update this Privacy Policy. Material changes will be communicated via an in-app notice or, if email is linked, by email. Continued use after the effective date of changes constitutes acceptance of the updated policy. The "Last updated" date at the top reflects the most recent revision.
11. Contact
Breeza
Email: privacy@breeza.io (general: hello@breeza.io)
Website: breeza.io