Privacy Policy

Last updated: May 31, 2026

This policy explains what information WaxUp collects, how we use it, and how you can control it. We tried to write it in plain English instead of legalese. If anything is unclear, email us at support@rae-apps.com and we will explain it.

Who we are

WaxUp is a mobile app that translates surf forecasts into beginner-friendly guidance. WaxUp is built and operated by Rae-Apps LLC (Really Awesome Engineering), a single-member limited liability company organized in California (referred to as “we,” “us,” “Rae-Apps,” or “WaxUp” in this policy).

Our registered address is [TO CONFIRM: registered business address — use the LLC’s registered-agent address, not a home address]. For privacy questions or requests, contact support@rae-apps.com.

What information we collect

Information you provide

When you create an account, we collect:

• An Apple-issued user identifier from Sign in with Apple. We never see your Apple ID password. Apple may forward a relay email if you choose private email; we receive that relay address, not your real one.
• Information you choose to add to your surfer profile (experience level, preferred drive distance, goals).
• Gear reviews you write, including the gear, your rating, and the text of the review.
• Surf session logs (date, duration, feel rating, notes). Session logs are stored only on your device and are not sent to our servers.

Information we collect automatically

• Forecast and location queries. When you check conditions for a beach, we send the beach reference to our forecast partner so we can return surf data. We do not retain a personal log of which beaches you check.
• Cached forecast data. Sunrise, sunset, and recent forecast values are stored on your device to keep the app fast. This stays on your device.
• Notification preferences. If you enable FOAMO (“conditions look right at this beach”) notifications, we record your preference locally. The notification itself fires from your device; we do not push notifications from our server.
• Subscription state. When you subscribe through the App Store, Apple tells the app whether your subscription is active. We do not see your card or payment information — Apple handles billing and we never receive your financial data.

Information we do not collect

• Your real name, address, or phone number unless you write them into a gear review yourself.
• Your payment details — Apple owns the billing relationship.
• We do not currently use third-party analytics services. [TO CONFIRM: no analytics SDK ships in the app]
• We do not use third-party crash-reporting services (such as Sentry or Crashlytics). [TO CONFIRM: no crash-reporting SDK ships in the app]

The WaxUp website (waxup.app)

This section covers the website at waxup.app, which is separate from the app described above. The website has no account and no login. It uses your approximate location for one purpose: to match its ambient background visuals to your local weather.

Coarse location (automatic, no prompt)

By default, our edge network (Cloudflare) estimates your approximate city from your IP address to pick sensible default weather for the page’s background water effect. This is coarse, IP-based, and happens without a prompt — the way most websites can infer a rough region from an IP address.

Precise location (only if you ask for it)

If you tap “Active Weather” and your browser grants permission, the website reads your approximate coordinates and rounds them to about city level (two decimal places, roughly a kilometre). We use them only to look up your current local weather so the page’s water and weather icon reflect real conditions.

• Where they go: the rounded coordinates are sent to our own weather endpoint (running on Cloudflare’s edge), which forwards them to Open-Meteo (open-meteo.com), a weather service, to fetch current conditions.
• What we keep: nothing on our servers. The coordinates live only in your browser’s sessionStorage for up to ten minutes and are cleared when you close the tab. We do not log your precise coordinates.
• No account, no profile: the website has no login, so this is never tied to an identity.
• If you decline: we fall back to the coarse IP estimate above. The site works the same; only the weather match is less precise.

You can change or revoke this permission anytime in your browser’s site settings (for example, iOS Safari: Settings → Apps → Safari → Location; Chrome: Site settings → Location).

How we use your information

• To make the app work — show forecasts, save your profile, sync your gear reviews across devices, render widgets.
• To process subscriptions through Apple’s StoreKit billing.
• To respond to you when you contact us.
• To prevent abuse — for example, blocking users who post abusive gear reviews.

We do not sell your personal information. We do not share it with advertisers. We do not use it to train AI models.

How we share your information

We share data only with the service providers we need to run the app:

• Supabase (United States — AWS US West, Northern California) — our backend for authentication and storage of profiles, gear reviews, and user blocks. Supabase is a data processor; they store data on our behalf. Their privacy practices: supabase.com/privacy.
• Apple — handles Sign in with Apple, App Store subscription billing, and App Store distribution.
• Open-Meteo (open-meteo.com) — provides the surf, swell, and weather forecast data. Their terms and privacy: open-meteo.com/en/terms.

We do not share your data for any other purpose without your consent, except where required by law.

Where your data is stored

Account, gear-review, and profile data sits in our Supabase project, hosted in the United States (AWS US West, us-west-1, Northern California). If you are in the European Economic Area, the United Kingdom, or another region with cross-border transfer rules, your data may be transferred to and processed in the United States or other countries. We rely on Standard Contractual Clauses where required.

Surf session logs you record stay only on your device. We never see them and they never leave your phone.

How long we keep your data

• Account data (profile, sign-in identifier): for as long as your account exists. When you delete your account, we delete it within 30 days.
• Gear reviews: for as long as your account exists, unless you delete a specific review yourself, in which case it is removed immediately.
• Forecast cache: stays on your device; refreshed periodically and replaced.
• Support email correspondence: for up to 24 months from the last message, then deleted.

Your rights

You have the following rights over your personal data. We honor these regardless of where you live, even if your local law does not require it:

• Access — see what data we have about you. Email support@rae-apps.com.
• Export — download your gear reviews as a JSON file directly in the app: Settings → Privacy & Data → Prepare export.
• Correct — edit your gear reviews from the gear page in-app. For other corrections, email us.
• Delete a specific review — open the gear page, choose Delete from your review menu.
• Delete your account and all associated data — Settings → Account → Delete Account. The deletion runs server-side and wipes profiles, gear reviews, user blocks, and local data on your device.
• Withdraw consent to optional features (notifications) — toggle off in Settings.
• Object or restrict processing — email us and we will explain how it works for your situation.
• Lodge a complaint with your local data protection authority. In the EU, find your authority at edpb.europa.eu. In the UK, the ICO at ico.org.uk.

We will respond to privacy requests within one calendar month, as required by GDPR. In rare complex cases, we may extend by up to two months and will tell you why.

Children

WaxUp is not intended for children under 13 — or under 16 where local law sets a higher minimum age (for example, parts of the EU). If we learn we have collected data from a child under that age, we will delete it.

If you are a parent or guardian who believes your child has signed up, email support@rae-apps.com and we will resolve it.

Security

We protect your data with reasonable technical and organizational measures. Sign in with Apple keeps your credentials with Apple, not us. Supabase encrypts data at rest and in transit. Account deletion runs through a server-side function that uses a service-role key — that key never reaches your device.

No system is perfectly secure. If we ever discover a breach that affects your personal data, we will notify you and any required authority within the legally required timeframe (72 hours under GDPR).

Apple App Store privacy disclosures

Our App Store privacy “nutrition label” reflects what is described above. If you see a discrepancy between the App Store label and this policy, email support@rae-apps.com — we want to fix it.

International transfers

If you use WaxUp from outside the United States (where our backend is hosted), your data is transferred there. We rely on:

• Standard Contractual Clauses (SCCs) for transfers from the EU/UK to the US.
• The UK International Data Transfer Addendum where applicable.

Changes to this policy

If we make material changes to this policy, we will:

• Update the “Last updated” date at the top.
• Show an in-app notice the next time you open WaxUp.
• For significant changes affecting EU/UK users, give 30 days’ notice before changes take effect.

Contact

Privacy questions, requests, or complaints:

Email: support@rae-apps.com — use the subject line “Privacy request” for fastest handling. We respond within one calendar month or sooner.