Privacy Policy

1. Data we collect

• Account data: when you sign in with Google, we receive your name and email address and a user ID, via Google and our authentication provider.
• Profile data: your display name and your WhatsApp number, which you provide.
• Trip data: the break, date, and time of trips you post.
• Consent record: the version of these policies you accepted and when.
• Payment data: when you buy lifetime access, payment is handled by Stripe. We never see or store your full card details; we keep only a record that you paid (a Stripe identifier, the amount, and the date) so we can grant and recognise your access.
• Usage analytics: basic, cookie-less usage analytics (page views, device type) via Vercel Analytics.

The €5 is a one-time charge for access to the noticeboard. There are no seat or boat-fare fields anywhere in the Service. Any boat cost is settled directly between surfers, off-platform.

2. How we use it

To run the noticeboard: to show your posted trips and display name to other users, to let you sign in, to maintain your profile, and to keep the Service working and safe.

After a trip you posted has departed, we may send a single email to your account address asking how it went, so we can tell whether the board is helping surfers connect. Every such email includes a one-click unsubscribe link, and you can opt out at any time without affecting the rest of the Service.

3. Sharing your WhatsApp number

Your WhatsApp number is not shown publicly: it never appears on the board or in link previews. It is released only to a signed-in member who has paid for access, and only when they open a specific trip to get in touch about it, so the conversation can move to WhatsApp. To discourage anyone from collecting numbers in bulk, these reveals are rate-limited and logged. Your display name and posted trips, by contrast, are visible to anyone browsing the Service, so please don’t put anything in your display name you don’t want to be public.

4. Legal basis & consent

We process your data on the basis of your consent, which you give when you accept these policies at sign-up, and as necessary to provide the Service you’ve asked for. You can withdraw consent by deleting your account (see below). Depending on where you live, laws such as the EU/UK GDPR or Indonesia’s Personal Data Protection Law may give you additional rights (see “Your rights”).

5. Service providers

We rely on a few processors to run the Service:

• Google: sign-in (you authenticate with your Google account).
• Supabase: database and authentication (stores your profile and trips).
• Stripe: payment processing for lifetime access. Stripe handles your card details under its own terms and privacy policy; we receive only confirmation of payment.
• Vercel: application hosting and basic, cookie-less usage analytics.
• Resend: email delivery (the welcome email and the post-trip follow-up).
• WhatsApp / Meta: when you choose to message, the conversation happens in WhatsApp under their own terms and privacy policy.

These providers process data on our behalf and may store it on servers outside your country.

6. Cookies

We use only strictly necessary cookies, the kind that don’t require a consent banner. A session cookie set by our authentication provider (Supabase) keeps you signed in, and Stripe may set a cookie at checkout to help prevent fraud. We don’t use any advertising, tracking, or profiling cookies, and our usage analytics (Vercel) are cookie-less. Because we set no non-essential cookies, there’s nothing here for you to opt in or out of; if you block the essential cookies in your browser, sign-in and payment may not work.

7. Retention & deletion

We keep your data while your account is active. You can delete individual trips, or your entire account, from your profile at any time. Deleting your account erases your profile (including your WhatsApp number), pulls all your trips off the board, and removes your sign-in identity (your name and email) from our systems.

One exception: a record of your one-time payment is held by our payment processor (Stripe) for as long as tax and accounting law requires. We never store your card details, and once your account is deleted that payment record is no longer linked to an account on our side.

8. Your rights

Subject to your local law, you may have the right to access, correct, or delete your data, to withdraw consent, and to object to or restrict certain processing. You can exercise most of these directly in the app (edit your profile, delete trips, delete your account), or contact us using the details below.

9. Children

The Service is not intended for anyone under 18, and we don’t knowingly collect their data.

10. Changes

We may update this policy. Material changes will be reflected in the effective date, and we may ask you to accept the updated version.

11. Contact

For privacy questions or requests, contact support@jukung.app.