Legal

Privacy.

Last updated: June 30, 2026.

This page explains what data the Corail: Surf Crew Journal app processes, why we process it, and how to request access or deletion.

Who we are

Corail: Surf Crew Journal is a mobile app that lets you log your surf sessions, see what your crew surfed, and keep a surfer profile built from your sessions.

The data controller is Raphael Chelly, based in France.

What we process and why

• Account information: an account is required to use the app. When you create one, we process the details you provide, such as your email address and display name, to identify you, secure your account, and let you join or create a crew.
• Content you create: journal entries, surf session logs, and photos you add are stored so the app can provide its core features. Content you choose to share is visible to the members of your crew.
• Location while the app is in use, if you allow it: with your permission, the app uses your position to tag sessions or surf spots. Coordinates may be sent to our backend to return relevant data. We do not store them long term beyond what you choose to save in your logs.
• Ocean conditions: when you log a session at a spot, our servers may fetch swell, wind, and tide data for that location and time to pre-fill or display conditions. Only spot coordinates and a timestamp are sent to weather providers — not your identity.
• Photos: the app only accesses images that you choose to add or export. We do not read your full photo library and do not upload it to our servers.
• Health and fitness data: if you enable Health sync, the app reads and writes workout data (duration, calories) to Apple Health. This only happens if you turn the feature on, and the data stays on your device under Apple's HealthKit framework. We do not receive a copy on our servers, and it is never used for advertising or sold to third parties.

What we do not do

The app does not show ads, does not include third-party analytics or advertising tracking SDKs, does not sell your data, and does not perform cross-app tracking.

Processors and third parties

Data processing relies on the following external providers:

• Supabase (EU region): authentication, database, file storage, and backend services.
• Expo: app updates, push notification delivery, and infrastructure.
• PostHog (EU region): product analytics, only if you have given consent. You can withdraw consent anytime in the app's Settings.
• Sentry: crash and error reporting, to keep the app stable. No personal data is collected beyond what is needed to diagnose a crash.
• OpenStreetMap / Nominatim: converts session coordinates into place names. Only the coordinates are sent, not your identity.
• Open-Meteo: swell, wind, and marine weather for session conditions and forecasts. Only spot coordinates and a timestamp are sent, not your identity.
• WorldTides: tide data for session conditions. Only spot coordinates and a timestamp are sent, not your identity.
• Apple HealthKit: if you enable Health sync, used on your device to read and write workout data. Governed by Apple's own Health data policies.

We do not sell your data.

Retention and GDPR rights

We keep data only for as long as needed for the purposes described above. Account information and content are kept while your account is active. Location is not stored long term beyond what you save.

If the GDPR applies to you, you can request access to your data, correction, deletion, restriction, objection, portability where applicable, and withdrawal of consent for optional processing.

To delete your account in the app, go to Settings → Privacy & data → Delete my account. Full instructions are on our account deletion page. To delete specific data without closing your account — a session, photo, or comment — see our partial data deletion page. To exercise other rights, email privacy@corail.surf with enough information to identify the relevant request. You may also lodge a complaint with the CNIL, the French data protection authority, if you believe your rights are not respected.

Children

The app is not directed at children. If you believe a child created an account or sent us information, contact us so we can delete it.

Changes

We may update this privacy policy. If we make a material change, we will update the date at the top of this page. Continued use of the app after an update means you accept the revised version.

Contact

For any question about this policy: privacy@corail.surf.