你的衝浪紀錄，
屬於你。

iOS 記錄不用註冊；浪人需以 Apple 或 Google 登入。Android 首次使用需登入。我們不販售你的資料。

繁體中文

SurfBound 隱私政策（繁體中文）

最後更新：2026-10-30

我們的原則

iOS 記錄不用註冊；浪人需以 Apple 或 Google 登入。Android 首次使用需登入。你的衝浪紀錄屬於你。

收集與儲存的資料

購買紀錄：為顯示 Pro 標記，社群伺服器保存付費訂閱的 Apple 原始交易識別碼（不透明字串）、產品代號（月／季／年，只有我們看得到）與這一期的到期日；早期測試者與創始成員只保存原因與期限。不保存價格、收據、Apple ID 或付款資料。Apple 的簽章交易在收到時驗證，不保留。
健康與健身資料（心率、卡路里、workout 與體能統計）：由 Apple HealthKit 管理，並儲存在你的裝置與你的 iCloud。
精確位置資料（GPS 軌跡、浪點提醒的地理圍欄）：儲存在你的裝置；軌跡隨 session 紀錄保存在你的裝置與 iCloud 備份中。
其他資料（50 Hz 加速度計／陀螺儀動作感測 CSV）：session 期間記錄，儲存在你的裝置。
其他使用資料（偵測參數、浪點名稱）：隨 session 儲存在你的裝置。
手機的動作與健身活動歷史：app 只會在每一場衝浪 session 的時間範圍內於裝置上查詢，用來辨識開車時段並修正誤判的浪。app 僅暫時取出開車區間的起訖時間，用完即丟；原始活動資料不會儲存或上傳。拒絕這項權限不影響其他功能，只會停用這項自動修正。
Garmin 來源的 session：若你連結 Garmin 手錶使用 SurfBound，app 會接收該手錶記錄的衝浪 session，包括浪數、乘浪軌跡片段、速度與時長。

未啟用「分享資料改進偵測」時，以上資料不會上傳至我們的 CloudKit 測試資料庫。

選擇性分享（可隨時關閉）

啟用 app 設定分頁的「分享資料改進偵測」時（首次啟動時明確揭露），上傳內容包括 session 統計與標註修正（其中可能包含偵測參數與浪點名稱）、精確位置資料（GPS 軌跡），以及其他資料（50 Hz 動作感測紀錄）。上傳內容不包含心率、卡路里或其他 HealthKit 健康與健身資料。這些資料用於 App 功能與分析，且僅限改進浪數偵測演算法。

如果本機活動歷史判定某些浪發生在開車時段，上傳的只有「浪被標記為行車」這項衍生結果，並歸在既有的 session 統計與標註修正中；手機的原始活動歷史與開車區間起訖時間不會上傳。這項衍生結果同樣受「分享資料改進偵測」開關控制。

若你連結 Garmin 手錶使用 SurfBound，該手錶記錄的浪數、乘浪軌跡片段、速度與時長同樣依「分享資料改進偵測」開關決定是否分享給開發者，用途同樣僅限改進浪的偵測。Garmin session 的上傳內容不包含心率、卡路里或其他健康與健身資料。

Garmin 來源的資料與 Apple Watch 來源分開儲存與分析，不會用其中一種來校正另一種。

上傳紀錄會與你的 iCloud 識別碼關聯，因此同一使用者的紀錄可以彼此連結，但不包含你的姓名或 email。我們不會將這些資料用於廣告、販售或跨 app／網站追蹤。

你可以隨時在 app 設定分頁關閉「分享資料改進偵測」；關閉後不再上傳新資料。

技術資訊（iOS 與 Android）：伺服器會在登入工作階段記錄「平台／版本號」（例如 android/1），只有營運者看得到，刪除帳號時一併刪除。

手錶連線診斷。 當您將 SurfBound 與 Garmin 手錶配對時，手機 App 會把手錶背景連線的測試結果送到我們的伺服器：連線的次數、狀態與時間，以及該手機的安裝識別碼、App 版本與手錶型號。這些資料不含位置、心率或任何健康數據，只用來找出手錶同步失敗的原因，只有營運人員看得到，每個帳號最多保留 100 筆、30 天後自動刪除，刪除帳號時一併刪除。

浪人社群

浪人社群需以 Apple 或 Google 登入。社群資料由 Cloudflare 上的 SurfBound 社群伺服器處理，正式服務網域為 api.surfbound.app。登入不要求提供姓名。在 iOS 上登入時 Apple 會詢問是否提供電子郵件，你可以選擇分享真實信箱，或使用 Apple 的「隱藏我的電子郵件」。社群伺服器會保存 Apple 提供的這個信箱、Apple 是否已驗證它，以及它是否為 Apple 的轉寄信箱。用 Google 登入時，也會保存 Google 提供的 email 與是否已驗證；Google 沒有轉寄信箱。你登入時提供的 email，我們只用在兩件事：一、帳號出問題時聯絡你。二、你用另一種方式（例如 Google）登入、準備開新帳號時，如果這個 email 已經有一個 SurfBound 帳號，我們會提醒你改用原本的方式登入。我們不會因此把你登入到別的帳號，也不會把你的 email 顯示給任何人。這個信箱不用於行銷，不提供給第三方，其他使用者看不到。1.1.5 之前建立的帳號沒有這項資料。刪除帳號時，信箱一併刪除。解除某個登入方式時，該方式的信箱一併刪除。我們使用 Apple 或 Google 提供的帳號識別碼與社群使用者識別碼維持帳號及登入狀態，並保存你設定的暱稱、代號、自我介紹與提供的個人頁資料。這些資料與你的社群帳號關聯。

你逐場選擇「分享給浪人朋友」時，會送出該場日期時間與時區、紀錄來源、你寫的分享文字（有填寫時），以及你選擇分享的時長、浪點名稱、浪數、最遠一道浪距離、最高浪速或浪況資料。有路線的紀錄可包含簡化後的路線與乘浪區段；不會送出完整 GPS 時序、速度序列、心率、卡路里、原始動作感測紀錄或私人備註。

從 Apple 健康匯入時，若來源提供路線，app 會讀取路線，並與匯入紀錄一起保存在你的裝置與你自己的 iCloud，不會上傳到 SurfBound 的研究資料庫。只有你選擇分享到浪人社群時，才會送出該場的日期時間、時長、浪點、你填寫的體感浪數、當天浪況、來源 app 名稱，以及有路線時的路線。日期時間、時長與匯入路線屬於 Apple 健康衍生資料；分享不帶最遠一道浪距離、最高浪速、心率與卡路里。

分享預設只供你與已核准的追蹤者查看。若開啟「公開我的動態」，所有浪人都能查看你的分享，分享也會出現在大家的動態牆上，包括你分享的浪點名稱與路線。個人頁的暱稱、自我介紹及提供的個人資料可能對其他登入使用者可見；設定代號後會有可對外分享的連結，公開帳號的連結頁也會顯示暱稱。封鎖限制優先於公開設定。

有 Pro 的帳號，頭像會帶一個標記，只代表這個帳號目前有 Pro。Pro 來源包括付費訂閱（含免費試用與優惠期間）、早期測試者的免費期間（到 2026-11-02）與創始成員，三種使用同一個標記；別人分不出來源，也看不到方案、價格或日期。目前不能關閉。已登入且本來就看得到你的浪人，會在你的動態、留言、shaka 名單、通知、個人頁、搜尋結果與追蹤名單上看到標記。公開網頁 surfbound.app/@代號不顯示標記，未登入的人看不到。Android 版的 Pro 訂閱使用同一個標記。

我們保存分享文字（最多 500 字，可被檢舉）、分享下的留言、提及、shaka 與追蹤請求／關係，用於顯示互動及通知。可查看該分享的人也能看到留言與 shaka 名單（含暱稱）；封鎖會限制彼此內容的可見性。檢舉會送出檢舉對象、理由與你提供的補充文字；我們保存檢舉與封鎖資料，用於處理不當內容與執行封鎖。

為提供社群推播，我們會保存與帳號關聯的推播 token、推播服務／環境，以及 app 安裝時產生的隨機裝置識別碼；後者不是硬體識別碼。推播可能包含互動者暱稱與相關分享、留言識別碼。登出或刪除帳號時，伺服器會清除相應推播登記。

你可在「浪人」→ 右上角「你的帳號」→「我的分享」向左滑動該筆紀錄，選「撤回」。撤回後，伺服器不再提供該分享，路線、統計及相關互動會清除，無法復原；想再次分享需要重新發佈。刪除已分享的本機紀錄也會啟動撤回，需由伺服器完成處理。你也能刪除自己的留言，分享作者可刪除該分享下的留言。

檢舉與內容管理

你可以檢舉分享、留言或其他浪人，也可以封鎖對方。每一筆檢舉會立即通知營運者，我們會在 48 小時內處理：移除違規的分享或留言、停權帳號，或結案。被停權的帳號無法登入，其公開內容會被移除。暱稱、代號、自我介紹、留言、分享文字與浪點名稱在送出時會比對不允許的字詞清單。檢舉內容（檢舉對象、原因與你填寫的備註）僅用於處理該筆檢舉；刪除帳號時，你提出的檢舉與針對你的檢舉會一併刪除。有疑問請來信 [email protected]。

你可在「浪人」→ 右上角「你的帳號」選「刪除帳號」，依畫面輸入暱稱確認（有暱稱時）。伺服器受理後會立即撤回所有分享、移除追蹤關係並撤銷登入狀態，其餘清理由背景工作完成。只登出、刪除 app 或在 Apple 設定撤銷登入授權，不等於刪除社群帳號。

浪人社群與「分享資料改進偵測」是不同的資料用途與管線；關閉研究資料分享不會撤回已發佈的社群內容。社群資料用於帳號、分享、互動、通知與內容管理，不用於廣告或販售。

第三方服務（Garmin Connect）

Garmin session 從手錶傳到 iPhone 時，會經由你自己安裝並使用的 Garmin Connect app 中繼。SurfBound 不會與 Garmin 交換任何資料，也無法取得你的 Garmin 帳號。

分析工具（iOS：Google Analytics for Firebase）

SurfBound 使用 Google Analytics for Firebase 收集使用行為，包括畫面瀏覽、功能使用次數、裝置型號與 app 版本，用於改善產品。

訂閱相關的購買結果（購買完成、取消、失敗、是否為免費試用，以及從哪個畫面進入付費頁）會傳送給 Google Analytics，用來了解付費流程。不包含付款資訊，也不用於廣告或追蹤。

這項分析不包含姓名、Email、健康資料（包括心率與卡路里）、GPS 座標或 session 內容；分析資料與用於改進衝浪偵測的 CloudKit 測試資料是兩條獨立管線。

資料由 Google 依其隱私條款處理。詳情請參閱 Google Analytics for Firebase 隱私資訊。

Garmin 早期測試者登記

當你自願登記 Garmin 早期測試時，我們會收集 Email、Garmin 錶款，以及你選擇提供的 SurfBound 支援代碼與 LINE ID。支援代碼是由 iCloud 識別碼衍生的識別碼。

這些資料只用於 Garmin 測試聯絡、寄送 TestFlight 邀請與提供安裝說明，儲存在受控的測試者名單中，不會出現在公開頁面或 URL。為寄送 TestFlight 邀請，我們會將你登記的 Email 提供給 Apple App Store Connect／TestFlight，由 Apple 依其隱私政策處理；Garmin 錶款、支援代碼與 LINE ID 不會提供給 Apple。你可以寄信至下方聯絡信箱要求刪除登記資料。

資料保留與刪除

訂閱到期未續訂時，Pro 標記會消失；Apple 或 Google Play 退款後，標記會在 app 回報之後消失。刪除帳號時，標記與上述購買紀錄、Pro 原因及期限會一併刪除。

當你在 app 內刪除 session 紀錄時，對應的雲端資料會標記為已刪除，並排除於後續分析。若希望將先前上傳的資料從 CloudKit 完整刪除，請寄信至下方聯絡信箱提出要求。

我們不做的事

不販售、不出租你的任何資料
不追蹤你跨 app 或跨網站的行為
不投放廣告
iOS 記錄不要求註冊帳號

Android 版

登入：Android 版第一次開啟時需要以 Google 或 Apple 帳號登入。我們取得帳號提供者給的識別碼，不要求姓名。用 Google 登入時，Google 會提供你的 Email，我們存在你的帳號上，用途只有兩個：帳號出問題時聯絡你；你改用另一種方式登入、即將開出新帳號時，提醒你這個 Email 已經有一個帳號（我們不會因此把你登入別的帳號，也不會把 Email 顯示給任何人）。Email 在你解除 Google 登入或刪除帳號時一併刪除。Android 上的 Apple 登入走網頁流程，不取得 Email。你可以在「設定 → 登入方式」為同一個帳號連結或解除 Google 與 Apple 登入。登入一次之後，沒有網路也能記錄與整理。

衝浪紀錄存放在哪裡：紀錄（含心率與熱量）存在你的手機，並透過 Android 的自動備份存到你自己的 Google 帳號。我們的伺服器不保存你的個人紀錄。刪除 app 會移除手機上的紀錄；重新安裝並登入同一個 Google 帳號時會從你的備份還原。

選擇性分享（Android）：第一次開啟時會明確詢問，回答之前不會上傳任何東西；之後可以在「設定 → 協助改進判浪」隨時關閉。開啟後，你的紀錄會傳一份到 SurfBound 的語料主機（corpus.surfbound.app，由 Cloudflare 代管），只用來改進浪的偵測。上傳內容：手錶記錄的 GPS 軌跡與速度、每一道浪、你的整理結果（否決、加星、補登）、板子規格、手錶型號，以及手錶的運作狀況（記憶體、有沒有存漏或異常結束）。不包含心率、熱量、你的姓名、Email 或 SurfBound 帳號；主機只認得 app 在你手機上產生的一組隨機代碼。

刪除（Android）：在 app 裡刪掉一場紀錄，語料主機上對應的那一份也會刪除。「設定 → 刪除我上傳過的全部資料」會刪掉這支手機上傳過的全部語料並停止上傳。這組代碼只存在你的手機與你的 Google 備份；若移除 app 且沒有備份，我們無法指認哪些資料是你的，所以請在移除之前先刪除。刪除 SurfBound 帳號不會刪除語料（兩者沒有關聯），請另外在設定中刪除。

Garmin 手錶：紀錄由手錶經你手機上的 Garmin Connect 傳給 SurfBound，不經過我們的伺服器。

訂閱：SurfBound Pro 的購買由 Google Play 處理，我們不取得你的付款資料。為顯示 Pro 標記，app 會把 Google Play 的購買權杖（不透明字串）與產品代號送到社群伺服器，由伺服器向 Google Play 確認訂閱狀態。伺服器只保存產品代號（月／季／年，只有我們看得到）與這一期的到期日，以及一個由購買權杖算出、無法還原成權杖的識別碼（用來避免同一筆訂閱掛在兩個帳號）；不保存購買權杖本身、價格、收據、Google 帳號或付款資料。

浪人（社群）功能會傳到我們伺服器的資料（Android）：你的暱稱、代稱、自介；你追蹤誰、誰追蹤你、你封鎖了誰；你選擇分享的那一場（簡化後的路線、浪點名稱、時長、浪數、速度等統計、當天浪況、你寫的文字）；你的留言與 shaka；你送出的檢舉內容。沒有按分享的紀錄不會傳出。心率、熱量與完整的 GPS 逐秒資料永遠不會傳到社群伺服器。

誰看得到：暱稱、代稱、自介、衝浪次數與成就是公開的個人頁內容，個人頁不含浪點名稱或任何位置。分享預設只有你核准的追蹤者看得到；你可以改成公開。你封鎖的人看不到你的內容。你可以隨時收回一則分享或刪除自己的留言。你送出的檢舉只有營運者看得到，保留到你或被檢舉的人刪除帳號為止。

權限（Android）：位置只要求「概略位置」，在手機上用來選離你最近的浪點，不會傳給我們；沒有背景定位。沒有要求相機、通訊錄、麥克風。

其他服務（Android）：地圖使用 Google 地圖；浪況與潮汐來自 Open-Meteo 與中央氣象署，查詢時送出的是浪點的座標，不是你的位置；登入由 Google 或 Apple 處理；伺服器由 Cloudflare 代管。Android 版沒有廣告、沒有分析或追蹤工具、沒有當機回報工具，也不使用廣告 ID。

刪除帳號（Android）：在「設定 → 刪除帳號」或 https://api.surfbound.app/account/delete 刪除。會被永久刪除的：帳號本身（暱稱、自介、成就）；你發佈的所有分享（含路線與文字），以及別人在這些分享下的留言與 shaka；你在別人分享下的留言與 shaka；追蹤關係、邀請、封鎖名單、通知；你提出的檢舉與針對你的檢舉；登入用的憑證（含登入時 Apple 或 Google 提供給我們的電子郵件地址）與推播登記（用 Apple 登入的帳號會同時向 Apple 撤銷授權）。刪除立即開始，通常幾秒內完成，無法復原。刪除後的保留規則，請見下方 iOS 與 Android 共用的「刪除社群帳號後保留的資料」。手機上的衝浪紀錄與你 Google 帳號裡的備份不受影響，由你自己保管與刪除；「協助改進判浪」上傳的匿名紀錄不連結帳號，要另外在 app 設定裡刪除。

聯絡：[email protected]

刪除社群帳號後保留的資料（iOS 與 Android 共用）

你的代號（例如 @name）不再連結到你，但會保留為「已使用過」，不開放給任何人。

一筆「這個帳號已刪除」的作業紀錄（只有內部編號與時間），最多保留 30 天後清除。

用 Apple 登入的帳號：Apple 在收到撤銷後可能通知我們，那時會留下一筆「這個 Apple 登入已撤銷」的標記（不含姓名與 Email），在登入憑證的最長有效期過後清除。

如果有其他使用者封鎖過你，我們會保留一個由你的登入身分計算出來、無法還原的代碼，僅用來讓該封鎖在你以同一個 Apple 或 Google 帳號重新註冊時繼續有效。這個代碼不含你的暱稱、代號、信箱或任何內容。封鎖者解除封鎖或刪除帳號時，它會一併刪除；除此之外不設保存期限。沒有人封鎖過你的話，不會留下這個代碼。

聯絡

[email protected]

English

SurfBound Privacy Policy (English)

Last updated: 2026-10-30

Our principle

Recording on iOS needs no registration; Lineup requires Sign in with Apple or Google. Android requires sign-in on first use. Your surf data is yours.

Data we collect and where it lives

Purchase records: to display the Pro mark, the community server stores the Apple original transaction identifier (an opaque string), product identifier (monthly, quarterly, or yearly, visible only to us), and the current period’s expiry date for paid subscriptions. For early testers and founders, it stores only the reason and expiry. We do not store prices, receipts, Apple IDs, or payment details. Apple-signed transactions are verified when received and are not retained.
Health and fitness data (heart rate, calories, workouts, and fitness statistics) is managed by Apple HealthKit and stored on your devices and in your iCloud.
Precise location data (GPS tracks and geofenced spot reminders) is stored on your device; tracks are kept with your session records on your devices and in your iCloud backup.
Other data (50 Hz accelerometer/gyroscope motion CSV files) is recorded during sessions and stored on your device.
Other usage data (detection parameters and surf spot names) is stored with sessions on your device.
Motion and fitness activity history from your phone is queried on-device only within the time range of each surf session, solely to identify driving intervals and correct waves detected by mistake. The app temporarily extracts only the start and end times of driving intervals, then discards them; the raw activity data is neither stored nor uploaded. Denying this permission does not affect other features and only disables this automatic correction.
Garmin-source sessions: if you link a Garmin watch to SurfBound, the app receives surf sessions recorded by that watch, including wave count, ride-track segments, speed, and duration.

When "Share data to improve detection" is not enabled, this data is not uploaded to our CloudKit test database.

Optional sharing (can be turned off at any time)

When "Share data to improve detection" is enabled from the app's settings (disclosed at first launch), uploaded content includes session statistics and labeling corrections (which may include detection parameters and surf spot names), precise location data (GPS tracks), and other data (50 Hz motion recordings). Uploaded content does not include heart rate, calories, or other HealthKit health and fitness data. This data is used for app functionality and analytics, solely to improve the wave-detection algorithm.

If on-device activity history identifies waves that occurred while driving, only the derived result that those waves were marked as driving may be uploaded as part of the existing session statistics and labeling corrections. Raw phone activity history and the start and end times of driving intervals are not uploaded. This derived result is also controlled by the "Share data to improve detection" setting.

If you link a Garmin watch to SurfBound, the wave count, ride-track segments, speed, and duration recorded by that watch are also shared with the developer only when "Share data to improve detection" is enabled, and solely to improve wave detection. Uploaded Garmin-session content does not include heart rate, calories, or other health and fitness data.

Garmin-source data and Apple Watch-source data are stored and analyzed separately. Neither source is used to calibrate the other.

Uploaded records are associated with your iCloud identifier, so records from the same user can be linked, but they do not contain your name or email. We do not use this data for advertising, sell it, or track you across apps or websites.

You can turn off "Share data to improve detection" at any time from the app's settings. No new data is uploaded after it is turned off.

Technical information (iOS and Android): the server records the platform/version (for example android/1) in sign-in sessions. Only the operator can see it, and it is deleted when you delete your account.

Watch connection diagnostics. When you pair SurfBound with a Garmin watch, the phone app sends the results of the watch’s background-connection checks to our server: how many times it connected, its state, and the times, together with that phone’s installation ID, the app version and the watch model. This never includes your location, heart rate or any health data. We use it only to work out why a watch failed to sync; only our operators can see it; we keep at most 100 entries per account, delete each entry after 30 days, and delete them all when you delete your account.

Community

Lineup requires Sign in with Apple or Google. Community data is processed by SurfBound's community server on Cloudflare; the production service domain is api.surfbound.app. Sign-in does not request your name. At sign-in on iOS, Apple asks whether to share your email; you can share your real address or use Apple's Hide My Email. The community server stores the address Apple provides, whether Apple has verified it, and whether it is an Apple relay address. With Google sign-in, we also store the email Google provides and whether it is verified. Google does not provide a relay address. We use the email you provide at sign-in for two things only: 1) to reach you if something goes wrong with your account; 2) if you sign in another way (for example with Google) and are about to create a new account while that email already belongs to a SurfBound account, to remind you to sign in the way you used before. This never signs you into another account, and your email is never shown to anyone. It is not used for marketing, is not shared with third parties, and is not visible to other users. Accounts created before version 1.1.5 do not have it. Deleting your account deletes the address. Unlinking a sign-in method also deletes the address associated with that method. We use the account identifier provided by Apple or Google and a community user identifier to maintain your account and sign-in sessions. We store the nickname, handle, bio, and profile information you provide, linked to your community account.

When you choose to share an individual session, we send its date and time, time-zone offset, recording source, any text you add to the share, and the duration, spot name, wave count, longest ride distance, maximum ride speed, or surf conditions you choose to share. Sessions with a route may include a simplified route and ride segments. We do not send full timestamped GPS data, speed sequences, heart rate, calories, raw motion recordings, or private notes.

When importing from Apple Health, the app reads a route if the source provides one and stores it with the imported session on your devices and in your own iCloud, not in SurfBound's research database. Only when you choose to share the session to the community do we send its date and time, duration, spot name, the wave count you entered, surf conditions, the source app name, and the route if available. The date and time, duration, and imported route are derived from Apple Health. Sharing does not include longest ride distance, maximum ride speed, heart rate, or calories.

By default, shares are visible only to you and your approved followers. Enabling “Public activity” makes your shares visible to everyone on Lineup and places them in everyone's feed, including any spot name and route you share. Your nickname, bio, and provided profile information may be visible to other signed-in users. Setting a handle creates an externally shareable link; the link page for a public account also displays its nickname. Blocking takes precedence over public visibility.

Accounts with Pro carry an avatar mark that only means the account currently has Pro. Pro may come from a paid subscription (including free trials and promotional periods), the early-tester free period (through 2026-11-02), or founder access. All three use the same mark; others cannot distinguish the source or see the plan, price, or dates. The mark cannot currently be turned off. Signed-in surfers who can already see you can see it in your activity, comments, shaka lists, notifications, profile, search results, and follow lists. Public pages at surfbound.app/@handle do not display the mark; signed-out visitors cannot see it. Pro subscriptions on Android carry the same mark.

We store share captions (up to 500 characters, which can be reported), comments, mentions, shakas, and follow requests and relationships to display interactions and notifications. People who can view a share can also see its comments and shaka list, including nicknames, subject to blocking restrictions. Reports send the target, reason, and any note you provide. We store reports and blocks to handle inappropriate content and enforce blocking.

For community push notifications, we store an account-linked push token, provider and environment, and a random identifier generated for the app installation—not a hardware identifier. Notifications may include the interacting user's nickname and related share or comment identifiers. The server clears the corresponding push registration when you sign out or delete your account.

To withdraw a share, open Lineup → Your account → My shares, swipe left on the session, and select Withdraw. The server stops serving the share and clears its route, statistics, and associated interactions. Withdrawal cannot be undone; sharing again creates a new post. Deleting a shared local session also starts withdrawal, which must be completed by the server. You can delete your own comments, and a share's author can delete comments on that share.

Reporting and content moderation

You can report shares, comments, or other surfers, and you can block them. Each report notifies the operator immediately, and we act on it within 48 hours: removing the share or comment, suspending the account, or closing the report. Suspended accounts cannot sign in and their public content is removed. Nicknames, handles, bios, comments, share text, and spot names are checked against a list of disallowed words when submitted. Report details (the target, the reason, and any note you add) are used only to handle that report; deleting your account deletes reports you filed and reports about you. Questions: [email protected].

To delete your community account, open Lineup → Your account → Delete Account. Confirm by entering your nickname when prompted. Once accepted, the server immediately withdraws all shares, removes follow relationships, and revokes sign-in sessions; remaining cleanup runs in the background. Signing out, deleting the app, or revoking Sign in with Apple in Apple settings does not by itself delete your community account.

Community sharing and Share data to improve detection serve separate purposes and use separate pipelines. Turning off research-data sharing does not withdraw community posts. Community data is used for accounts, sharing, interactions, notifications, and moderation—not advertising or sale.

Third-party service (Garmin Connect)

When a Garmin session moves from your watch to your iPhone, it is relayed through the Garmin Connect app that you install and use. SurfBound does not exchange any data with Garmin and cannot access your Garmin account.

Analytics (iOS: Google Analytics for Firebase)

SurfBound uses Google Analytics for Firebase to collect usage behavior, including screen views, feature-use counts, device model, and app version, to improve the product.

Subscription purchase results (completed, cancelled, failed, whether it was a free trial, and which screen led to the paywall) are sent to Google Analytics to understand the purchase flow. They do not include payment details and are not used for advertising or tracking.

This analytics data does not include your name, email, health data (including heart rate or calories), GPS coordinates, or session content. Analytics data and the CloudKit test data used to improve surf detection are handled through separate pipelines.

Google processes this data under its privacy terms. See Google Analytics for Firebase privacy information for details.

Garmin early tester registration

When you voluntarily register for Garmin early testing, we collect your email address and Garmin watch model, plus a SurfBound support code and LINE ID if you choose to provide them. The support code is an identifier derived from your iCloud identifier.

We use this data only to contact Garmin testers, send TestFlight invitations, and provide installation instructions. It is stored in a controlled tester list and is never published on a public page or URL. To send a TestFlight invitation, we provide your registered email address to Apple App Store Connect/TestFlight, where Apple processes it under its privacy policy; your Garmin watch model, support code, and LINE ID are not provided to Apple. You may email the contact address below to request deletion of your registration data.

Data retention and deletion

The Pro mark disappears when a subscription expires without renewal, or after an Apple or Google Play refund once the app reports it. Deleting the account deletes the mark and the purchase records, Pro reasons, and expiry dates described above.

When you delete a session in the app, the corresponding cloud data is marked as deleted and excluded from future analysis. To request complete deletion of previously uploaded data from CloudKit, email the contact address below.

What we never do

Sell or rent any of your data
Track you across apps or websites
Show ads
Require an account for recording on iOS

Subscriptions

Subscriptions are processed by the Apple App Store; we never see your payment information.

Android

Sign-in: Android requires a Google or Apple account on first launch. We receive the identifier provided by your account provider and do not request your name. With Google sign-in, Google provides your email, which we store on your account for only two purposes: contacting you about account problems; and, when you use a different sign-in method and are about to create a new account, reminding you that this email already has an account (this does not sign you into another account or show your email to anyone). The email is deleted when you unlink Google sign-in or delete your account. Apple sign-in on Android uses the web flow and does not obtain email. In Settings → Sign-in methods, you can link or unlink Google and Apple for the same account. After signing in once, you can record and organize sessions offline.

Where surf records are stored: records (including heart rate and calories) are stored on your phone and backed up to your own Google account through Android Auto Backup. Our servers do not store your personal records. Uninstalling the app removes records from your phone; reinstalling and signing in to the same Google account restores them from your backup.

Optional sharing (Android): you are explicitly asked on first launch, and nothing is uploaded before you answer. You can turn it off at any time in Settings → Help improve wave detection. When enabled, a copy of your records is sent to SurfBound’s corpus server (corpus.surfbound.app, hosted by Cloudflare), solely to improve wave detection. Uploads include the watch-recorded GPS route and speed, each wave, your corrections (rejections, stars, and added waves), board specifications, watch model, and watch operating information (memory, missed saves, or abnormal endings). They do not include heart rate, calories, your name, email, or SurfBound account; the server recognizes only a random code generated by the app on your phone.

Deletion (Android): deleting a session in the app also deletes its corresponding copy on the corpus server. Settings → Delete all my uploaded data deletes all corpus data uploaded by this phone and stops uploads. This code exists only on your phone and in your Google backup. If you uninstall without a backup, we cannot identify which data is yours, so delete it before uninstalling. Deleting your SurfBound account does not delete corpus data (the two are not linked); delete it separately in Settings.

Garmin watches: records pass from the watch through Garmin Connect on your phone to SurfBound, not through our servers.

Subscriptions: SurfBound Pro purchases are handled by Google Play; we do not receive your payment details. To display the Pro mark, the app sends the Google Play purchase token (an opaque string) and product identifier to the community server, which confirms the subscription status with Google Play. The server stores only the product identifier (monthly, quarterly, or yearly, visible only to us) and the current period's expiry date, and a one-way fingerprint of the purchase token that cannot be turned back into it (used to keep one subscription from marking two accounts); it does not store the token itself, prices, receipts, your Google account, or payment details.

Data sent to our servers by Lineup (Android): your nickname, handle, and bio; whom you follow, who follows you, and whom you block; sessions you choose to share (simplified routes, spot names, duration, wave count, speed and other statistics, surf conditions, and your text); your comments and shakas; and reports you submit. Unshared records are not sent. Heart rate, calories, and full second-by-second GPS data are never sent to the community server.

Who can see it: your nickname, handle, surf session count, bio, and achievements are public profile content. Profiles do not include spot names or any location. Shares are visible only to approved followers by default; you can make them public. People you block cannot see your content. You can withdraw a share or delete your own comments at any time. Only the operator can see reports you submit; they are retained until you or the reported person deletes their account.

Permissions (Android): only approximate location is requested, used on your phone to choose the nearest surf spot and not sent to us. There is no background location. Camera, contacts, and microphone access are not requested.

Other services (Android): maps use Google Maps. Surf conditions and tides come from Open-Meteo and Taiwan’s Central Weather Administration; queries send the spot’s coordinates, not your location. Google or Apple handles sign-in; Cloudflare hosts the servers. Android has no ads, analytics or tracking tools, or crash-reporting tools, and does not use the advertising ID.

Account deletion (Android): delete your account in Settings → Delete Account or at https://api.surfbound.app/account/delete. Permanently deleted: the account (nickname, bio, achievements); all your shares (including routes and text), along with others’ comments and shakas on them; your comments and shakas on others’ shares; follows, invites, blocks, notifications; reports you filed and reports about you; sign-in credentials (including email addresses Apple or Google provided at sign-in) and push registrations. For Apple sign-in, authorization is also revoked at Apple. Deletion starts immediately, normally completes within seconds, and cannot be undone. The shared iOS and Android account-retention rules below apply after deletion. Records on your phone and backups in your Google account are unaffected and remain yours to manage and delete. Anonymous records uploaded through Help improve wave detection are not linked to your account and must be deleted separately in the app’s settings.

Contact: [email protected]

Records retained after community account deletion (iOS and Android)

Kept after deletion: your handle is detached from you but stays reserved so nobody else can take it; a record that the deletion ran (an internal id and a time) for up to 30 days; and, for Sign in with Apple, possibly a marker that this sign-in was revoked (no name, no email), written if Apple notifies us, until sign-in credentials could no longer be valid. If another user had blocked you, we also keep a one-way code derived from your sign-in identity, used only so that block still applies if you register again with the same Apple or Google account; it contains no nickname, handle or content, has no time limit, and is removed when the person who blocked you unblocks you or deletes their account.

Contact