Privacy Policy
Last updated
This document is a working draft.
Some details below are still marked [TODO] and have not been settled yet. It has not been reviewed by a lawyer. If something here matters to a decision you are making, ask us before relying on it.
This policy explains what [TODO: legal entity name] ("Board Hogs", "we", "us") collects when you use Board Hogs, what we do with it, and what is published where other people — and search engines — can see it.
Board Hogs is a public catalog by design. A lot of what you add is meant to be seen. Section 5 lists the controls you have over that and says plainly what each one does and does not cover.
1. Who is responsible for your data
[TODO: legal entity name] is the controller of the personal data described here. You can reach us at [TODO: contact email], or by post at [TODO: postal address].
2. What we collect
Almost everything Board Hogs holds about you is something you typed in or uploaded. We do not buy data about you, and we do not track you across other websites.
- Account: your email address and a hashed password, held by our authentication provider. We never see your password in readable form. If you sign in with a third-party provider instead, we receive the email address and basic profile it gives us. When you create an account, we also save any short campaign labels and public profile referral name present in that signup page’s address. These labels are supplied by the link and are not verified referrals.
- Profile: your username, display name, bio, avatar image, unit preferences, and — if you choose to set one — a home location, which is covered in detail in section 3.
- Your quiver: the boards you add, including shaper, model, dimensions, volume, fin setup, condition notes, the conditions you ride them in, photos, and whether a board is marked for sale or open to trade with a price.
- Board–spot stories: the places where you have ridden a board, an optional overall fit assessment and note, story visibility, photos, and discussion. A session can establish that you rode a board at a spot, but its daily rating and note do not become the board’s overall fit or story note.
- Rider details, if you fill them in: your height, weight, years surfing, and self-described ability. These are visible only to you unless you choose to publish them, and where a weight is published it is shown as a range rather than an exact figure.
- Sessions: the date, length, rating, written notes, spot, and board for each session you log, plus optional condition tags (swell size, wind, tide, crowd, break type), an optional note about where you stayed, and any photos you attach.
- Surf conditions for your sessions: when you log a session at a known spot, we fetch the historical swell, wind, and water temperature for that place and date from a public marine weather service and store it alongside the session. This is weather data about the spot, not about you.
- Contributions: board and spot reviews, ratings, comments, votes, suggested catalog edits, spot submissions, and shaper page claims.
- Derived information: activity records that drive your feed and notifications, a points ledger recording what you have contributed, aggregate statistics about which boards perform in which conditions, and a "Surf DNA" summary computed from the conditions in your logged sessions.
- Technical records: our hosting and database providers keep standard server logs, including IP addresses, for security and reliability. Your browser also reports blocked-content security violations to us; those reports identify the blocked source but contain nothing that identifies you.
3. Location, specifically
Board Hogs does not track your location. There is no background location collection, and nothing on Board Hogs reads your device location unless you press a button asking it to.
What we store is derived from something you type. If you set a home location on your dashboard, you type a place — a city, state, or country — and we look it up through OpenStreetMap's public geocoding service to get a coordinate pair for that place. We store the text you typed and the resulting coordinates. The coordinates are as precise as the place you named, so naming a city gives us a city; they are not a reading of where you actually are.
We use that pair for two things: sorting boards for sale by how far they are from you, and a proximity element in how your feed is ordered. Your coordinates are readable only by you. No page on Board Hogs displays them, the data that builds your public profile page has them removed before it leaves the database, and our interface will not return them to anyone signed in as somebody else — the permission to read those two values is held by your own account alone. What other people see is the free-text place name you typed, which is shown on your profile and on your listings.
The board marketplace can also ask your browser for your current location, and only if you agree to your browser's prompt. That reading is used to sort the results you are looking at and is placed in the page address so the search can be shared or reloaded. It is not saved to your profile or stored by us.
Setting a home location is optional. You can clear it, and you can use Board Hogs without one.
4. What we use it for
We use what we collect to:
- Run the service — show your quiver, board–spot stories, optional session diary, profile, and the catalog pages your boards link to.
- Order your feed, using who you follow, what equipment you have in common with other surfers, how recent something is, and how far away it happened.
- Build aggregate statistics about boards, models, and spots across many users. These aggregates do not identify you.
- Count signups by the campaign labels in a signup link, so we can tell which links bring people to Board Hogs.
- Send you in-app notifications about follows, comments, reviews of your boards, and matches for boards on your wish list.
- Send you account emails — confirming your address and resetting your password. We do not send marketing email.
- Moderate content, investigate reports, enforce the terms, and protect the service against abuse.
5. What is public, and the controls you have
These are rendered for anyone, signed in or not: your profile, each of your public boards, public board–spot stories shown within board and spot pages, public sessions, the reviews and comments you write, the quiver directory, the board marketplace, and every shaper, board model, and surf spot page. Search engines may index and cache public pages. Pages are also cached at our hosting provider's edge for up to a day, so a change you make can take time to disappear everywhere.
The controls you have, and precisely what each one covers:
- Session privacy, set per session. "Private" means only you. "Friends only" — the default for a new session — means you and people who follow you. "Public, hidden spot" publishes the session without naming the break. "Public" publishes it in full.
- Board visibility, set per board. A private board does not appear on your profile, in the directory, or in the aggregate data on board and spot pages.
- Board–spot story visibility, set per story. A private story is readable only by the board owner. A story on a private board is private regardless of the story setting. Story photos use the same visibility rules and are served through an access-checking proxy.
- Surf passport, off by default. Controls whether the globe of places you have surfed appears on your profile.
- Rider details, off by default. Controls whether your height, ability, and weight band appear publicly.
- Show my activity to people who don't follow me. This one is not a privacy setting, and the app says so where you toggle it: it controls whether your public activity can be recommended to strangers in their feed. Turning it off does not make anything private — public content stays reachable at its own address either way.
- Photos follow the thing they are attached to. A photo on a session is visible to exactly the people the session itself is visible to, and a photo on a board or a board–spot story follows that board or story. This is enforced on the file itself, not only on the page: every photo is served through a proxy that checks whether you are allowed to see it before it returns the image, so having a link to the file is not on its own a way to view it.
6. Who else can see your data on Board Hogs
Other users see what your settings publish, plus a few things that are public by their nature: your reviews and comments are attributed to you, and the record of what you have contributed — the points you earned and what you earned them for — is readable rather than private, because it is what community rankings are built from.
Some data is yours alone. Your full surf statistics, your year-by-year totals, your notifications, and the individual votes you cast on other people's content are visible only to you. Activity records respect the audience of the thing they describe.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There are no advertising trackers on Board Hogs. We use Google Analytics to understand how the site is used, as described in sections 7 and 8.
7. Who processes your data for us
Board Hogs is a small operation and relies on other companies to run. Each of these receives only what it needs to do its job.
- Supabase — authentication, database, and file storage. This is where your account and everything you post lives.
- Cloudflare — hosting, page serving, and edge caching. Requests to Board Hogs pass through it.
- OpenStreetMap Foundation — geocoding. When you set a home location, or search the marketplace by place name, the text you typed is sent to their public lookup service to be turned into coordinates.
- Open-Meteo — historical and forecast marine and weather data. When you log a session at a known spot, the spot's coordinates and the date are sent to retrieve the conditions for that session.
- Google Analytics — aggregate usage measurement: which pages are viewed, roughly where visitors come from, what device and browser they use, and whether actions such as saving a board or review or sharing a page complete. Action events use broad labels, without account or board identifiers, review text, or exact coordinates. Page addresses are cleaned before they are sent, so sign-in links and recovery codes never reach Google. Google signals and ad personalisation are switched off, and the data is not used for advertising.
9. Keeping and deleting your data
We keep your account data for as long as your account exists, and content you post for as long as you leave it up. You can delete individual boards, board–spot stories, sessions, reviews, and photos yourself at any time.
There is currently no button that deletes your whole account. To have your account and its data deleted, email us from the address on the account at [TODO: contact email] and ask. We will confirm your request and carry it out by hand. We aim to do this within 30 days.
Deleting your account removes your profile, boards, board–spot stories, sessions, reviews, photos, and other content associated with it. Three things survive, and you should know which: aggregate statistics that no longer identify you are not unwound; routine backups expire on their own schedule rather than immediately; and copies that search engines or other third parties have already cached are outside our control.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it in a portable form, object to or restrict certain processing, and withdraw consent you have given. If you are in California, you also have the right not to be discriminated against for exercising these rights — and, as stated above, we do not sell personal information or share it for cross-context behavioural advertising.
You can exercise most of these directly: your profile and content are editable, and per-item deletion is built in. For anything else, including a full account deletion or a copy of your data, write to us at the contact address above. We will not charge you for a reasonable request.
If you think we have handled your data badly, please tell us first — but you may also complain to your local data protection authority.
11. Children
Board Hogs is not intended for children under 13, or under 16 in the European Economic Area and the United Kingdom, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
12. Where your data is held
Board Hogs's database and file storage are hosted in AWS US West (N. California), us-west-1, and our pages are served from a global edge network, so your data may be processed in countries other than the one you live in. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the safeguards our providers put in place, including standard contractual clauses.
13. Changes and contact
We will update this policy as Board Hogs changes — in particular, if we add another analytics provider or an email service, this page will say so before it ships, not after. The date at the top always reflects the current version, and we will give notice of material changes through the service.
This policy is governed by the laws of [TODO: governing jurisdiction]. Questions, requests, and complaints go to [TODO: contact email].