≈ OISurf.

OISURF · SYDTECH, LLC

Privacy Policy

Effective date: October 28, 2026

This Privacy Policy explains how Sydtech, LLC ("OISurf," "we," "us") handles information when you use oisurf.com. Contact us at guru@gosydtech.com about privacy or support.

Current service: Public forecasts are available without an account. Display preferences and visit history stay in your browser. Signed-out favorites stay in your browser; signed-in favorites are saved to your account. Optional Google sign-in is supported through Supabase when configured. Email registration is not yet enabled. The account section below explains Google sign-in and the planned email feature.

1. Information we handle today

We offer optional Google Analytics 4 as described below. We do not install advertising pixels. Hosting statistics may still use technical request data regardless of your analytics choice. Our maps are served locally without an external map-tile service. Local storage is separate from cookies. Signing in uses essential secure session cookies; public forecasts do not require them. Local visit history ranks your own frequently opened spots, not global visitor popularity, and is not sent to our server. Use Clear my visit history in the directory to remove those counts.

2. Uses and sharing

We use information to deliver requested forecasts, remember device preferences, secure and troubleshoot the service, respond to messages and comply with legal obligations.

Hosting: Hostinger and infrastructure providers process technical information to host and secure the site. See Hostinger's Privacy Policy.

Environmental data: Our server requests marine and weather forecasts from Open-Meteo and buoy observations and tide predictions from NOAA. These requests contain fixed public beach/offshore coordinates or public station IDs. We do not include your name, email, browser IP address or Google credentials in forecast-provider requests. Providers receive our server's network information. Shared forecast caches contain public environmental data, not visitor profiles. See Open-Meteo's Privacy Policy and NOAA's privacy information.

We may disclose relevant information when required by law or reasonably necessary to investigate abuse or protect legal rights. We do not sell personal information or share it for cross-context behavioral advertising. We do not use personal information or Google user data to train generalized artificial-intelligence or machine-learning models. Providers may process information in countries other than where you live. Linked websites have their own policies.

Optional Google Analytics

With your permission, Google Analytics 4 measures visits to public pages and surf forecasts so we can understand usage and improve the service. It uses analytics cookies and processes technical information such as browser and device details, page views and approximate location derived from network information. Google receives your network request, including your IP address; Google states that GA4 does not log or store individual IP addresses. See Google’s Privacy Policy.

We load the Google tag only after you choose Allow analytics. No thanks keeps it off. You can change your choice through Analytics preferences in the footer. We also keep analytics off when your browser sends Global Privacy Control or Do Not Track. We remember your choice on this browser for up to six months. Analytics cookies are configured to expire after 90 days, with renewal subject to browser and Google behavior.

We send public page and supported spot views. We do not send account identifiers, email addresses, authentication codes, saved favorites, stored visit counts or free-form searches to Analytics. Account and authentication pages are excluded. We strip queries and fragments from reported page URLs and reduce referrers to their origin. Pages with unrecognized queries or fragments are excluded from tracking. Google Signals and advertising personalization are disabled in our tag; we do not use Google Analytics for advertising.

Withdrawing consent stops future analytics and removes accessible Google Analytics cookies from this site; it does not delete information already received by Google. Essential sign-in cookies and local spot preferences remain available. Analytics retention also depends on our Google Analytics property settings. Contact us about access or deletion requests; because we do not link analytics to an account, we may be unable to identify an individual analytics record.

3. Google sign-in and planned email accounts

Google sign-in uses Supabase as the authentication provider. We store your verified account identifier, email and basic display name with an encrypted server-side session. Access and refresh tokens remain on the server; the browser receives an opaque session cookie. We store account favorites as supported spot IDs in an encrypted private database, keyed to your verified account, so they can be retrieved on your other signed-in devices. We do not automatically upload browser-only favorites. Visit history, theme and display preferences remain browser-local. Email registration remains planned.

If you choose email registration when available, the authentication provider will process your email address and authentication credentials to create and secure your account and send confirmation or password-reset messages. For Google sign-in, we request only basic identity permissions: openid, email and profile. Google may provide an account identifier, email address and basic profile information such as your name and picture. OISurf will not receive your Google password or request access to Gmail, Drive, Calendar or Contacts.

We use Google identity information only to authenticate you and operate your account. Favorite syncing is optional through signing in; public forecasts remain accessible without an account. Supabase processes identity and session information, including login-related network information such as IP address and browser details; a configured email provider will deliver account messages. We will identify the email provider before public email signup opens. See Supabase's Privacy Policy and Google's Privacy Policy.

OISurf's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data will not be sold, used for advertising or used for unrelated profiling. We will request additional permission before a new use that requires it.

You can revoke Google access through your Google Account connections. Revocation does not by itself delete data already saved with OISurf; contact us separately to request deletion.

Public community surf reports

Signed-in visitors can publish a spot report containing an observation time, estimated wave-face height range, conditions, wind and an optional plain-text note. Reports are public under a generated surfer alias associated with the account. We do not publish your Google name, email, authentication tokens or account identifier with a report. The alias connects reports by the same account; it is not a promise of anonymity, and notes may reveal information you choose to include. Do not include contact details, other people’s personal information or sensitive information.

We store reports, pseudonymous account ownership, moderation flags and limited posting-limit records on our private hosting infrastructure. Authorized moderators can review flags and hide or restore reports. Flagging requires sign-in; we do not publish the flagger’s identity. We use this information to publish observations, prevent abuse and moderate content. Reports are user observations, not verified measurements. They are not automatically used to change forecast ratings or train a forecast model. Report content and aliases are not sent as Google Analytics events.

You can delete your own reports while signed in. Deletion removes them from future public responses; it cannot recall copies or screenshots already made by others. Reports and associated flags are retained for up to 180 days after publication, with periodic cleanup; hidden reports follow the same retention. Posting-limit records expire after roughly 24 hours. Infrastructure backups may retain older records according to backup settings. Signing out or revoking Google access does not delete public reports. Contact us for verified account-data deletion requests, including reports and flags.

4. Your choices and requests

You can view public forecasts without signing in. Remove individual account favorites through the Saved control while signed in. Changes apply across your signed-in devices when refreshed. Signed-out browser favorites are separate; clearing site storage removes those and other browser preferences from that device, but does not delete account favorites. Use Clear my visit history to remove the local visit counts. Blocking local storage may prevent preferences from being remembered.

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal information, object to or restrict processing, or withdraw consent. Contact guru@gosydtech.com. We may need to verify your identity and retain certain information for legal or security reasons. We do not need your account password. Where applicable, you may also complain to your local data-protection authority.

5. Retention and security

Browser preferences remain until removed by you or your browser. In-memory abuse counters expire and are periodically removed. Infrastructure log and backup retention depends on the hosting provider and account settings; contact us about a specific request. We retain support correspondence as needed to respond, resolve issues and meet applicable legal obligations.

Public forecast-cache records may remain until replaced or administratively removed; refresh thresholds are not promises of immediate deletion. Account favorites remain until you remove them or request account-data deletion; signing out or revoking Google access does not delete them. Infrastructure backups may retain older encrypted records according to backup settings. OISurf server sessions expire after seven days; pending sign-in attempts expire after ten minutes. Expired session records are periodically removed. Signing out deletes the local server session. Supabase may retain the authentication account until it is deleted through its account administration process; contact us to request account deletion. Infrastructure backups can retain encrypted session records according to backup settings. We use HTTPS and reasonable access controls, but no internet service or storage system guarantees absolute security.

6. Children

OISurf is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information so we can investigate and remove it where appropriate.

7. Changes and contact

We may update this policy as the service changes. We will publish the revised policy and effective date here and provide additional notice or obtain consent where required for material changes.

Operator: Sydtech, LLC
Privacy and support: guru@gosydtech.com
Website: https://oisurf.com/

Also see our Terms of Service.