Privacy Policy

← Back

1. Data Controller

2. What Data We Collect

2.1 Account Data

Upon registration, we collect:

• Email address
• Password (stored in encrypted form)
• Display name (self-chosen name)

2.2 Profile Data

Optionally, you may provide the following information:

• Sport(s): windsurfing, kitesurfing, wing foiling
• Gear data: sail size, board volume, kite size, wing size

2.3 Location Data

During an active session, we collect:

• GPS coordinates (latitude and longitude)
• Selected surf spot

2.4 Chat Data

When using the Spot Chat feature:

• Text messages
• Photos (compressed to a maximum width of 1200px)
• Time of sending
• Display name of the sender

All chat messages and photos are automatically deleted after 7 days.

2.5 Session Data

• Start and end time of sessions
• Selected surf spot
• Gear used

2.6 External Integrations (such as Garmin Connect)

You can connect RigSize Live to external fitness and sports platforms. When connecting an external service, we collect the following data from your activities with your explicit consent:

• GPS tracks (latitude, longitude, altitude)
• Session duration and time
• Speed data
• Heart rate (if available via your device)
• Activity type (windsurf, kite, wing, etc.)
• Device information (model of your sports watch or GPS device)

You can disconnect an external integration at any time via the settings in the app. Upon disconnection, the access tokens are immediately deleted. Previously imported session data will remain in your account until you delete it or cancel your account.

2.7 Reports

When you report a chat message, we store: the reported message ID, the reason for the report, and your user ID.

3. Legal Basis for Processing

Processing	Legal Basis (GDPR)
Account and authentication	Performance of the contract (Art. 6.1.b)
Location sharing and session tracking	Consent (Art. 6.1.a)
Spot Chat messages	Performance of the contract (Art. 6.1.b)
Leaderboards and statistics	Performance of the contract (Art. 6.1.b)
External integrations (Garmin)	Consent (Art. 6.1.a) — you consciously connect your account
Reports and moderation	Legitimate interest (Art. 6.1.f) — user safety

4. Purposes of Processing

We use your data exclusively for:

• Providing and improving the RigSize Live service
• Displaying your location and gear data to other active users on the real-time map
• Storing and displaying your session history and statistics
• Facilitating the Spot Chat feature
• Compiling leaderboards
• Automatically importing session data from external platforms (such as Garmin) when you have given consent
• Handling reports and enforcing the code of conduct
• Ensuring the safety and integrity of the app

We do not use your data for advertising, profiling, or selling to third parties.

5. Sharing of Data

5.1 With Other Users

The following data is visible to other users of the app:

• Your display name
• Your location on the map (only during an active session)
• Your gear data (only during an active session)
• Your chat messages and photos in the Spot Chat
• Your session statistics on leaderboards

5.2 With Service Providers

We use the following external service providers (processors):

Service Provider	Purpose	Location
Supabase	Authentication, database, session storage	EU (Frankfurt)
Firebase / Google Cloud	Chat, photo storage	EU (Belgium)
Garmin Connect	Importing session and GPS data (optional)	USA (SCC applicable)
Vercel	Application hosting	Worldwide (CDN)

We do not share your data with any other parties unless legally required by a court order or competent authority.

6. Data Retention Periods

Data	Retention Period
Account data	As long as your account is active
Location data (real-time)	Only during an active session; removed from the map immediately after
Session history	As long as your account is active
Chat messages and photos	Maximum 7 days
Externally imported session data	As long as your account is active, or until you manually delete it
External access tokens (Garmin)	Until you disconnect the integration, then immediately deleted
Reports	Maximum 90 days
Blocked users	Stored locally on your device

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access — you can request to see what data we process about you
• Right to rectification — you can have incorrect data corrected
• Right to erasure — you can request deletion of your data
• Right to restriction — you can have the processing of your data restricted
• Right to data portability — you can request your data in a structured format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw previously given consent (e.g., location sharing, Garmin connection) at any time

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

You also have the right to file a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).

8. Security

We take appropriate technical and organisational measures to protect your data:

• All communication takes place over encrypted connections (HTTPS/TLS)
• Passwords are stored in hashed form (never in plain text)
• Database access is restricted through security rules (Row Level Security)
• Chat photos are stored with security rules that limit uploads to verified users
• Chat messages are automatically deleted after 7 days
• Third-party integrations use industry-standard OAuth 2.0 authentication; we never store your third-party passwords

9. Cookies and Local Storage

RigSize Live uses:

• Local storage (localStorage) — for storing your session settings, authentication tokens, and list of blocked users. This is necessary for the app to function.
• Session cookies — for authentication with Supabase and Firebase.

We do not use tracking cookies, advertising cookies, or third-party analytics.

10. Children

RigSize Live is not intended for children under the age of 16. We do not knowingly collect data from children under 16. If we discover that we have collected data from a user under 16, we will delete this data and the associated account as soon as possible.

11. International Data Transfers

We strive to keep your data within the European Economic Area (EEA). Where service providers process data outside the EEA (such as Vercel's CDN or Garmin's servers), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCC) or an adequacy decision.

12. Changes to This Privacy Policy

We reserve the right to modify this privacy policy. In the event of significant changes, we will notify you via the app. The most recent version is always available on this page.

13. Contact

For questions about this privacy policy or to exercise your rights: