Privacy Policy
Last updated: August 2026
1. Who We Are
Shacked ("we", "us", "our") is a surf forecasting service operated by oscon e.U., contactable at hello@shacked.surf. oscon e.U. is the data controller for personal data collected through shacked.surf and the Shacked iOS application.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all users of shacked.surf and the Shacked iOS app.
2. Data We Collect and Legal Basis
Account information
Email address and profile photo (received from Google when you sign in with Google OAuth).
Legal basis: Performance of a contract — necessary to provide your account, saved spots, and swell alerts.
Usage and preferences
Your saved surf spots, swell alert settings, and unit preferences (e.g. feet vs metres).
Legal basis: Performance of a contract — necessary to sync your settings across devices.
AI report inputs
When you generate an AI surf report, wave and wind condition data for the selected spot (no personal identifiers) is sent to Anthropic's API to generate the report text.
Legal basis: Legitimate interest — providing the AI report feature you have requested. No personally identifiable data is included in the prompt.
Location data
If you use the "Near Me" feature, your device's location is used only to sort nearby surf spots. It is processed on-device and is never transmitted to or stored on our servers.
Legal basis: Consent — you grant location access to your device when prompted.
Analytics and performance data
We may use Vercel's built-in analytics to understand aggregate page traffic. This does not use cookies and does not track individuals.
Legal basis: Legitimate interest — understanding how the Service is used so we can improve it.
3. How We Use Your Data
- To authenticate your account and keep you signed in
- To store and sync your saved spots and alert preferences
- To send swell alert notification emails when alerts you have set are triggered
- To generate AI surf reports based on forecast data
- To understand aggregate usage patterns and improve the Service
We do not sell your personal data. We do not use your data for advertising profiling.
4. Third-Party Processors
We share data with the following third-party service providers, each acting as a data processor on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database storage of account and alert data | EU (AWS eu-west-1) / US |
| Google (OAuth) | Sign-in only — we receive email and profile photo | Global |
| Anthropic, Inc. | AI surf report generation — wave/wind data only, no personal data | USA |
| Open-Meteo | Wave and weather forecast data — no personal data shared | EU |
| WorldTides | Tide prediction data — no personal data shared | Global |
| Vercel, Inc. | Hosting and edge delivery of the web application | Global |
| Apple, Inc. | iOS app distribution via the App Store | Global |
5. International Data Transfers
Some of our third-party processors (including Vercel, Anthropic, and Google) are based in the United States. When we transfer personal data from the European Economic Area (EEA) to these providers, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission, and — where applicable — the EU–US Data Privacy Framework.
Supabase stores data in the EU (AWS eu-west-1) by default. If you have questions about specific transfer mechanisms, contact us at hello@shacked.surf.
6. Data Retention
We retain your account data for as long as your account is active. If you delete your account, your personal data (email, saved spots, alert settings) is removed from our active database within 30 days. Anonymised, aggregated analytics data may be retained indefinitely.
We may retain data for longer periods where required by law or for the establishment, exercise, or defence of legal claims.
7. Your Rights
Depending on where you are located, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your personal data ("right to be forgotten").
- Portability: Request your data in a structured, machine-readable format so you can transfer it to another service.
- Restriction: Request that we restrict the processing of your data in certain circumstances.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at hello@shacked.surf. We will respond within 30 days. You may also delete your account directly from within the app, which will trigger erasure of your personal data.
If you are located in the EU or EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your national data protection authority (e.g. your country's DPA, or the Austrian Datenschutzbehörde if applicable).
8. Cookies and Tracking
Shacked does not use advertising cookies or third-party tracking cookies. We use a session cookie set by Supabase to keep you signed in. This cookie is strictly necessary for authentication and does not require consent under the ePrivacy Directive.
Vercel Analytics, if active, operates without cookies and does not track individual users. No other analytics or advertising trackers are deployed.
9. AI-Generated Content
The surf report feature uses an AI language model operated by Anthropic, Inc. When you generate a report, forecast data for the selected spot (wave height, swell period, wind speed) is sent to Anthropic's API. No personally identifiable information is included in these requests. Anthropic's use of this data is governed by their Privacy Policy. AI-generated reports are clearly labelled within the app and are for informational purposes only — see our Terms of Service for the full disclaimer.
10. California Residents (CCPA)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how we use it, the right to request deletion, and the right to non-discrimination for exercising your privacy rights.
We do not sell personal information. We do not share personal information with third parties for cross-context behavioural advertising.
To exercise your CCPA rights, contact us at hello@shacked.surf.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page. For significant changes, we will notify signed-in users by email where reasonably practicable.
12. Contact
For any privacy-related questions, to exercise your rights, or to make a complaint, contact us at hello@shacked.surf.