Privacy

Places you save (“pins”)

A pin is a latitude, a longitude, a radius and a name you choose. It is stored so the forecast can be computed for that spot and so an alert can be sent when a wave is coming to it. If you tap Use my location, the app reads your position once to move the map marker; you can drag it anywhere before saving, and the coordinate that is saved is whatever the marker ends at. Nothing is recorded until you save a pin, and deleting the pin deletes the coordinate.

Live position, course and speed (LINEUP only)

Used only to work out where and when ships' wakes reach your boat, and whether your track runs into a keep-out zone. While the LINEUP screen is open, your position, course and speed are sent every few seconds and held in memory for at most ten minutes after your last update. They are never written to disk, never joined to your pins, alerts or account, and never kept as a history.

Boat tracks (LINEUP, only when you turn on Record)

If you turn on “Record this session”, the boat's position every few seconds, its speeds, and the wakes met are saved to your account as a ride session when you tap End, exactly like a GPX track you upload from a watch. It is private by default. You can explicitly make it public or create a private invitation for one recipient. You can delete it any time, and deleting your account deletes the server-stored session and its invitations. Phone recording happens only while Record is on and the LINEUP screen is active; it pauses when the phone screen is off. Apple Watch recording is separate and works as described below.

Apple Watch recordings (optional)

Apple Watch recordings are optional. After you tap Record and allow Location, the companion records time, position, available speed and course, and GPS accuracy while recording is active, including with the screen lowered. Stop ends GPS capture. Recordings are limited to four hours; interruptions or unavailable GPS can leave gaps.

The route is saved locally on the Watch and transferred to the paired phone when available. You review it on the phone and choose Keep or Discard. Keep requires signing in and saves the journey privately, using a local upload queue when offline. The Watch retains its copy until the phone acknowledges your decision. Watch-only recording does not collect the phone’s live AIS feed or HealthKit data.

Private journey invitations

An owner can explicitly create a private invitation containing a route, times and recorded encounters. One signed-in recipient can accept it, and the owner can see the accepting account’s handle. Invitations expire after 30 days and the owner can revoke access sooner. Recipients cannot edit or invite others. They may retain screenshots or exported copies; revocation cannot remove copies already taken. Deleting the server-stored journey or its owner’s account removes its invitations.

A device identifier

On first launch the app is issued a random device key. It is a random number, not derived from your hardware and not shared with anyone. It exists so your pins and alerts belong to your phone before you have created an account, and so the app can work with no account at all. It is stored on your device in the system keychain.

This website's device key, and its LINEUP page

The website works with no account. The first time it needs one, your browser is issued a random device key, kept in the browser's local storage, so your pins and a live LINEUP session belong to this browser and no one else's; it is not a cookie. On the LINEUP page your position is read continuously only while the page is open and in view, after you agree on the page, and is handled as described under Live position, course and speed above. Removing this site's data in your browser removes the key.

Push notification token, if you turn alerts on

Turning alerts on registers a push token for your device with Apple or Google — on iOS, an Apple Push Notification service (APNs) device token — and stores it against your device key, together with your time zone so quiet hours land at the right hour of your night. It is used only to deliver the alerts you turned on. On iOS we send alerts to Apple directly; on Android they go through Expo's push service to Google. Turning alerts off, or deleting the app, ends this.

Purchase data, if you subscribe to Swell Signal Pro

Buying Pro in the iOS app sends us Apple's own transaction identifiers, the product you bought, its status (active, in a billing grace period, cancelled, expired) and its expiry date, linked to your account or device. That is what unlocks Pro and keeps it unlocked while the subscription is active. Apple handles the purchase itself — no card or payment details ever reach us. Deleting your Swell Signal account unlinks this record from you, but does not cancel the Apple subscription itself; cancel that separately in Apple ID settings.

Basic app facts

Platform (iOS or Android) and app version, so a bug can be traced to a release. Nothing about your hardware model, and no advertising or vendor identifier.

A phone number, only if you turn on text alerts

On the website, a Swell Signal Pro subscriber can ask for wave alerts by text message. Only then is a phone number stored, against your account, and used for nothing but those texts. Removing it from your account settings, or deleting the account, deletes it.

An account, only if you make one

An account is optional. Almost everything — the map, pins, tides, wind, alerts and the widgets — works without one. Signing up stores a handle you choose and a password that is stored only as a salted scrypt hash, never as text. An account is needed for saved display layouts and for pairing a wall screen, because those follow you across devices.

Reports you choose to send

After a predicted wave you may be asked how it actually was. If you answer, the rating and any comment are stored against your account. This is what calibrates the physics, and it is the only user-written content the service holds. Answering is always optional.

Limited first-party usage measurement

When usage measurement is enabled, the app and website tell our own server when they are in the foreground. We record the UTC day, first and last observation times for that day, platform and app version, approximate sessions separated by 30 minutes, and whether a forecast loaded or you saved a pin or tide place, submitted a rating or ride, or read alert history. Background refreshes, widgets and wall displays do not count as active use. We also count verified production subscriptions to understand adoption, excluding test purchases and complimentary access.

Usage records contain pseudonymous identifiers derived from the existing random device identity and, only while signed in, your account identity. Signing in lets activity from your signed-in devices count as one account. Anonymous activity remains separate; we do not guess which devices belong to the same person. The usage store does not contain your account handle, email, phone, IP address, precise location, push token, purchase transaction identifier, saved-place names or written comments. No third-party analytics service receives these records, and they are not used for advertising or tracking across other apps.

Daily usage records are kept for up to 90 UTC days. Deleting your account removes its usage records and those of its currently linked devices; asking the app to forget a device removes that device's usage records. Optional activity summaries are visible only to the operator through a local report. Usage measurement is enabled only after these disclosures and the app store privacy answers have been published.

• Apple and Google deliver push notifications to your device (older app versions and Android route them through Expo's push service); they receive the notification and the token it is addressed to. Apple additionally processes Swell Signal Pro purchases and subscription billing — Pro is sold and billed entirely through the App Store, and we never see your payment details.
• Esri serves the map background on this website, and OpenFreeMap serves it in the app. Loading map tiles reveals your IP address and which part of the chart you are looking at to that service, as any map does.
• Amazon Web Services sends text-message alerts, if you turned them on; it receives your phone number and the text of the alert.
• Cloudflare carries traffic between your device and our server; like any network provider it sees your IP address and the requests passing through.
• Photon (run by komoot, built on OpenStreetMap) and the US Census Bureau geocoder answer the search box when you make a pin in the app. What you type goes from your phone straight to Photon with the map's centre, so nearby places come first, and to the Census geocoder when it looks like a street address. They see that text, that point and your IP address, as with any web request; no identifier, account or device information is sent, and the search is not sent to our server.
• Public weather and tide services (government forecast agencies and a weather-data API) are asked for the forecast at a pin's approximate position, rounded to about 10 km. No identifier, account or device information is sent with that request.
• NOAA, WSDOT and a commercial vessel-traffic feed supply tides, ferry sailings and ship positions. Data flows from them. Nothing about you is ever sent to them.

The services described above help operate the app. A recipient you explicitly invite can view the journey they accept.

Pins, account details and reports are kept until you delete them. Deleting a pin deletes it. Deleting your account, from Settings → Account in the app, deletes the account and everything attached to it — sessions, pins, reports and ratings — and detaches it from any device. That is immediate and cannot be undone.

Deleting the app without deleting the account leaves the account in place; delete the account first if that is what you want. To have data removed by hand, or to ask what is held, write to the address below.

Everything travels over HTTPS. Session tokens and the device key are held in the iOS keychain or the Android keystore, not in ordinary storage. Passwords are stored only as scrypt hashes. No credential is ever sent to the browser or written into a page.

Swell Signal is not directed at children and does not knowingly collect anything from a child under 13.

If this policy changes in a way that affects what is collected, the effective date at the top changes and the app notes it on the next update.

[email protected]