← Back to Home

Privacy Policy

Effective: July 24, 2026 · Last Updated: July 25, 2026

1. Who We Are & Scope

Veer ("we", "our", or "us") is a wind-sports forecasting and session-tracking app for iOS. This Privacy Policy explains what information the app collects, how it is used, who it is shared with, and the choices and rights you have. For the purposes of the EU/UK GDPR, the data controller is [[LEGAL_ENTITY]]; contact details are in Section 12.

Privacy in one line: Veer works without an account, keeps your sessions, profile, and gear on your device, and only sends data off the device when a feature you turned on genuinely needs it (weather forecasts, alerts when the app is closed, purchases, and anonymous analytics).

2. No Account Required

Veer has no sign-up, login, or password. To operate subscriptions and analytics, the app uses Firebase Anonymous Authentication to assign a randomly generated identifier to your install. This identifier is not your name, email, or Apple ID, and we do not link it to your real-world identity.

3. Information We Collect

  • Anonymous identifier: a random, app-generated Firebase user ID used to associate your subscription entitlement and anonymous analytics with your install.
  • Location data: with your permission, the app uses your location to find wind spots near you and, during an active recording session, to draw your GPS track and calculate distance, speed, and personal bests. Recording continues with the screen locked and the phone in a pocket (indicated by the iOS blue status bar). Coordinates for the spots you view are also sent to third-party weather providers (Section 6) to return a forecast for that point. Location tracking during recording only runs while you are actively recording.
  • Motion & fitness data: during a session the app reads device motion sensors (accelerometer/gyroscope via CoreMotion) to detect jumps and airtime. This processing happens on your device. If — and only if — you switch on the optional "improve jump detection" data-donation control in Settings, anonymized motion samples may be shared to help improve detection. It is off by default and you can turn it off at any time.
  • Notification token & alert rules: if you enable alerts and grant notification permission, the app sends your Apple Push Notification service (APNs) device token together with the alert rules you created (the spots, wind ranges, directions, days, and hours you want to be notified about) to our backend, so alerts can reach you even when the app is closed. This is the most identifying information the app transmits; it is sent only after you ask for alerts, it is not joined to any other profile, and disabling alerts (or the in-app "remove alerts" action) deletes it from the backend.
  • Onboarding survey (optional): when you first open the app, you may be asked a short set of multiple-choice questions about why you downloaded it and how you plan to use it (e.g. how you heard about it, what you're hoping it helps with, how often you ride). Every question can be skipped. Answers are stored against the same rotatable, anonymous device value used for spot presence and reports — never against your Firebase ID, RevenueCat ID, or any other account or analytics identifier — so the survey cannot be linked to you or to your other activity in the app. We later note, on that same anonymous entry, whether the install started a trial or purchased a subscription, so we can see in aggregate which reasons for downloading correlate with becoming a paying rider. The in-app "Reset all data" action deletes the entry from our backend immediately.
  • Content you submit: if you choose to contribute, the app lets you submit spot photos, crowd reports (how busy a spot is, on a 0–4 scale), presence ("I'm here now" / "I'm going at 3pm" — spot-level only, never your exact coordinates, and expiring automatically), and spot corrections (a category such as wrong name, location, conditions, or a missing hazard, plus an optional short note). All of this is tied only to the same random, rotatable device identifier used for the onboarding survey above — never to your name or an account. Photos require a credit and licence from you at upload, and every photo is reviewed and must be approved before it is shown to anyone; other submitted content is filtered before display. Any rider can report content they consider objectionable, a photo that receives 2 reports is automatically hidden pending review, and we may block a device identifier that submits abusive content.
  • Apple Watch: a companion watchOS app can record sessions on your wrist. The iPhone app declares Apple's HealthKit entitlement solely so it can launch the Watch app to hand off a recording — it does not request permission to read or share any HealthKit data, and no health data is read. Sessions recorded on the Watch transfer to your iPhone like any other session.
  • Widgets & Live Activities: home-screen widgets and Live Activities can display forecast information (spot name, forecast window times, and score) and in-progress session data (sport, spot name, distance, speed, elapsed time, and jump count). This is shared with the widget and Live Activity extensions through a private container on your device only — it is not uploaded to us for this purpose.
  • Subscription & purchase data: subscriptions are processed by the Apple App Store and managed through RevenueCat. We receive purchase and entitlement status (e.g. free / trial / Pro) tied to your anonymous ID. We never see or store your card number or Apple ID password.
  • Analytics & diagnostics: we collect aggregated, non-personally-identifying usage events (screens viewed, features used, funnel steps) via Google Analytics for Firebase (GA4), linked only to your anonymous ID, to understand engagement and fix problems. We may also collect crash and performance diagnostics. We do not read your device's advertising identifier (IDFA) and do not track you across other companies' apps or websites for advertising purposes; the app's use of App Tracking Transparency is limited to Apple Search Ads attribution, described in Section 7.

What we do not collect: we do not ask for your name, email, phone number, or precise home address; we do not sell personal data; and we do not run third-party advertising.

4. How We Use Your Data

We use the data above only to deliver and improve the app:

  • Show spot forecasts, tide data, model comparisons, and computed RideScores.
  • Record and analyze your GPS sessions, speed, and jumps, and mint collectible spot badges on completed sessions.
  • Send the wind alerts you configured, including while the app is closed.
  • Verify and restore your Pro subscription entitlement.
  • Measure feature engagement and fix crashes, using anonymous analytics and diagnostics.

Legal bases (EU/UK GDPR): performance of our agreement with you (delivering forecasts, tracking, and subscriptions); your consent (location, notifications, the optional motion-data donation, submitting content, and App Tracking Transparency, each of which you can withdraw); and our legitimate interests in keeping the app secure and understanding aggregate usage.

5. On-Device AI

Plain-language summaries ("the read", score explanations, alert drafting, and session recaps) are generated by Apple's on-device Foundation Models on supported hardware. This processing happens entirely on your device — your forecasts, sessions, and prompts are not sent to us or to any external AI service for this feature. On devices without on-device AI, the app shows a deterministic, non-AI version of the same text.

6. Third Parties & Data Recipients

We share data only with the service providers needed to run the features above, each acting under its own terms:

  • Weather & ocean data providers (Open-Meteo, NOAA, aviation weather / METAR stations, Pioupiou): receive spot coordinates to return forecasts, tides, and station observations.
  • Apple (App Store & APNs): processes payments and delivers push notifications.
  • RevenueCat: subscription entitlement management.
  • Google Firebase (Anonymous Auth, Analytics/GA4, crash diagnostics): anonymous identity and usage analytics.
  • Our backend infrastructure: hosts the spot catalogue, forecast proxy, and the alert/notification service that stores your push token and alert rules.
  • Map tiles & rendering (Esri ArcGIS World Imagery; MapLibre GL JS, loaded from the jsDelivr CDN): the in-app wind map is a web page we host, shown inside the app. Loading it requests satellite map tiles from Esri and the MapLibre GL JS map renderer from jsDelivr; each of those requests reveals your IP address (and, for map tiles, the map area you're viewing) to that provider.
  • Apple Maps / MapKit: used entirely on your device to generate the aerial snapshot shown for a spot.
  • Apple Search Ads (AdServices): if you allow tracking via the App Tracking Transparency prompt, we collect the Apple AdServices attribution token and pass it to RevenueCat to attribute a subscription to an Apple Search Ads campaign. See Section 7.

Some of these providers may process data outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses. We do not sell your personal data or share it for cross-context behavioral advertising.

7. App Tracking Transparency & Advertising

The app shows Apple's App Tracking Transparency (ATT) prompt. If you allow tracking, this enables the app to collect the Apple AdServices attribution token, which we pass to RevenueCat so a subscription can be attributed to an Apple Search Ads campaign that may have led you to the app. The app does not read your device's advertising identifier (IDFA) directly, does not build advertising profiles, does not share data with data brokers, and shows no ads of any kind. Declining the prompt is fully supported — the rest of the app works exactly the same either way. You can change your decision at any time in iOS Settings → Privacy & Security → Tracking.

8. Storage & Retention

Your sessions, rider profile, quiver, and settings are stored locally on your device. Push tokens and alert rules are retained by our backend only while your alerts are active; inactive installs are pruned automatically, and unregistering deletes them. Onboarding survey answers (Section 3) are retained on our backend until you use "Reset all data," which removes the entry immediately. Content you submit (photos, crowd reports, presence, and spot corrections) is retained as part of the spot record until presence expires automatically, the content is removed through moderation, or you ask us to remove it (Section 9). Analytics events are retained in aggregate under our analytics provider's standard retention settings. Transport to all cloud services is encrypted in transit (HTTPS/TLS).

9. Your Choices & Rights

  • Grant or revoke location, notifications, and motion access at any time in iOS Settings.
  • Turn off alerts to delete your push token and rules from our backend, and toggle the optional motion-data donation off in the app's Data & Privacy settings.
  • Withdraw a presence post at any time from within the app, and ask us to remove other content you've submitted (photos, crowd reports, spot corrections) by contacting us using Section 12.
  • Change your App Tracking Transparency decision at any time in iOS Settings → Privacy & Security → Tracking.
  • Clear all locally stored app data from the in-app settings screen, or by deleting the app.
  • Depending on where you live (EU/UK GDPR, California CCPA/CPRA, and similar laws), you may have rights to access, correct, delete, or port your personal data, to object to or restrict processing, and to withdraw consent. Because the app is anonymous, exercising some of these rights may require information that lets us locate your data (such as your alert configuration). You will not be discriminated against for exercising these rights.

To make a request, contact us using Section 12. EU/UK users also have the right to lodge a complaint with their local data protection authority.

10. Children

Veer is not directed to children under 16 (or the minimum age of digital consent in your country) and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy as the app evolves. Material changes will be reflected by an updated "Effective" date above and, where appropriate, an in-app notice. Continued use after an update constitutes acceptance of the revised policy.

12. Contact Us

For privacy questions or to exercise your rights, contact [[LEGAL_ENTITY]] at cumakessci@gmail.com.