Privacy Policy

OpenWaterSpots is a community map and logbook for open-water swimmers. We collect the minimum we need to run it, we never sell your data, and you can delete your account — and everything attached to it — at any time from Profile → Edit → Account.

OpenWaterSpots (“we”, “us”) is operated by Alexandru Coci. For any privacy question, or to exercise the rights described below, email alexandru.coci@olympian.org.

• Account data — your email address and password (passwords are hashed; we never see them in plain text).
• Profile data — display name, bio, and avatar image, all optional and all chosen by you.
• Swim data — GPS tracks you record in the app or import from Strava, plus distance, duration, water temperature, and any photo or note you attach.
• Contributions — swim spots you add, photos, reviews, condition reports, votes, comments, meetups, and follows.
• Technical data — a session cookie that keeps you signed in, and standard server logs (IP address, timestamp) kept briefly for security and debugging.

We process account and profile data to provide the service you signed up for (performance of a contract). We process the social and contribution data — swims, spots, photos — on the basis of your consent, given each time you choose to post. Technical logs are kept on the basis of our legitimate interestin running a secure, working service. We do not use your data for advertising and we do not profile you.

OpenWaterSpots is a community platform, so by design your profile, your logged swims, the spots and photos you contribute, and your follows are visible to anyone, signed in or not. Your email address and password are never shown publicly. If you do not want a swim to be public, do not log it.

We rely on a small set of processors, each handling only what their function needs:

• Supabase — database, authentication, and file storage hosting.
• Vercel — application hosting and delivery.
• Mapbox — map tiles and geocoding; your coordinates are sent to render maps.
• Open-Meteo — weather and marine forecasts; spot coordinates are sent to fetch conditions.
• Strava — only if you choose to connect it, to import your open-water swims.
• Resend — only if email features are enabled, to deliver notification or digest emails.
• Unsplash — stock imagery for articles; no personal data is sent.

We never sell your data and we never share it for third-party marketing.

We keep your data for as long as your account exists. When you delete your account, your profile, swims, follows, likes, comments, photos, reviews, condition reports, and notifications are permanently removed. Swim spots you added to the community map remain (they belong to the shared catalogue) but are no longer attributed to you.

If you are in the UK or EU, the GDPR gives you the right to access, correct, export, or erase your personal data, and to object to or restrict its processing. You can edit your profile and delete your account yourself at any time. For anything else — a copy of your data, a correction, a complaint — email alexandru.coci@olympian.org and we will respond within 30 days. You also have the right to complain to your local data protection authority (in the UK, the ICO).

We use one essential cookie: the authentication session that keeps you signed in. We do not use advertising or analytics tracking cookies.

OpenWaterSpots is not intended for children under 16. We do not knowingly collect data from anyone under 16; if you believe a child has registered, contact us and we will remove the account.

We may update this policy as the product evolves. Material changes will be reflected in the effective date above; significant changes will be communicated in-app.