Privacy Policy

The short version

Ebbward shows ocean conditions for beaches on US coasts, from a catalog we curate. You can use it without an account. An account lets you sync your saved beaches and settings, post and flag underwater-visibility reports, set condition alerts and send feedback. Ebbward is run by Endpaper Labs LLC (“we”). We collect only what these features need, we do not sell your data, and there are no ads.

What we collect

• Account: your email address, the name you enter, and a securely hashed password. We record whether you confirmed your email.
• Sign-in sessions: when each session started and was last used, and the app's user agent (device and app version).
• Synced preferences: your units, light or dark appearance, selected beach and saved beaches, so they follow you between devices.
• Visibility reports you post: the beach, when you observed the water, visibility, method, depth, surge, where you got in and your notes. Other people using Ebbward see your report with your first name only (or “A tester”), never your email.
• Flags you raise: which report you flagged, the reason and any note. Only our team sees flags.
• Condition alerts: your alert rules (beach, wave and wind limits, time window, on or off) and the alert delivery history (what we sent and when, and whether it reached a device).
• Push notification tokens: if you allow notifications, the token your phone gives us so we can send alerts. Turning notifications off or removing the app disables it.
• Feedback and bug reports: what you write, your account email (or the address you give when signed out) and basic device details (app version, platform, OS version, device model).
• Security and server logs: to stop abuse of sign-in, sign-up and similar actions we keep short-lived rate-limit records keyed on your IP address (and, where the request names one, an email address); they are removed within a day of expiring. Our hosting also keeps technical logs, such as errors and request details, to keep the service running and secure.

We do not ask for your contacts or photos, and never for your location in the background. Ocean conditions come from public forecast and observation services (Open-Meteo, NOAA, the National Weather Service); our server requests them for the beach you look at, and nothing about you is sent to them.

• Finding a beach: what you type in the beach search is sent to our server. When it looks like a place name, our server looks it up with Open-Meteo's geocoding service; only the words you typed are sent, never who you are.
• Near me: only when you tap Near me, the app asks for your location at that moment and sends the coordinates to our server to find nearby beaches. We use them for that one answer and do not store them.
• Maps: the beach map loads its background tiles from OpenFreeMap, which, like any website, sees your IP address when it sends them.

How we use it

To run your account and sync your settings, show visibility reports to other people, review flagged reports, send the alerts you set up (one morning push per alert per day, only when your limits fit), answer feedback and keep the service secure. Condition alerts are a convenience, and Ebbward is not a safety service: see the Terms.

Who processes it

• Hosting and database: servers we operate in the United States (Hetzner, Hillsboro, Oregon). If you use Ebbward from outside the US, your data is processed and stored in the US.
• Email: account, confirmation and password emails, and our own notifications about feedback and flags, are delivered by Resend.
• Push notifications: delivered through Expo's push service to Apple or Google.

We do not sell or rent your data, and we do not share it with advertisers or data brokers.

How long we keep it

• Visibility reports stop being shown at the end of the local day at that beach (midnight in the beach's time zone) on the day they describe, and are deleted 30 days later. You can delete your own reports at any time.
• Alert rules stay until you delete them or your account. Alert delivery history stays until you delete your account; the app shows the last 30 days.
• Everything else stays while your account exists.

Deleting your data

Delete your account in the app, or email us from the address on the account. Deletion removes your account, sessions, synced preferences, visibility reports, flags, alert rules and history, and push tokens. Details are on the account deletion page.

Children

Ebbward is not directed to children under 13, and we do not knowingly collect their data.

Changes and contact

This policy may change as the beta grows; we will update this page and its date. Questions or requests: hello@endpaperlabs.com, or see Support.