Privacy Policy

Who we are

Ebbward shows beach and ocean conditions for US coasts and the Great Lakes. It is made by Endpaper Labs LLC, a company based in California (“we”). This policy covers the Ebbward apps for iPhone, iPad, Mac and Android, and the website ebbward.com. Questions or requests go to hello@endpaperlabs.com.

The short version

• You can use Ebbward without an account. Your saved beaches and settings then stay on your device.
• An account (email and password, or Sign in with Apple or Google) lets you sync between devices, post visibility reports and get condition alerts. Visibility reports are public and show only the first word of your name.
• We collect what those features need. We show no ads, we do not sell or share your information, and we do not track you across other companies’ apps or websites.
• Crash reports go to Sentry. Usage analytics go to Umami, which runs on our own server, and you can turn analytics off in the app.
• Near me uses your location once, only when you tap it, and we do not store it.
• You can delete your account at any time, in the app or on the Delete account page.

What we collect and why

Without an account

• Saved beaches, recently viewed beaches, units and appearance are kept on your device, not by us.
• To show conditions, the app asks our server for the beaches, forecasts and reports you look at. These requests carry no account, and we keep no record of them beyond the error logs and abuse limits described under Server and security logs.
• Beach search: what you type is sent to our server to find matching beaches. When it looks like a place name, our server looks it up in its own copy of the U.S. Census Bureau’s place names (the Census Gazetteer, kept in our database), so the words do not leave our server. Where that copy is not in use yet, or is unavailable, our server asks Open-Meteo’s geocoding service instead; only the words go to Open-Meteo, from our server, never your IP address or who you are. We do not store what you search for.
• Crash reports and usage analytics (below) identify your install by a random ID that is not tied to your name or email address.

With an account

• Email address: to sign you in, confirm the address is yours, reset your password and send account emails. We do not send marketing email.
• Name: we ask for your first name (Apple or Google may give us your full name). Other people only ever see its first word, on visibility reports you post.
• Password: stored only as a bcrypt hash that cannot be turned back into your password. Accounts that use Apple or Google have no password with us.
• Account details: when you created the account, whether and when you confirmed your email, the kind of device you signed up on, and the version of the Terms of Use you agreed to.
• Sign-in sessions: each lasts 30 days. We keep when it started and was last used, and the app’s user agent (app version, device type and system version).
• Synced preferences: units, appearance, selected beach and saved beaches, so they follow you between devices.
• People you hide: whose reports you chose to hide and when. Only you see this list; the other person is not told, and our team sees only how many people hid an account, never who.

Sign in with Apple or Google

Instead of a password you can use Sign in with Apple or Sign in with Google. Apple or Google handles the sign-in and confirms who you are to us; their own privacy policies cover that step.

• From Apple we receive a user ID that Apple creates for our apps (not your Apple ID itself), your email address and, if you choose to share it, your name. If you choose Hide My Email, Apple gives us a private relay address that forwards to your real one. We only ever see the relay address, and our emails reach you through Apple’s relay.
• We also keep a token from Apple, encrypted, so that when you delete your account we can tell Apple to revoke Ebbward’s access to your Apple ID.
• From Google we receive a Google user ID, your email address and your name. We do not receive your Google password, profile photo, contacts, or any access to your Google account.
• We save the name only when the sign-in creates a new account. If you already have an Ebbward account with the same email address, the sign-in links to it.

Visibility reports and what is public

• If you post a report, we store the beach, when you saw the water, the visibility, method, depth and surge you chose, where you got in (up to 80 characters) and your notes (up to 300).
• Reports are public. Anyone using Ebbward, including people without an account, sees the report with the first word of your account name (or “Someone” if there is none). Your email address is never shown.
• A report stops being shown at the end of the local day at that beach (midnight in the beach’s time zone) on the day it describes, and is deleted 30 days later. You can delete your own reports at any time.
• If you flag a report, we store which report, the reason and any note (up to 200 characters). Only our team sees flags. Two flags from different people hide a report until we review it.

Alerts and notifications

• Condition alerts: your alert rules (beach, wave and wind limits, time window, on or off) and the alert delivery history (which beach and day, the text we sent, and whether it reached a device). We send at most one alert per rule per day, in the morning at that beach, only when the forecast fits your limits. Alerts are a convenience, and Ebbward is not a safety service: see the Terms.
• Push tokens: if you turn on notifications, your device gives us a push token, which we link to your account so alerts reach you. On iPhone, iPad and Android the token comes from Expo’s push service, which passes each notification to the Apple Push Notification service or to Google’s Firebase Cloud Messaging. On a Mac we send notifications straight to the Apple Push Notification service. The notification text travels through those services.
• When you sign out or turn notifications off, the token is switched off and no longer linked to your account. Deleting your account deletes its tokens. We never send a notification to a token that is not linked to an account, such as one a signed-out Mac registered.

Feedback

You can send feedback or a bug report from the app, with or without an account. We store what you write, the kind of message, the app version and build, platform, system version and device model, and an email address: your account’s if you are signed in, or the one you choose to add if you are not. We use it to fix problems and, when there is an address, to reply. We receive an email notice about each bug report.

If you delete your account, we remove the text, email address and device details from feedback you sent while signed in. Feedback sent without an account is kept until you ask us to delete it; if you later delete an Ebbward account with the same email address, we remove that address from it.

If you test a pre-release version through TestFlight or Google Play testing, Apple or Google also share with us your tester email address, crash reports and any feedback you send through them.

Location for Near me

• Ebbward asks for your location only when you tap Near me, and only while you are using it. It never uses your location in the background.
• The app (or your browser, on ebbward.com) reads your position once and sends the coordinates to our server, without your account, to find the closest beaches. We use them for that one answer and do not store them. They are never linked to your account or sent to analytics.
• If that request fails, our proxy’s error log records it, coordinates included, for up to about seven weeks (see Server and security logs).
• Maps never show your position. In the iPhone, iPad and Android apps and on the website, map tiles come from OpenFreeMap; the Mac app uses Apple’s maps. Like any map service, they see your IP address and the area you view.

In the water (marine life near a beach)

• The species list for a beach comes from public sightings on iNaturalist. Our server asks iNaturalist about the area around the beach, not around you, using the beach’s position rounded to about a kilometer, and keeps the answer for days. Your location is never sent to iNaturalist, and neither is anything about you or your account.
• We show only photos their authors released for reuse (public domain, CC0, CC BY or CC BY-SA), each with its credit. They load directly from iNaturalist’s open-data host on Amazon Web Services (inaturalist-open-data.s3.amazonaws.com), so that host sees your IP address and which photo was requested, as with any image on the web. Our website loads these photos without a referrer, so the host is not told which page you were on.

Crash and error reports (Sentry)

• When the app, the website or our server hits a crash, a freeze or an error, a report goes to Sentry, a crash-reporting service. We also send a small sample of performance timings, such as how long a screen or a request took.
• A report says what went wrong and the steps just before it, with the app version, device model and system version and, if you are signed in, your account ID (a random code, not your name or email address).
• Before a report leaves the app or our server we remove email addresses, passwords, sign-in tokens, the query part of web addresses and the contents of requests.
• Crash reports are sent even if you turn off Share usage analytics, because we need them to fix the app; turning it off stops the performance timings. Sentry deletes reports automatically within 90 days.
• If you allow it in your device’s settings, Apple and Google also share crash statistics with us.

Usage analytics (Umami)

• To learn which features people use and where the app gets in their way, the app records simple events: opening a screen, viewing or saving a beach, searching, using Near me, setting an alert, posting or flagging a report, signing in (and with which method) or seeing an error.
• Each event carries the beach’s catalog ID where there is one, the app version and build, platform, device type, screen size and language, and a random install ID. Once you sign in, events also carry your account ID.
• For a search we record only roughly how long it was and how many results it found, never the words you type. Near me records only whether it worked and roughly how many beaches it found, never your location. An error records only its kind, never the message.
• The events go to Umami, open-source analytics software that runs on our own server; no analytics company receives them. Umami does not store your IP address. It uses it at the moment of the event to estimate your country, region and city, and stores that estimate.
• To turn analytics off, switch off Share usage analytics: under Privacy on the You tab on iPhone, iPad and Android (in Preferences in versions before 1.4.1), or under General in Settings on a Mac. It is on until you turn it off, and turning it off also discards events not yet sent.
• Our scheduled cleanup removes analytics events and sessions, including session properties, older than 26 months, and details attached to events older than 13 months. When you delete your account, we queue removal of Umami records linked to that account and retry it if the cleanup service is temporarily unavailable. This does not erase install-only history or records linked to other accounts on the same device. We retain a product-specific keyed hash of the deleted account ID with no automatic expiry, solely to reject later analytics from that account. This pseudonymous suppression record does not contain the raw account ID.

Visiting our website

• ebbward.com sets no cookies for visitors and has no advertising or social media trackers.
• We count visits to its pages with the same self-hosted Umami: the page address without its query, the site you came from (not the full address), your browser, device type, screen size and language, and an estimated country, region and city. To stop your visits being counted in a browser, open ebbward.com/privacy?nt=1 once in it.
• The conditions pages remember your units, theme, and saved and recent beaches in your browser’s storage. That stays in your browser.
• If you sign in on the website, for example to delete your account, your sign-in is kept in your browser’s storage until you sign out. Where the page offers Sign in with Google, the button is loaded from Google, so Google can see that you opened that page.

Server and security logs

• To stop abuse of sign-in, sign-up, search and similar actions, we keep short-lived counters keyed on your IP address (for IPv6, its first half) and, for sign-in and similar requests, the email address used. They are deleted about a day after their time window ends.
• Our proxy logs only requests that fail, never successful ones: the time, the address requested including its query (which can contain search words or Near me coordinates), the result, your IP address, your app or browser’s user agent and the referring page. These server logs are kept for up to about seven weeks.
• We keep a record of each email we send you (its kind and whether it was delivered), with your address stored only as a keyed one-way hash. These records are deleted when you delete your account.

What we don’t do

• No ads, and no advertising or marketing code in the apps or on the website.
• We do not sell or share your personal information, and we do not give it to data brokers.
• We do not track you across other companies’ apps or websites, and we do not use advertising identifiers such as Apple’s IDFA or Google’s advertising ID. That is why Ebbward never asks for permission to track you.
• We do not record which ad or link led you to install the app.
• We do not collect your contacts, photos, microphone, health or financial information. There is nothing to buy in Ebbward.
• We do not send your information to AI services or use it to train AI models.

Service providers

These companies run parts of Ebbward for us. They process information only to provide their service. If you use Ebbward from outside the US, your information is processed and stored in the US.

Umami runs on our own server, so no analytics company is involved.

How long we keep it

• Account details, synced preferences, the people you hide, alert rules and alert history: until you delete them or your account. The app shows the last 30 days of alerts.
• Sign-in sessions last 30 days and are deleted within an hour of expiring. Password reset links expire after an hour and email confirmation links after 7 days; both are deleted once expired.
• Visibility reports are shown until the end of the local day at that beach and deleted 30 days later. Flags are deleted with the report.
• Push tokens stay linked to your account while notifications are on (see Alerts and notifications).
• Feedback: as described under Feedback.
• Abuse-prevention counters: about a day after their window ends. Proxy error logs: up to about seven weeks.
• Crash reports: Sentry deletes them within 90 days. Scheduled cleanup removes analytics events, sessions and session properties older than 26 months, and event details older than 13 months. The minimal deletion-suppression hash has no automatic expiry and is used only to reject later analytics.
• Emails we sent you or our team, and emails you sent us, stay in those mailboxes.
• When you delete your account, we delete it from our live database right away. Nightly database backups are encrypted at rest, kept for up to 30 days and then deleted, so a deleted account is gone from every copy within 30 days. We keep a record that a deletion happened, under the account’s random ID, and the status of feedback you sent with its text removed, so we can account for requests.

Your choices and rights

• Delete your account: in the app, open the You tab, then your account, and choose Delete account (in versions before 1.4.1, Preferences, then Account; on a Mac, open Account and choose Delete account). If you have a password, you confirm with it; Apple and Google accounts have no password to enter. You can also delete it on the Delete account page, or by emailing us from the address on the account. Deletion removes your account, sessions, synced preferences, visibility reports, flags, the people you hid, alert rules and history, push tokens and the link to Apple or Google, and if you used Sign in with Apple we ask Apple to revoke Ebbward’s access. Deleting the app alone does not delete your account.
• Delete some of it: delete your reports and alert rules or remove saved beaches in the app, or email us to delete feedback or anything else without deleting your account.
• Get a copy: on a Mac, choose Export my data in Account to save your account data as a file. From any other device, email us from the address on your account and we will send you a copy.
• Correct it: email us to change your name or email address.
• Analytics: switch off Share usage analytics (see Usage analytics), and see Visiting our website for the site.
• Notifications: turn alerts off or delete them in the app, or turn off notifications for Ebbward in your device’s settings.
• Location: you can refuse or withdraw location permission in your device settings and still find beaches by search or on the map.

US state privacy rights, including California

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, to get a copy of it, to correct it and to have it deleted, and not to be treated differently for using these rights. We do not sell or share personal information, as the California Consumer Privacy Act defines those words, and have not done so in the past 12 months.

The personal information we collect is described above: identifiers (email address, name, account ID, install ID, push tokens, IP address), the content you post and send us, app activity (analytics and logs), and geolocation (Near me, used once and not stored, and the approximate location Umami estimates). It comes from you, your device, and Apple or Google when you use their sign-in, and it goes only to the service providers listed above. The only sensitive personal information we handle is your sign-in credentials and your Near me location. We use them only to sign you in and to answer that request, never to infer anything about you.

To make a request, email hello@endpaperlabs.com, from your account’s address if you have one. You can also ask someone to act for you. We will confirm the request came from you and respond within 45 days, as California law requires.

Children

Ebbward is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Anyone can check conditions without an account. If you believe a child under 13 has created an account or sent us information, email hello@endpaperlabs.com and we will delete it.

Security

• Every connection to our servers and the website uses HTTPS; plain HTTP is redirected.
• Passwords are hashed with bcrypt, and sign-in sessions and one-time links are stored only as SHA-256 hashes, so our database alone cannot be used to sign in as you. Apple tokens are encrypted (AES-256-GCM), and email records keep addresses only as keyed hashes.
• On your device, the apps keep your sign-in in the system’s secure storage (the Keychain on Apple devices, encrypted storage on Android).
• No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

Changes to this policy

When we change this policy we will update this page and its effective date. If a change significantly affects information you have already given us, we will also tell you in the app or by email before it takes effect.

Contact

Endpaper Labs LLC. For questions, requests or complaints about privacy, email hello@endpaperlabs.com. For help with the app, see Support.