Privacy Policy

1. Overview

DivEscape collects the minimum data needed to run the site: your email and password to sign you in, your saved destinations and profile preferences to remember what you like, and basic technical logs to keep the service secure. We don't sell data, we don't share it with advertisers, and we only send you emails when something account-related needs your attention.

2. Data controller

The controller of your personal data is:

3. Data we collect

Account data

Email address (required for sign-in), password hash (managed by Supabase — we never see your plaintext password), the timestamp of when you created your account, and whether your account is a diver or dive-operator account.

Profile data

Optional display name, notification preferences, and the soft-delete timestamp if you ever delete your account (kept for 30 days so you can recover by signing back in).

Activity data

Which destinations you save as favorites — stored on our servers, tied to your account. Your display preferences (theme, temperature unit, depth unit, plankton hue and density) are stored in your browser so they persist between visits; if you are signed in, they are also saved to your account profile so they follow you across devices.

Technical data

IP address, browser user agent, and request timestamps. These are collected automatically by Vercel for security and abuse prevention. Vercel Web Analytics and Speed Insights also receive these signals to compute aggregate metrics, but anonymize them immediately — no IP address or identifier is retained (see “Privacy-friendly analytics” below).

Operator listing data

If you hold an operator account and create a business listing, we collect the information you submit: business name, business type, associated destination, website URL, description, and a hero photo. Once you publish your listing, this information is displayed publicly on the relevant destination page. When we need to reach you about your listing, we use your account email address. Uploaded photos are stored in Supabase Storage — the same Supabase platform already used for the database and authentication.

Operator billing data

If you purchase an operator subscription (currently the Pinnacle tier), we store a Stripe customer ID, subscription ID, subscription status, and the current-period-end date on your operator profile. We never see or store your card number, expiry, or CVV — those are entered on Stripe's hosted checkout page and held solely by Stripe.

Tier interest capture

If you submit your email via a “Notify me when available” form on a coming-soon tier, we store your email address and which tier you asked about. This data is used only to notify you when that tier launches. You can ask us to remove your entry at any time by emailing legal@divescape.app.

Feedback data

If you send feedback via the in-app feedback form, we store your message, the category you chose, an optional star rating, the page you were on, and your browser's user agent. If you provide your email we store it so we can reply, and if you're signed in the feedback is linked to your account. This is used only to triage and respond to your feedback; it is stored in Supabase and emailed to our team via Resend so we see new feedback promptly.

Email logs

Delivery and open status for the transactional emails we send (sign-up confirmation, password reset, email change). Retained for approximately 30 days by Resend.

4. Legal basis

Under GDPR Art. 6 and Swiss revFADP Art. 31, we rely on:

• Contract performance(Art. 6(1)(b) GDPR) — for the account itself, authentication, transactional emails, and billing data processed to fulfil a paid operator subscription.
• Legitimate interest(Art. 6(1)(f) GDPR) — for technical logs, security monitoring, and handling feedback you send us.
• Consent(Art. 6(1)(a) GDPR) — for tier interest capture (submitting the “Notify me” form constitutes consent; you may withdraw by emailing legal@divescape.app).

5. Third-party processors

We share your data with the following processors, each acting on our documented instructions:

• Supabase(Auth + Postgres database + Storage, EU region) — stores your account, profile, favorites, and operator listing photos.
• Resend(transactional email delivery, EU region) — sends your auth emails and notifies our team of new feedback you submit.
• Vercel(hosting + technical logs + privacy-friendly analytics, US headquartered, multi-region edge) — serves the site, stores access logs, and provides cookieless web analytics and performance metrics (Core Web Vitals).
• Hostpoint(DNS and domain registrar, Switzerland) — operates the divescape.app DNS records.
• Cloudflare(Turnstile bot protection, US headquartered, global network) — when you sign up, sign in, or request a password reset, Turnstile evaluates technical browser signals (including your IP address) to distinguish humans from bots. No account data is shared with Cloudflare.
• Stripe(payment processing, US) — processes operator subscription payments. We share your email and the subscription amount; Stripe stores all card data. We receive and store only the Stripe customer ID, subscription ID, status, and current-period-end.
• Unsplash(image CDN, US) — serves destination photos.

We do not sell your data and do not share it with advertisers.

6. Legal disclosure

We may disclose your personal data if required by Swiss or other applicable law, by court order, or in response to a valid government request. When we do, we disclose only the minimum data the request legally compels us to share, and we notify you of the request unless we are legally prohibited from doing so.

7. International transfers

Vercel, Stripe, Unsplash, and Cloudflare may transfer data to the US. Where required, we rely on the Swiss adequacy framework and EU Standard Contractual Clauses (SCCs) put in place by these processors. The Swiss Federal Council recognizes the EU as having adequate data protection.

8. Cookies & local storage

Strictly necessary cookies

Supabase auth session cookies — these keep you signed in. They are essential for the site to work and do not require consent under the EU ePrivacy Directive.

Local storage

Your in-browser preferences (theme, units, plankton settings), the destinations in your compare list, and the in-flight pending-email-change marker. These are stored only in your browser and never read by our servers.

Privacy-friendly analytics

We use Vercel Web Analytics and Speed Insights to understand aggregate traffic (page views, referrers) and real-world performance (Core Web Vitals). These are cookieless: they set nothing on your device, use no persistent or cross-site identifier, and collect no personal data. Because no information is stored on or read from your device, this does not require consent under the EU ePrivacy Directive. We use no advertising trackers and no fingerprinting.

9. Data retention

• Account and profile data— kept until you delete your account. After deletion, a 30-day soft-delete window applies (sign back in within that window to recover your account). After 30 days, your auth.users record, profile, and saved favorites are permanently deleted.
• Technical logs— retained per processor defaults: Vercel approximately 30 days, Supabase approximately 7 days.
• Email delivery records— retained approximately 30 days by Resend.
• Operator billing data(Stripe customer ID, subscription ID, status, period-end) — retained for the life of the operator account and deleted when the account is permanently purged.
• Operator listing & photos— if you run an operator listing, deleting your account hides the listing from the site immediately, erases your uploaded listing photos at that point, and permanently removes the listing when the account is purged after 30 days.
• Tier interest emails— retained until the tier launches and the notification is sent, or until you request removal.
• Feedback submissions— retained until resolved and no longer needed for follow-up.

10. Your rights

Under GDPR Art. 12–22 and Swiss revFADP Art. 25–32, you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data (delete your account).
• Receive your data in a portable format.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interest.
• Withdraw consent(where consent is the basis — currently applies to tier interest capture; email legal@divescape.app to withdraw).

Most of these you can exercise directly via your account settings at /account: edit your display name and email, change your password, delete your account, or export your data as JSON. For anything else, email legal@divescape.app.

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local EU supervisory authority.

11. Children

DivEscape is not directed at users under 16. Do not create an account if you are under 16. We will delete accounts we discover to belong to minors.

12. Changes to this policy

Material changes will be notified via email at least 14 days before they take effect. The “Effective date” at the top of this page reflects the most recent revision.

13. Contact

Email legal@divescape.app for any privacy-related question or to exercise your rights.