Privacy Policy

Information we collect

• Account information: your name, email address, email-verification status, account status, and optional marketing preference.
• Booking information: participant names, email addresses, phone numbers, height, weight, shoe sizing, age group, session details, booking status, and waiver acceptance. We use sizing information to prepare suitable surf equipment.
• Agreement information: the accepted waiver version and text hash, acceptance time, participant identity, signer identity, parent or legal-guardian relationship when applicable, and the separate optional photo and video permission choice.
• Donation information: donation amount, currency, status, donor email when provided, and Stripe transaction identifiers. High 5 Surf does not receive or store your full card number.
• Communications and support: messages you send us, your account email, an optional callback number, and delivery status for transactional emails.
• Security and technical information: IP address, browser or device information, timestamps, and request or diagnostic records that our hosting, security, and application services generate to operate and protect the site.

How we use information

• Provide accounts, free lessons, bookings, and customer support.
• Prepare appropriate equipment, coordinate group sessions, and record waiver acceptance.
• Process optional donations and maintain accounting records.
• Send verification, booking, waiver, support, security, and other transactional messages.
• Prevent abuse, investigate problems, protect the service, and meet legal obligations.

Marketing choices

Creating an account does not subscribe you to marketing. Marketing email is optional and requires a separate choice. You can change that choice in your account settings or use the unsubscribe link in a marketing message. We may still send non-marketing messages needed to operate your account or fulfill a booking.

When we share information

We use service providers only as needed to run High 5 Surf. These include Hetzner and Coolify for hosting, self-hosted Convex for application data and authentication, Cloudflare for network security and lesson video delivery, Stripe for donations, Resend for email, and Stormglass for surf forecasting. These providers process information under their own terms and privacy commitments.

We may also disclose information when required by law, to protect people or the service, or as part of a business transaction where appropriate safeguards apply. We do not sell personal information or use it for targeted advertising.

How long we keep information

We keep information only for as long as reasonably needed for the purposes described here. Account information is generally kept while the account is active; disabled account profiles are deleted or anonymized after two years. Booking contact and equipment information is removed 90 days after the session, while a non-identifying booking summary is kept for two years. Email delivery and Stripe webhook details are kept for 90 days, resolved support and security records for two years, and donation records for seven years. Waiver evidence is kept until our insurer or legal counsel approves a finite period. A documented legal hold may temporarily override these periods.

Your choices and requests

Depending on where you live, you may have rights to request access, correction, deletion, or a copy of your personal information, or to object to certain uses. We may need to verify your identity before completing a request. You can also update your name and marketing preference in account settings.

To make a privacy request, email [email protected].

Security

We use access controls, encrypted connections, restricted administrative access, and service monitoring designed to protect information. No online system can guarantee absolute security. Please keep private booking and waiver links confidential and contact us if you believe your account or link has been compromised.

Children and group bookings

Online booking is currently limited to participants age 13 or older. A parent or legal guardian must complete the required agreement for a participant age 13–17. Contact us before providing information online for a child under 13. Please also contact us if you believe a child submitted personal information without appropriate permission.

Cookies and local storage

We use browser storage needed for sign-in and security. We do not currently run Google Analytics or set advertising cookies. Read the Cookie Policy for details.

Changes and contact

We may update this policy as the service changes. We will post the updated policy here and change the effective date. Questions about this policy can be sent to [email protected].