Privacy Policy

Effective date: March 9, 2026  |  Last updated: October 23, 2026

Swellframe, Inc. ("Swellframe," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your data when you use the Swellframe website, customer portal, connected e-ink devices, and related services (collectively, the "Service").

1. Information We Collect

Account Information

When you create an account, we collect your first name, last name, username, email address, preferred time zone, and a hashed version of your password.

Billing & Shipping Information

If you purchase a device or subscribe to premium features, we collect billing and shipping addresses. Payment details (credit card numbers, etc.) are processed directly by Stripe and are never stored on our servers.

Device Information

When you register and use a Swellframe device, we collect the device identifier, configuration settings (spot selections, slide modes, rotation interval), check-in timestamps, firmware version, and operational telemetry (refresh results, errors, battery level, and signal strength).

The device identifier is derived from your device's Wi-Fi hardware (MAC) address. Because it is linked to your account, we treat it as personal data and it is covered by the retention and deletion terms in section 4.

Usage Data

We collect server logs including request timestamps, endpoints accessed, response status codes, and request latency. We also use limited third-party advertising and measurement tools on our website, described in the Cookies & Tracking section below.

Forecast Data

Location coordinates for your selected surf spots are used to retrieve forecast data from third-party providers. We cache forecast data temporarily to reduce API calls and improve performance.

2. How We Use Your Information

• Provide the Service: Deliver forecasts, render images, manage device configurations, and process orders.
• Account Management: Authenticate your identity, maintain your account, and provide customer support.
• Communications: Send transactional emails (order confirmations, account notifications). If you opted in, send product updates and release announcements.
• Improve the Service: Analyze usage patterns and device telemetry to fix issues and improve forecast quality.
• Legal Compliance: Comply with applicable laws and respond to legal requests.

3. Third-Party Services

We share information with the following third-party services as necessary to operate the Service:

• Stripe: Processes payments. Receives your billing information and email. See Stripe's Privacy Policy.
• Stormglass: Provides surf and weather forecast data. Receives geographic coordinates (latitude/longitude) for your selected spots. See Stormglass Privacy Policy.
• Resend: Delivers our email. Receives your email address and first name for account email we have to send you, such as verification, device pairing, order confirmations and device alerts, and for product updates if you opted into those.
• Microsoft Azure: Hosts our infrastructure. Your data is stored in Azure data centers in the United States.
• Cloudflare: Provides DNS, content delivery and security for our websites and API. Requests to us pass through Cloudflare, including your IP address. See Cloudflare's Privacy Policy.
• CookieYes: Manages cookie consent on our website and stores our record of your consent choices. See CookieYes Privacy Policy.

We do not sell your personal information to third parties.

Dawn Patrol (optional)

If you connect your Dawn Patrol account, your frame can show your surf sessions next to the forecast. Nothing is shared until you connect it from your Swellframe account, and you can disconnect at any time from the same place.

• What we receive: your Dawn Patrol display name and user ID, and for each session its date, start and end time, time zone, spot and the measurements Dawn Patrol records: waves, wave distances, speeds and times, paddling distance and strokes, and your rating. For a spot you created in Dawn Patrol, we also receive its name. We do not ask for heart rate or any other health data.
• What we keep: a short record of each session from the last 400 days (start and end time, number of waves, longest wave, top speed, longest ride, time in the water and paddling distance) to work out your totals, the details of your latest session, and the slides we draw from them. We use the GPS points of your waves only to work out the spot and the measurements, and we do not keep them.
• Why: only to show your sessions and totals on your frame and in your Swellframe account. We do not sell this data, use it for advertising or profiling, or use it to train AI models.
• Legal basis: your consent, given when you connect (GDPR Art. 6(1)(a)). Disconnecting withdraws it.
• Who processes it: our hosting and delivery providers, Microsoft Azure and Cloudflare, on our behalf. Dawn Patrol sees the requests we make for your data and when you disconnect.
• International transfer: Dawn Patrol is based in the Netherlands, and we store this data in the United States. The transfer takes place under the European Commission’s Standard Contractual Clauses (controller to controller) in our agreement with Dawn Patrol. You can ask us for a copy of these safeguards.
• How long we keep it: while you stay connected. When you disconnect or delete your Swellframe account we delete it straight away, and your frame replaces the slide the next time it connects. If Dawn Patrol ends our access, for example because you removed Swellframe in Dawn Patrol or deleted your Dawn Patrol account, we stop using the data as soon as we learn of it, at the latest within a week, and delete it within 14 days after that unless you reconnect. A session you delete in Dawn Patrol is removed from our copy within 7 days, usually within hours. This data is not part of our backups. Deleted files can be recovered by us for up to 14 days before they are gone for good.
• Your rights: the rights in section 6 apply to what we hold. For the data Dawn Patrol holds itself, Dawn Patrol’s own privacy policy applies, and you can contact Dawn Patrol directly.

Requests from public authorities. We may disclose your personal information where we are required to by valid legal process, such as a subpoena, court order or warrant. Before we disclose anything we verify that the request is genuine and that the authority making it has jurisdiction, and we disclose only the specific information the request compels rather than your account as a whole. Where we are permitted to tell you, we will do so before we respond, so that you have the chance to object.

4. Data Storage & Retention

Account data is retained for as long as your account is active. Device telemetry and check-in logs are retained for up to 30 days. Forecast cache data is retained for up to 12 hours. Data from a connected Dawn Patrol account is kept as described under Dawn Patrol in section 3. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

5. Data Security

We implement reasonable security measures to protect your data, including:

• Passwords are hashed using PBKDF2-SHA256 with 120,000 iterations and a unique salt.
• Session tokens are signed with HMAC-SHA256 and expire after 8 hours, or after 30 days if you chose "remember me" when signing in.
• Device credentials are stored as SHA-256 hashes.
• All data in transit is encrypted via HTTPS/TLS.

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights & Choices

• Access & Update: You can view and update your account information through the customer portal.
• Delete: You can delete your account and its data directly in the customer portal, or by contacting us. Deleting your account also erases the telemetry history of every device linked to it.
• Unsubscribe: You can opt out of marketing emails at any time using the unsubscribe link in those emails or by contacting us.
• Data Export: You may request a copy of your personal data by contacting us.
• Object & Restrict: You may object to, or ask us to restrict, processing we carry out on the basis of our legitimate interests.
• Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Complain: If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority.

We respond to rights requests within one month, as required by the GDPR. Contact us at [email protected].

7. Cookies & Tracking

The Swellframe website uses localStorage to maintain your session state (session token and account ID). This is essential to keep you signed in and is never used for advertising.

We use two third-party advertising and measurement tools to understand how our advertising performs and to measure sign-ups and other conversions: the Google Ads tag (Google LLC) and the Meta Pixel (Meta Platforms, Inc.).

We manage your consent for these tools through CookieYes (CookieYes Limited), a consent management platform. CookieYes stores your choices and records our proof of consent, and sets a small cookieyes-consent cookie to remember your preference.

• For visitors in the European Economic Area, the United Kingdom, and Switzerland, a consent banner is shown. Until you accept, the Google Ads tag runs in Google Consent Mode with consent denied (no cookies, nothing stored on your device) and the Meta Pixel does not load. If you accept advertising cookies, these tools load and may set their own cookies. You can change or withdraw your choice at any time using the cookie settings link on the page.
• For visitors elsewhere, both tools load normally and may set their own cookies.

You can also opt out at any time using your browser's privacy settings or an ad blocker, through your Google ad settings, or through your Meta ad preferences.

8. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it promptly. Some countries in the European Economic Area set this age lower, at 13, 14, or 15; where that applies, the local age governs.

9. Information for users in Europe (GDPR)

Controller

Swellframe, Inc. is the controller of the personal data described in this policy. You can reach us at [email protected].

EU Representative

[TO BE COMPLETED: name and EEA address of our Article 27 representative.]

Why we process your data (legal bases)

• Performance of a contract, Art. 6(1)(b): creating and maintaining your account, delivering forecasts to your device, fulfilling orders and subscriptions, and sending transactional email such as order confirmations and account or security notices.
• Legitimate interests, Art. 6(1)(f): device telemetry used to keep devices working, diagnose faults, and improve forecast quality; and security, fraud prevention, and rate limiting. Our interest is in operating and supporting a reliable product.
• Consent, Art. 6(1)(a): marketing email, advertising and measurement cookies, and the data we receive when you connect your Dawn Patrol account.
• Legal obligation, Art. 6(1)(c): meeting our legal and tax obligations.

International transfers

We are based in the United States, and our infrastructure provider stores your data in data centres in the United States. This means your personal data is transferred outside the European Economic Area.

[TO BE COMPLETED: the Chapter V transfer mechanism we rely on, either EU-US Data Privacy Framework certification of the receiving parties, or Standard Contractual Clauses. Include a note that a copy of the safeguards is available on request.]

Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. Surf condition ratings are informational only.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us:

• Email: [email protected]
• Website: swellframe.co

← Back to SWELLFRAME