Privacy Policy

1. Who we are

PaddleReady is operated by Brainstorm Innovative Technologies, LLC, a Florida limited liability company. For all privacy matters, contact privacy@paddleready.app.

For purposes of GDPR, CCPA, and equivalent privacy laws, Brainstorm Innovative Technologies, LLC is the data controller.

2. What we collect — and why

Location data (GPS)

When you open the app or check conditions, your GPS coordinates are used in real time to fetch weather, tides, advisories, sun times, and water quality. We do not log, store, cache, or retain the coordinates from those lookups. They travel from your device to the third-party data APIs (Open-Meteo, NOAA, USGS) over encrypted connections and are not written to our database.

Nearby launch points work differently. That lookup is served either directly by OpenStreetMap's Overpass API or by our own launch-points API, which caches Overpass results so we are not repeatedly hitting their public servers. On a cache miss, our server stores your coordinates rounded to two decimal degrees — roughly a 0.7-mile (1.1 km) grid cell, not your precise location — together with the search radius, for up to 24 hours. That rounded, shared cache entry is what is written to our database; your exact coordinates are not.

Location you deliberately submit is different, and it is stored. If you add a launch point, report a hazard, or create a Trip Check-In, the coordinates you attach to that submission are saved to our database — that is the whole point of the feature, since other paddlers need to find the launch or avoid the hazard. Launch points and hazard reports are public to other users; Trip Check-In locations are private to you and the trip contact you name. Do not submit a location you do not want recorded.

Anonymous device identifier

To enforce spam-prevention rate limits on community submissions, the app generates a random UUID-style identifier stored locally in AsyncStorage on your device. It contains no PII, cannot be reversed to identify you, and is not linked to your Apple ID, Google account, name, or email.

User-submitted content

Posting a comment, review, launch point, or amenity vote requires an account. When you submit one, we store the text, the username on that account (it is shown publicly as the author — you cannot post under a different name), an optional 1–5 star rating, any amenity tags, your device identifier, your account ID, and a timestamp. Because the device identifier is stored on the same record as your account, treat it as linked to you rather than anonymous. Do not include personally identifying information in your submissions — and choose a username you are comfortable showing publicly.

User-submitted photographs

All uploaded photos are re-processed using PHP's GD image library before storage. This process creates a brand-new image file from the pixel data only — all EXIF metadata (GPS coordinates, device model, timestamps) is permanently discarded. Images larger than 1,600 px on the longest edge are downscaled. MIME type is validated against the actual binary content via finfo, not the file extension.

Registered account data (optional)

If you create an account, we store your username, email address, and a bcrypt-hashed password. We never store plaintext passwords. Account data is used for authentication and Pro subscription status only.

Hazard reports

Submitted by signed-in users only: hazard type, title, description, severity, GPS coordinates of the hazard, the submitter's account ID, and the timestamp. Hazards are publicly visible on the map. Reports are clearly labeled as user-submitted and unverified.

Trip Check-In (Pro)

If you use Trip Check-In, we store: planned launch + return times, location, vessel notes, paddler count, trip notes, and your trip contact's name, phone, and email. Trip Check-Ins are retained until you delete them or delete your account — deleting your account permanently removes every Trip Check-In associated with it. You confirm at trip creation that your trip contact has agreed to be listed. Your trip contact receives exactly one automated message from us, and only if you do not check in: a single overdue alert about your trip. We never send them marketing, promotional, or newsletter email of any kind. It is a transactional message you initiated, so it carries no unsubscribe link; if a contact does not want future PaddleReady trip alerts, they can email support@paddleready.app and we will suppress that address permanently.

Advertising data (free version only)

The free version of the app displays banner ads served by Google AdMob. Every ad request is configured as non-personalized — ads are matched to general context, not to a behavioral profile of you. To serve and measure ads, Google may process your device's advertising identifier, IP address, and coarse device information under Google's privacy policy. We never receive, store, or combine that data with anything else described in this Policy, and your GPS data is never available to the ad SDK. PaddleReady Pro removes all ads — no ad-network requests are made for Pro subscribers. You can reset or limit your device's advertising identifier in iOS Settings → Privacy & Security, or Android Settings → Google → Ads.

What we do NOT collect

• No GPS history or location logs — we never build a trail of where you have been. The coordinates behind your weather, tide, advisory, sun, and water-quality lookups are never written down. The one exception is nearby-launch-point lookups, where a coarse, rounded coordinate (not your precise location) may be cached briefly on our server — see "Location data (GPS)" above. This bullet is about tracking, not about the launch points, hazard reports, and Trip Check-Ins you deliberately submit: those coordinates are stored in full, as described above
• No advertising identifiers collected by us (in the free version, Google's ad SDK may access the device ad identifier to serve non-personalized ads — see "Advertising data" above)
• No tracking cookies, pixels, or web beacons
• No camera roll, contacts, microphone, or biometric data
• No browsing history outside the app
• No payment card numbers (Pro is billed by the Apple App Store or Google Play — we never receive payment details)

3. How we share data

We do not sell, rent, trade, or commercially exploit your information. Limited sharing only:

• Third-party data APIs. Your GPS coordinates travel directly from your device to: Open-Meteo, NOAA, USGS, Sunrise-Sunset.org, OpenStreetMap Nominatim, Overpass API, and Apple Maps / Google Maps for tile rendering.
• Advertising (free version only). Google AdMob serves non-personalized banner ads in the free app and may process the device advertising identifier and coarse device information to do so. Pro subscribers are excluded entirely.
• Legal process. Court orders, subpoenas, warrants with proper jurisdiction. We will challenge overly broad requests.
• CSAM. Any image we reasonably believe constitutes child sexual abuse material is immediately removed, reported to the NCMEC CyberTipline as required by 18 U.S.C. § 2258A, and preserved for law enforcement.
• Corporate transactions. In a merger or acquisition, user data may transfer. The successor entity must honor this Policy.

4. Security

All data in transit between the app and our servers is encrypted with TLS 1.2 or higher. Backend infrastructure is hosted on DreamHost. Inputs are validated and SQL uses parameterized queries. Rate limiting is enforced on submission endpoints. File uploads pass MIME validation and are re-processed through the GD library, which destroys embedded payloads.

To be precise about what that does not cover: we do not currently apply field-level encryption to stored content. Free-text you submit — trip titles, descriptions, notes, hazard reports, comments — is held in an access-controlled database but is not encrypted field-by-field at rest. Please do not enter anything in those fields you would not want stored in plain text.

NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS 100% SECURE. WE CANNOT GUARANTEE ABSOLUTE SECURITY. YOU TRANSMIT DATA TO US AT YOUR OWN RISK.

Security vulnerability reports: security@paddleready.app.

5. Your rights

Regardless of where you live:

• Request a copy of data tied to your anonymous device ID
• Request deletion of your submitted content
• Stop submitting at any time — no opt-out form needed

California residents (CCPA / CPRA): the right to know, delete, correct, opt out of sale (we don't sell), and non-discrimination for exercising these rights. Email privacy@paddleready.app with subject "CCPA Request."

EEA / UK / Swiss residents (GDPR): rights of access, rectification, erasure, restriction, data portability, and to object. Lawful bases: legitimate interest (spam prevention, community safety, app functionality), implied consent (voluntary submission), and explicit consent (location permission). Subject: "GDPR Request."

6. Account deletion

Delete your account at any time:

• In the app: About tab → Account Settings → Delete my account.
• Without the app: use the form at paddleready.app/delete-account.

We process deletion within 30 days. Anonymous device-ID submissions can also be deleted on request to privacy@paddleready.app.

7. Children

PaddleReady is intended for users 13+. We do not knowingly collect personal information from children under 13. If you believe your child under 13 has submitted data, email privacy@paddleready.app and we will investigate and delete promptly. In jurisdictions with a higher digital-consent age (e.g., 16 in some EU member states), the higher threshold applies.

8. Changes

We may update this Policy. Material changes will be communicated in-app and via a notice on the website. Continued use after a revised Policy constitutes acceptance.

9. Contact

Privacy: privacy@paddleready.app
Security: security@paddleready.app
Legal / DMCA: legal@paddleready.app
Support: support@paddleready.app
Abuse / CSAM: violations@paddleready.app

Brainstorm Innovative Technologies, LLC
brainstorminnovative.com