Privacy Policy
Effective date: March 9, 2026 | Last updated: August 6, 2026
Swellframe LLC ("Swellframe," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your data when you use the Swellframe website, customer portal, connected e-ink devices, and related services (collectively, the "Service").
1. Information We Collect
Account Information
When you create an account, we collect your first name, last name, username, email address, preferred time zone, and a hashed version of your password.
Billing & Shipping Information
If you purchase a device or subscribe to premium features, we collect billing and shipping addresses. Payment details (credit card numbers, etc.) are processed directly by Stripe and are never stored on our servers.
Device Information
When you register and use a Swellframe device, we collect the device identifier, configuration settings (spot selections, slide modes, rotation interval), check-in timestamps, firmware version, and operational telemetry (refresh results, errors, battery level, and signal strength).
The device identifier is derived from your device's Wi-Fi hardware (MAC) address. Because it is linked to your account, we treat it as personal data and it is covered by the retention and deletion terms in section 4.
Usage Data
We collect server logs including request timestamps, endpoints accessed, response status codes, and request latency. We also use limited third-party advertising and measurement tools on our website, described in the Cookies & Tracking section below.
Forecast Data
Location coordinates for your selected surf spots are used to retrieve forecast data from third-party providers. We cache forecast data temporarily to reduce API calls and improve performance.
2. How We Use Your Information
- Provide the Service: Deliver forecasts, render images, manage device configurations, and process orders.
- Account Management: Authenticate your identity, maintain your account, and provide customer support.
- Communications: Send transactional emails (order confirmations, account notifications). If you opted in, send product updates and release announcements.
- Improve the Service: Analyze usage patterns and device telemetry to fix issues and improve forecast quality.
- Legal Compliance: Comply with applicable laws and respond to legal requests.
3. Third-Party Services
We share information with the following third-party services as necessary to operate the Service:
- Stripe: Processes payments. Receives your billing information and email. See Stripe's Privacy Policy.
- Stormglass: Provides surf and weather forecast data. Receives geographic coordinates (latitude/longitude) for your selected spots. See Stormglass Privacy Policy.
- Resend (if opted in): Manages email communications. Receives your email address and first name if you opted into product updates.
- Microsoft Azure: Hosts our infrastructure. Your data is stored in Azure data centers in the United States.
- CookieYes: Manages cookie consent on our website and stores our record of your consent choices. See CookieYes Privacy Policy.
We do not sell your personal information to third parties.
4. Data Storage & Retention
Account data is retained for as long as your account is active. Device telemetry and check-in logs are retained for up to 30 days. Forecast cache data is retained for up to 12 hours. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.
5. Data Security
We implement reasonable security measures to protect your data, including:
- Passwords are hashed using PBKDF2-SHA256 with 120,000 iterations and a unique salt.
- Session tokens are signed with HMAC-SHA256 and expire after 8 hours, or after 30 days if you chose "remember me" when signing in.
- Device credentials are stored as SHA-256 hashes.
- All data in transit is encrypted via HTTPS/TLS.
No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
6. Your Rights & Choices
- Access & Update: You can view and update your account information through the customer portal.
- Delete: You can delete your account and its data directly in the customer portal, or by contacting us. Deleting your account also erases the telemetry history of every device linked to it.
- Unsubscribe: You can opt out of marketing emails at any time using the unsubscribe link in those emails or by contacting us.
- Data Export: You may request a copy of your personal data by contacting us.
- Object & Restrict: You may object to, or ask us to restrict, processing we carry out on the basis of our legitimate interests.
- Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. This does not affect processing carried out before you withdrew it.
- Complain: If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority.
We respond to rights requests within one month, as required by the GDPR. Contact us at [email protected].
7. Cookies & Tracking
The Swellframe website uses localStorage to maintain your session state (session token and account ID). This is essential to keep you signed in and is never used for advertising.
We use two third-party advertising and measurement tools to understand how our advertising performs and to measure sign-ups and other conversions: the Google Ads tag (Google LLC) and the Meta Pixel (Meta Platforms, Inc.).
We manage your consent for these tools through CookieYes (CookieYes Limited), a consent management platform. CookieYes stores your choices and records our proof of consent, and sets a small cookieyes-consent cookie to remember your preference.
- For visitors in the European Economic Area, the United Kingdom, and Switzerland, a consent banner is shown. Until you accept, the Google Ads tag runs in Google Consent Mode with consent denied (no cookies, nothing stored on your device) and the Meta Pixel does not load. If you accept advertising cookies, these tools load and may set their own cookies. You can change or withdraw your choice at any time using the cookie settings link on the page.
- For visitors elsewhere, both tools load normally and may set their own cookies.
You can also opt out at any time using your browser's privacy settings or an ad blocker, through your Google ad settings, or through your Meta ad preferences.
8. Children's Privacy
The Service is not intended for children under 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it promptly. Some countries in the European Economic Area set this age lower, at 13, 14, or 15; where that applies, the local age governs.
9. Information for users in Europe (GDPR)
Controller
Swellframe LLC is the controller of the personal data described in this policy. You can reach us at [email protected].
EU Representative
[TO BE COMPLETED: name and EEA address of our Article 27 representative.]
Why we process your data (legal bases)
- Performance of a contract, Art. 6(1)(b): creating and maintaining your account, delivering forecasts to your device, fulfilling orders and subscriptions, and sending transactional email such as order confirmations and account or security notices.
- Legitimate interests, Art. 6(1)(f): device telemetry used to keep devices working, diagnose faults, and improve forecast quality; and security, fraud prevention, and rate limiting. Our interest is in operating and supporting a reliable product.
- Consent, Art. 6(1)(a): marketing email, and advertising and measurement cookies.
- Legal obligation, Art. 6(1)(c): meeting our legal and tax obligations.
International transfers
We are based in the United States, and our infrastructure provider stores your data in data centres in the United States. This means your personal data is transferred outside the European Economic Area.
[TO BE COMPLETED: the Chapter V transfer mechanism we rely on, either EU-US Data Privacy Framework certification of the receiving parties, or Standard Contractual Clauses. Include a note that a copy of the safeguards is available on request.]
Automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. Surf condition ratings are informational only.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or your data, please contact us:
- Email: [email protected]
- Website: swellframe.co