Your sessions stay private.

What Surco stores

When you continue without creating an account

Surco creates an anonymous technical identity through Supabase. It is used to save your Spots and provide personalized forecasts and widgets. Saved Spot data can include the name, coordinates, surf preferences, and display order you choose.

Diary entries and their photos are stored on your iPhone by default. They are not backed up to Surco's servers unless you create or sign in to an account and enable Sync & Backup.

When you create or sign in to an account

We store your email address, account identifier, optional name and username, Saved Spots, and authentication-provider information needed to operate your account. If Sync & Backup is enabled, we also store private copies of your Diary entries, ratings, intentions, forecast snapshots, and attached photos.

Device permissions

Location access is optional and is used to show your position while searching for Spots. Photo-library access is optional and is used only when you choose photos for a Diary entry. Surco does not access either source without the relevant iOS permission.

Diagnostics and analytics

Surco uses limited product analytics to understand app usage and diagnose problems. This can include app and device information, interaction events, and an account identifier for signed-in users. Diary writing and Diary photos are not sent to analytics.

How the data is used

• Provide Saved Spot forecasts, search, and widgets.
• Provide optional private Diary sync and restore.
• Authenticate accounts and preserve account security.
• Maintain reliability, prevent abuse, and fix errors.
• Answer support requests you send to us.

Surco does not sell personal data and does not use Diary content or photos for advertising.

Service providers

Surco relies on service providers to operate the app: Supabase for authentication, databases, and private file storage; Open-Meteo for forecast data; Apple and Google when you choose their sign-in services; Expo for app delivery and optional push infrastructure; and PostHog for limited product analytics. These providers process data under their own security and privacy terms.

Retention and deletion

Local Diary data remains on your iPhone until you delete entries or remove the app. Deleting an entry provides a short Undo period, then permanently removes it and propagates that deletion to Sync & Backup when enabled.

Signed-in users can delete their account in Surco under Settings → Account → Delete account. This deletes the account, Saved Spots, private Diary backup, backed-up photos, and other account-linked data from active systems. The local Diary stays on that iPhone and returns to local-only mode. Limited copies may remain temporarily in provider backups until their normal backup rotation completes.

Your choices

You can use Surco without a named account, deny optional iOS permissions, disable Sync & Backup by signing out, delete individual Diary entries, or permanently delete your account in the app. You can also contact us to ask about your personal data.

Security, children, and international processing

We use access controls, encrypted connections, and private storage to protect server data. No system is completely secure, so keep your device and sign-in credentials protected. Surco is not directed to children under 13. Our providers may process data in countries other than your own under applicable safeguards.

Changes and contact

We may update this policy as Surco changes. Material changes will be reflected here with a new date. Questions or privacy requests can be sent to hello@surco.app.