WanderDive
Privacy Policy
Last updated: September 29, 2026
Your dive log belongs to you. We do not sell it, share it with advertisers, or use it for any purpose other than running WanderDive.
This policy explains what personal data WanderDive collects, why, how long we keep it, and your rights under the General Data Protection Regulation (GDPR) and Finnish data protection law.
1. Data Controller
Stefan Saxen, Finland — privacy@wanderdive.app
2. Data We Collect
| Category | Data | Source |
|---|---|---|
| Account | Email address, password (stored hashed by our authentication provider) | You, when registering |
| Dive log | Dive dates and times, site names, countries and map coordinates, depths, durations, conditions, gear, gas, ratings, trips, sightings, notes and buddy names you enter, and depth profiles from imported files | You, when logging or importing dives |
| Photos | Dive photos and certification card photos you upload (resized and re-encoded in your browser) | You |
| Certifications | Certification names, agencies and dates | You |
| Share link | The optional display name you choose and a count of how often your link was opened | You / automatically |
| Technical logs | IP address, browser type, requested pages, timestamps | Automatically, by our hosting and database providers |
We do not track your location in the background, track you across other websites, or use advertising or analytics cookies. If you add details about other people — for example buddy names or photos of them — please make sure they are happy for you to do so.
3. How We Use Your Data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account | Performance of a contract (Art. 6(1)(b)) |
| Storing, syncing and displaying your dive log | Performance of a contract (Art. 6(1)(b)) |
| Showing your public map when you create a share link | Performance of a contract (Art. 6(1)(b)) |
| Preventing fraud and abuse, keeping the service secure | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Data Sharing
We do not sell your personal data. We only use the following service providers, each for what WanderDive needs from them:
- Supabase Inc. — database, authentication and photo storage. Your account and dive data are stored in Supabase's EU region (Frankfurt, Germany).
- Vercel Inc. (United States) — website hosting and delivery; processes request logs including IP addresses.
- Cloudflare, Inc. (United States) — domain name (DNS) and forwarding of emails sent to our contact addresses. If you email us, your message and email address pass through Cloudflare to our mailbox.
- Esri — map tiles. Your browser loads map images directly from Esri's servers, which receive your IP address and the map area being viewed.
- OpenStreetMap Foundation (Nominatim) — place search. When you search for a location in the dive form, the search text is sent to Nominatim along with your IP address.
If you create a share link, anyone with the link can see the dive details listed on the share page (sites and their locations, dates, depths, times, conditions, sightings and trips). Buddy names, notes, photos, gear and your email are never shown there. You can turn the link off at any time.
If you send a buddy invite for a dive, anyone with that link can see that dive's site, location, date, time, depth, duration, conditions and sightings, plus your share-page display name if you set one — never buddy names, notes, photos or gear. A buddy who adds the dive gets their own copy in their log, which you can't change or delete; deleting your dive disables the link.
5. Data Retention
- Account, dive log and photos — kept while your account is active and deleted when your account is deleted.
- Technical logs — kept by our providers according to their own retention policies (typically up to 30 days).
6. Your Rights
Under the GDPR you have the right to:
- Access — request a copy of the data we hold about you.
- Rectification — correct inaccurate data (you can edit your dives in the app).
- Erasure — delete your account and all its data yourself in the app (Account → Delete account), or ask us to.
- Portability — take your data with you: export your whole log as UDDF or CSV from the Stats page.
- Restriction and objection — limit or object to processing based on legitimate interests.
To exercise any of these rights, email privacy@wanderdive.app. We respond within 30 days.
7. Cookies and Storage on Your Device
WanderDive uses no cookies for tracking. To work — including offline — it stores the following in your browser:
- Sign-in session (local storage) — keeps you logged in. Strictly necessary.
- Offline copies (IndexedDB and the browser cache) — your dive list, dives you have opened, photos you have viewed, map tiles you have seen, and dives waiting to sync. These stay on your device.
- App files (service worker cache) — so the app opens without a connection.
- Small preferences (local storage) — for example whether a one-time notice has been shown.
Signing out removes your offline dive copies and cached photos from the device. Clearing site data in your browser removes everything.
8. International Transfers
Your dive log is stored in the EU. Some providers above (for example our hosting and map providers) may process technical data such as IP addresses outside the EU/EEA. Where they do, they rely on safeguards recognised under GDPR Chapter V, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
9. Security
We use encrypted connections (HTTPS), row-level security in the database so each account can only access its own data, private photo storage, and hashed password storage. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach as the law requires.
10. Children
WanderDive is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
11. Changes to This Policy
We may update this policy. When we make material changes we will update the date at the top of this page and, where appropriate, tell you in the app.
12. Supervisory Authority
You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), PO Box 800, FI-00531 Helsinki, Finland — tietosuoja.fi.
13. Contact
Questions about privacy: privacy@wanderdive.app