Safety & privacy

Alfie's Almanac is a personal, non-commercial surf guide. Privacy questions and requests can be sent through the existing contact form, so Alfie's private email, address and phone do not need to be published.

Accounts: Google handles sign-in. Supabase stores the account profile and favourite spots, and authentication cookies keep signed-in visitors connected to their account.

Optional notifications: If you turn on spot notifications, Supabase stores your selected maps, alert types and quiet hours, plus an encrypted browser push endpoint and device keys. A login-session identifier links the device to your signed-in session. These are used only to send the alerts you selected. The browser’s push service (such as Apple, Google, Mozilla or Microsoft, depending on your device) processes delivery and may handle delivery data under its own terms. Notifications are off until you enable them; you can pause the account setting or remove a device in Account settings. Successful sign-out stops future delivery eligibility; encrypted device records are removed when notification maintenance next succeeds. Account deletion removes its notification records. A message already in flight may still arrive.

Messages: Web3Forms and hCaptcha process the email address, optional name, message and anti-spam information submitted through the contact form. This is used to receive, assess and reply to the message—not for a mailing list or targeted advertising.

Analytics and device storage: Vercel Analytics and optional first-party performance measurements help understand page use and technical performance. The app also stores condition caches, selected map state and guide progress on the visitor's device. This information is not sold or used to build advertising profiles.

Retention and overseas handling: Account and favourite data are kept while the account remains in use. Messages are kept only as reasonably needed to reply, resolve the issue and meet security or legal needs. Google, Supabase, Vercel, Web3Forms and hCaptcha may process information outside Australia and apply their own security, backup and retention practices.

Use the contact form to request access, correction or deletion, or to complain about how information has been handled. Account deletion may require Alfie to remove the account manually; associated favourites are deleted with it.