Privacy Policy

The service is operated by an individual established in France.

Contact: hello@lineup-experience.com

Identification details are disclosed in the legally required Mentions légales.

Lineup collects only the data necessary for the operation of the service:

• Email address (account creation)
• Authentication data (BetterAuth + Supabase)
• Surfing profile: skill level, preferred wave types, board quiver (entered during onboarding)
• User-generated content: surf sessions, notes, and optional session photos (stored in Supabase)
• AI-generated content: personalized coaching objectives, session debriefs, and FAQ content produced by AI services
• Voice recordings (optional): when you use the voice-log feature, short audio clips are submitted to OpenAI’s transcription API to produce a text summary. Audio is not retained on our servers and is subject to OpenAI’s API data policy.
• Subscription and payment data: web billing is managed by LemonSqueezy (Merchant of Record) and iOS in-app purchases are handled by Apple via RevenueCat. We do not store credit card numbers or payment instrument details — only the subscription status, tier, and source.
• Push notification tokens (optional): if you enable notifications, an opaque device token is managed by OneSignal to deliver messages. The token cannot be used to identify you outside the service.
• Analytics: usage data via PostHog (pages viewed, interactions, device type, performance metrics). IP address is not collected and device ID is excluded from event properties.
• Technical logs (security, performance, error tracking)

Location data: when you grant geolocation access, your coordinates are truncated client-side to approximately one kilometer (~1 mile) precision before being sent to our servers, where they are used solely to surface nearby surf spots and local forecasts. We do not receive or store precise location on our servers. Full precision is used only client-side to center the in-app map.

• Contractual necessity: account creation, access to the service, subscription management via LemonSqueezy
• Legitimate interest: security, fraud prevention, analytics for registered users to improve service quality
• Consent: analytics for anonymous visitors, uploading pictures or optional personal data

Note: Page views are tracked for conversion analysis under legitimate interest. Registered users are tracked for service improvement purposes. Anonymous visitors can opt out of detailed behavioral tracking via the cookie banner.

Data is processed to:

• maintain user accounts
• operate platform features (session logs, personalized surf recommendations)
• generate personalized coaching objectives and session insights using AI
• process subscription payments
• improve service performance
• ensure platform security
• provide customer support

Data is retained only as long as necessary for service operation:

• Account data: until account deletion
• Photos and surf logs: until user deletes them or deletes their account
• AI-generated coaching data: retained alongside session data until the user deletes the associated content or their account
• Voice recordings: not retained. Audio is submitted to OpenAI’s transcription API in real time and discarded on our side once the text summary is returned.
• Location data: coarsened coordinates may be logged transiently alongside API requests for debugging but are not retained in long-term storage.
• Subscription data: retained as long as the subscription is active, plus any period required by applicable accounting and tax regulations
• Analytics: limited retention as configured in PostHog

Data may be shared with the following processors and sub-processors:

• Vercel (hosting, crash reporting, performance metrics)
• Supabase (database and authentication)
• PostHog (product analytics, configured without IP collection or cross-subdomain cookies)
• LemonSqueezy (web payment processing — Merchant of Record, handles web billing and subscriptions)
• RevenueCat (iOS subscription state management and App Store receipt validation)
• Apple Inc. (iOS in-app purchase payment processing, governed by Apple’s standard App Store terms)
• OneSignal (push notification delivery)
• Open-Meteo (surf and weather forecast data provider; weather data by Open-Meteo.com, CC BY 4.0)
• OpenAI (AI content generation for coaching and FAQ, plus voice-to-text transcription for the optional voice-log feature)
• Anthropic (Claude) (AI content generation for FAQ quality assurance)
• Perplexity (AI research for FAQ generation)
• SerpAPI (search data for FAQ verification)

AI sub-processors receive the minimum data required for their function. OpenAI additionally receives voice audio when you use the voice-log feature; audio is submitted in real time to produce a text summary and is retained by OpenAI only per its API data policy (no long-term storage on our side). Your email address and other direct personal identifiers are never transmitted to AI providers.

All providers are GDPR-compliant or offer adequate protection mechanisms.

Data is never sold.

Under the RGPD, users may request:

• access to their data
• correction of inaccurate data
• deletion of their account
• restriction or objection to processing
• portability of data

Requests: delete-account form or hello@lineup-experience.com

Lineup uses HTTPS, access controls, authentication protection, Row Level Security (RLS) on the database, and secured infrastructure via Vercel and Supabase. No method is fully error-free, but industry-standard safeguards are applied.

Some providers may process data outside the EU. Transfers rely on GDPR adequacy decisions or Standard Contractual Clauses (SCCs).

This policy may be updated to reflect service evolution. Significant changes will be communicated via the website.