Privacy Policy
This Policy explains how Beachy handles personal data and the choices available to you.
1. Controller and contact
HelpFullStack, a Dutch sole proprietorship (eenmanszaak), is the data controller for Beachy. KVK: 75776022. Address: Lumeijstraat 37-2, 1056 VV Amsterdam, the Netherlands. Privacy contact: contact@getbeachy.app.
2. Data we process
- Account data such as email, authentication provider, identifiers, and sessions.
- Profile data such as display name and profile photo.
- Reviews, ratings, saved beaches, lists, reports, blocks, and timestamps.
- Push token, device platform, permission status, and notification preferences.
- Technical, security, device, log, crash, IP-address, and abuse information received by us or our providers.
- Location when you grant access. It is used to show nearby beaches; Beachy does not build a location-history profile.
- Usage and performance data: which screens and features you use, such as beaches viewed, searches run, filters applied, and beaches saved, together with app version, device model, startup timings, and error reports. This includes the words you type into beach search, which we use to find beaches people look for but cannot find. It never includes your name, email address, or precise location. Please do not type personal information into the search field.
3. Purposes and legal bases
We use data to provide accounts and app features, synchronize content, publish reviews, handle support and moderation, send notifications you enable, secure and troubleshoot Beachy, comply with law, and establish or defend claims. The legal bases are our agreement with you, legitimate interests in operating and securing Beachy, consent for optional permissions and communications, and legal obligations.
We also use usage and performance data to understand how Beachy is used, to decide what to build next, and to find and fix crashes and slow screens. The legal basis is our legitimate interest in improving and maintaining Beachy. This is collected for people with and without an account. You can switch it off at any time under Settings › Privacy › Share usage data; switching it off stops any further collection.
4. Providers and international transfers
Providers include Supabase for database, authentication, storage, and server functions; Expo/EAS and Apple for app delivery and push notifications; Mapbox for maps; Google Maps for nearby places on iOS; Apple or Google when you choose their sign-in services; and PostHog for usage analytics and error reporting. Our Supabase project is hosted in the EU, and our PostHog project is hosted in the EU. Some providers may process data outside the EEA using adequacy decisions, standard contractual clauses, or another lawful safeguard.
Beach photos are loaded directly from the third-party servers that host them. As with any image on the web, those servers receive your device's IP address and basic request information, such as the app and iOS version, and handle it under their own terms. We do not send them your account details or any other data.
On iOS, the Nearby section of a beach page shows food and drink places from Google Maps, through Google's Places SDK. When it loads, your device contacts Google directly and sends the beach's location. Google also receives your device's IP address, and its SDK collects a device identifier, usage and performance data, and, if you have allowed Beachy to use your location, may collect your device's location. Google handles this data under its own privacy policy (policies.google.com/privacy). Beachy does not store these results, and we do not send Google your account details.
5. Public information and sharing
Reviews and their display name and profile image may be visible to others. Reports and blocks are private. We do not sell personal data. Limited data may be disclosed to providers, authorities where legally required, professional advisers, or a successor in a business transfer.
6. Retention and deletion
Account data and content are generally retained while your account exists. Account deletion removes the live profile, reviews, saved beaches, lists, devices, and notifications. Temporary backups may take up to 30 days to expire. Moderation and security records may be retained for up to 24 months, or longer for an active dispute or legal obligation. Technical logs are normally kept no longer than 90 days unless needed for an incident. Usage and performance data is retained for up to 12 months.
7. Your rights
You may request access, correction, deletion, restriction, objection, or portability and may withdraw consent by emailing contact@getbeachy.app. You can complain to the Dutch Autoriteit Persoonsgegevens or your local authority.
8. Children, security, and changes
Beachy is a general-audience service and is not designed specifically for children. Where local law requires permission from a parent or guardian for an account-based service, that permission is required. Contact us if you believe a child provided personal data without legally required permission. We use reasonable safeguards, but no service is completely secure. Material Policy changes will be communicated in the app or by another appropriate method.