PRIVACY POLICY

1. Introduction

Plain Sight Works ("we," "us," or "our") operates the Surfsmash mobile application and the Surfsmash website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using Surfsmash, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

2. Information We Collect

Information You Provide Directly

When you create an account or use Surfsmash, we may collect:

• Account information: email address, username, and team name
• Authentication data: encrypted password or one-time passcode used for sign-in
• Gameplay data: your event picks, season predictions, surfer card inventory, and league participation
• Support inquiries: name, email, and message content when you contact us through our support form

Information Collected Automatically

Surfsmash does not use third-party analytics SDKs, advertising trackers, or crash reporting services. We do not collect device identifiers, IP addresses, or location data through the app. Our hosting provider (Supabase) may collect basic server logs as part of normal infrastructure operations.

Information from Third Parties

We do not receive personal information about you from third-party sources. Surfsmash does not integrate with social login providers such as Sign in with Apple, Google, or Facebook.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Surfsmash fantasy surfing experience, including leagues, scoring, and leaderboards
• Send you in-app notifications, such as reminders to submit your picks before an event starts
• Respond to your support inquiries
• Maintain and improve the Service
• Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

We may share your information only in the following circumstances:

• Service providers: We use Supabase for database hosting and authentication, and Expo for delivering app updates. These providers process data on our behalf and are bound by their own privacy policies.
• Within your leagues: Other members of your league can see your username, team name, picks, predictions, and scores as part of normal gameplay.
• Legal requirements: We may disclose your information if required to do so by law or in response to valid legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Retention

We retain your account information for as long as your account is active. When you delete your account, your profile data is removed. Historical gameplay data (picks and scores) may be retained in anonymized form for the integrity of league standings and scoring records.

Support inquiries are retained for a reasonable period to allow us to follow up and improve our service.

6. Data Security

We implement appropriate technical measures to protect your personal information, including:

• All data transmitted between the app and our servers is encrypted via HTTPS
• Passwords are securely hashed and never stored in plain text
• Database access is controlled through Row Level Security (RLS) policies, ensuring users can only access their own data

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your account and associated personal data
• Opt out of in-app notifications through your device settings

To exercise any of these rights, please contact us through our support page or email us at support@plainsight.works.

California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information.

European Economic Area Residents (GDPR)

If you are located in the EEA, you have additional rights including the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is your consent (provided when you create an account) and our legitimate interest in operating the Service.

8. Children's Privacy

Surfsmash is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us through our support page.

9. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence, including in the United States, through our infrastructure providers (Supabase and Expo). By using the Service, you consent to the transfer of your information to these locations.

10. Third-Party Links and Services

Surfsmash may contain links to third-party websites and services, including the World Surf League (WSL) website, the Apple App Store, and Google Play Store. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies before providing them with your information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we may notify you through the app or by other means. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Company: Plain Sight Works
• Email: support@plainsight.works
• Support: www.smash.surf/support