Privacy Policy

Last updated 3 July 2026.

This policy describes, in plain terms, what data Fin actually collects and how it is used. It has not yet been reviewed by a lawyer, and it does not name a registered legal entity, address, or governing jurisdiction, all of which still need to be added before this is a complete legal document. Treat it as an accurate description of current practice, not a finished contract.

Fin (“Fin”, “we”, “us”) operates divewithfin.com, a directory of dive and snorkel sites with optional accounts for logging dives, tracking species seen, and leaving reviews. This policy covers what we collect from visitors and account holders, why, and who we share it with.

Data we collect

Account information

If you create an account, we collect your email address and a password (stored hashed by our authentication provider, never in plain text), or, if you sign in with Google, your name, email address, and profile photo as provided by Google. We store a display name and, if you upload one, an avatar.

Dive logs and marine life sightings

If you log a dive, we store the site visited, the date, and whatever details you choose to fill in: depth, duration, visibility, water temperature, current, gear used, and tank details. If you tag species you saw, we store the species, quantity, and behaviour notes, linked to that dive log. Taken together, this is a personal record of where and when you have been diving, so we treat it as sensitive: it is visible to you, contributes to anonymised, aggregated patterns we show on site pages (for example, which species are typically seen at a site and in which months), and is only shown to other users if you choose to make a review or dive card public.

Reviews and corrections

Site reviews you write, including rating, title, body text, and visit date, are attributed to your account and public. Corrections you submit for a site (name, location, depth, hazards, and similar) are used to improve that site's data and are not displayed as authored by you.

Technical and usage data

Like most websites, our hosting provider (Vercel) logs request data such as IP address, browser type, and pages requested, for security and reliability. We use Google Analytics (GA4) to understand aggregate traffic and usage patterns, and Vercel Analytics/Speed Insights to monitor page performance. Neither is configured to identify you by name.

Cookies and similar technology

We use a small number of cookies:

Essential: Supabase sets a session cookie so you stay signed in. The site does not function without this one.
Analytics: Google Analytics (GA4) sets cookies to distinguish visitors and sessions.
Maps: Mapbox, which powers the interactive map, sends anonymous usage telemetry to Mapbox as part of its normal operation.

We do not currently run a cookie consent banner. If you are in a jurisdiction that requires opt-in consent for analytics cookies specifically, this is a known gap we intend to close.

How we use your data

We use the data above to: run the account and dive-logging features you sign up for; show you your own collection, badges, and dive history; improve the accuracy of site and species data using aggregated (not individually identified) dive log patterns; send transactional email, such as sign-up confirmation and password reset, via our email provider Resend; and monitor and improve site performance and reliability.

We do not sell your personal data, and we do not use your dive logs or sightings for advertising targeting.

Who we share data with

We use a small set of service providers (sub-processors) to run Fin. Each only receives what it needs to do its job:

Supabase hosts our database, authentication, and file storage.
Google provides optional sign-in (OAuth) and Google Analytics.
Vercel hosts the website and provides performance analytics.
Mapbox powers the interactive map.
Resend delivers transactional email on our behalf.
Open-Meteo supplies weather and sea temperature data used on site pages; this is a public data lookup and does not involve your personal data.
Wikimedia Commons hosts some of the reference images we display; loading these sends your browser's request directly to Wikimedia's servers.

We do not otherwise sell, rent, or share your personal data with third parties, except where required by law.

Where your data is stored

Our infrastructure providers (Supabase, Vercel, Google) operate data centres in multiple countries, so your data may be processed outside your own country. Each provider maintains its own security and compliance programme; we choose providers that publish clear data-handling terms.

How long we keep your data

We keep account data, dive logs, and reviews for as long as your account is active. If you want your account and associated data deleted, email support@divewithfin.com and we will delete it, other than data we are required to retain for legal or security reasons (for example, fraud-prevention logs).

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email support@divewithfin.com. Most of your own data (dive logs, reviews, profile) is also visible and editable directly in your account.

Children's privacy

Fin is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.

Security

We rely on our providers' security infrastructure (encryption in transit, access controls, hashed passwords) and follow reasonable practices to protect your data. No system is completely secure, and we cannot guarantee absolute security.

Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of Fin after a change means you accept the updated policy.

Contact

Questions about this policy or your data: support@divewithfin.com.