Pour l'instant, ce texte n'existe qu'en anglais.
DRAFT — not legal advice. Review by a qualified lawyer before publishing.
Version: 1.0 · Effective from: 10 November 2026
The short version
- Uretara has no accounts, no analytics, no advertising and no tracking. We don't know who you are.
- Your favourites, settings, saved forecasts and your surf journal (ratings, notes and any photos you add) stay on your phone.
- If you let Uretara use your location, it's used on your phone to find the spots nearest to you. We don't send your position to our servers.
- To show a forecast, the app asks our server for the forecast for a sea area around a spot, not for you. If you turn on the evening alert, the app does this in the background the evening before, for your favourites.
- Like any website or app server, ours sees your IP address when you ask it for something. It uses it only for a moment, to stop any one device from overloading the server, and we don't store it.
- If you open a buoy or an official marine bulletin, it opens that website in Safari, and that website sees your IP address. This version of the app shows no live cameras.
- If you suggest a correction to a spot on our web form, we receive your answers and, only if you give them, a name to credit and an e-mail address to thank you. Nothing is published until we have read and approved it (section 3a).
The rest of this page is the detail.
1. Who we are
The Uretara app is provided by Alessandro Voltan, a private individual, Alameda Mazarredo 43, 48009 Bilbao, Spain. Uretara is a personal, non-commercial project: it is free, has no ads, sells nothing and is not run by a company.
We are the "controller" of the personal data described here, under the EU General Data Protection Regulation (GDPR) and Spain's Ley Orgánica 3/2018 (LOPDGDD).
Contact for anything in this policy: hello@uretara.com.
No data protection officer is appointed: Uretara is run by a private individual and its processing does not require one (GDPR art. 37; LOPDGDD art. 34). For anything about your data, write to hello@uretara.com.
2. What this policy covers
This policy covers the Uretara app for iPhone, version 1.0 and later, and our website at https://api.uretara.com. The website's privacy, terms and support pages load nothing from other servers, use no cookies and keep nothing about you; its spot-suggestion form is described in section 3a.
3. What data we process, and why
| Data | Why | Legal basis (GDPR art. 6) | Where it goes | How long we keep it |
|---|---|---|---|---|
| Your device's location (only if you allow it, "while using the app") | To sort spots by distance ("near me") | Your consent, given through the iOS permission prompt, which you can withdraw at any time in iOS Settings () | Nowhere. It's used on your phone and not sent to us. | Not stored by us. iOS handles it. |
| The forecast areas you look at (a grid square of 0.1°, about 11 km, around a spot) | To send you the forecast for that area | Our legitimate interest in providing the app you chose to use (art. 6(1)(f)) | Our server, hosted by Google Cloud | We don't keep a list of who asked for what. If an area that isn't one of the app's spots is asked for, our server notes that area (its position and a count, nothing that identifies who asked) for up to 7 days, so it can keep it up to date. Forecast areas of the app's spots are not listed at all. |
| Your IP address and basic request details (time, the address requested, app version and device type as sent by iOS) | To deliver the request and to limit how often one device can ask (so nobody can overload the service) | Legitimate interest in running a secure, working service (art. 6(1)(f)) | Our server's memory only, for the few minutes the limit needs | Not stored. Our server doesn't write it down, and Google Cloud's request logs are turned off for our server. |
| Favourites, home spot, level, units, language, alert settings, cached forecasts, and your surf journal (ratings, notes, the photos you choose to add) | To remember your choices, keep your journal and work offline | Not sent to us. Stored only on your device. | Your device only (and your own iCloud or device backup, if you use one, under Apple's terms). If you export the journal, iOS's share sheet sends the file where you choose. | Until you change or delete them, or delete the app |
| Evening alerts (if you turn them on) | To tell you the evening before when a favourite looks good | Your consent, given through the iOS notification prompt (art. 6(1)(a)) | The alert is worked out and shown on your phone (a local notification). To do it, the app fetches your favourites' forecast areas from our server in the background, like any other forecast request. No push token is created. | Nothing extra is kept by us |
| Crash reports | To fix bugs | Not collected by us. If you turned on "Share with App Developers" in iOS Settings, Apple shares crash data with us "aggregated or in a form that does not personally identify you" (Apple). | Apple, then us via Apple's developer tools | Apple's own retention applies in its tools. We keep no copy outside them, except a report we save while fixing a bug, deleted once the fix ships and at the latest after 6 months. |
3a. Spot suggestions
Anyone who surfs a spot can tell us where it breaks and when it works, on a web page at https://uretara.com/help/<spot> (or /help/new for a spot that isn't in Uretara yet). You may get there from a link we sent you, a QR code, or the "Help Uretara get it right" link on a spot the app took from open maps. No account is needed.
| Data | Why | Legal basis (GDPR art. 6) | Where it goes | How long we keep it |
|---|---|---|---|---|
| Your answers: which spot, where it breaks (a point you place on a map), which way it faces, the kind of break, best tide and wind, the size range, who it suits, an optional tip of up to 200 characters, and the page language | To check and correct the spot in Uretara | Your consent, given by sending the form (art. 6(1)(a)) | Our server, as one file per answer in our storage at Google Cloud (Belgium, europe-west1) | Until we have reviewed it; an approved answer becomes part of the spot's public description (below). Rejected answers are deleted 30 days after we reject them. |
| A name or school to credit (optional) and "I surf here" details (optional) | To credit you on the spot ("Checked by [name], [month year]") and to judge local knowledge | Your consent (art. 6(1)(a)) | Our server; the credit name is published with the approved spot. If you give no name, the credit reads "a local surfer". | As long as the spot shows the credit. Ask us and we remove it from the next version. |
| An e-mail address (optional) | Only to reply or say thank you. Never shown, never published, never used for newsletters or marketing | Your consent (art. 6(1)(a)) | Our server, readable only by us on the review page | Until we have replied, then deleted within 90 days of our reply |
| Your IP address | To limit how many answers one device can send (5 an hour), against spam | Legitimate interest in keeping the form usable (art. 6(1)(f)) | Our server's memory only | Not stored, not written to the answer, not logged |
- Nothing is published automatically. Every answer is read by us first. Only an approved answer changes a spot in Uretara, and only after we publish a new content update.
- Licence. By sending, you agree that your answer (not your e-mail) is published under the Creative Commons Attribution 4.0 licence (CC BY 4.0), credited to the name you gave. You can ask us to remove your credit or your contribution from future versions; copies that others already made under CC BY 4.0 can't be recalled.
- The page itself. The form shows a map. To draw it, your browser loads the map code from cdnjs (Cloudflare) and map images from EOX and the OpenStreetMap Foundation (section 5). Those services see your IP address, as any website you visit does. The form uses no cookies, no analytics and no tracking.
- To see, correct or delete an answer you sent, write to hello@uretara.com with the spot and roughly when you sent it (or the e-mail you used).
If you write to us by email, we use your email address and message only to reply, on the basis of our legitimate interest in answering you, and we delete the thread within 90 days of our reply.
4. What we don't do
- The app doesn't ask for your name, email or any account. The spot-suggestion form asks for a name and an e-mail only as optional fields (section 3a).
- We don't use analytics, advertising or tracking tools, and we don't share data with data brokers.
- We don't sell or rent data to anyone.
- We don't build a profile of you, and we don't make automated decisions about you.
- We don't send your device's location to our server.
- We don't read your contacts or anything else on your phone. The only photo the app sees is one you pick for a journal entry, and that copy stays on your phone. (When you share a forecast card, iOS shows its own share sheet and we never see where it goes.)
5. Other services involved
| Service | What it does in Uretara | What it receives from you |
|---|---|---|
| Apple (MapKit maps, Location Services, notifications, App Store, crash reports) | Shows the map and satellite imagery; tells the app where you are if you allow it; delivers the app | Map requests and location go to Apple under Apple's own privacy policy (https://www.apple.com/legal/privacy/). We don't receive your map activity. |
| Google Cloud (Belgium, region europe-west1) | Runs our server and its storage and network | The requests described in section 3, including your IP address, which passes through it but isn't stored. It acts as our processor under a data processing agreement (Google Cloud Data Processing Addendum, https://cloud.google.com/terms/data-processing-addendum). |
| Cloudflare (cdnjs) | Serves the map code (Leaflet) to the spot-suggestion web form (section 3a) | Your browser's request for the file, including your IP address, under Cloudflare's own policy. The app doesn't use it. |
| EOX IT Services (Austria) and the OpenStreetMap Foundation (UK) | Serve the satellite images (EOxCloudless 2016) and the street map on the spot-suggestion web form | Your browser's requests for map images of the area you look at, including your IP address and the address of our page (as the "referer"), under their own policies. The app doesn't use them. |
| Open-Meteo | Our server gets weather and wave model data from Open-Meteo | Nothing from you. Your phone never contacts Open-Meteo. Our server asks for forecasts by sea area only. |
This version of the app shows no live cameras.
Buoys and official marine bulletins are links, not part of the app. When you tap one, it opens in an in-app browser (Safari) and that website's own policy applies.
Anyone we share data with as described above must protect it at least as well as this policy does.
6. Location
Uretara asks for location only when you choose "near me", and only "while using the app". Uretara works fully without it: you can choose spots from the list, search or the map.
Your position is used on your phone to sort spots by distance. It is not sent to us. When you then open a spot, the app asks our server for that spot's forecast area, as it does for any spot you open.
You can turn location off at any time: Settings › Privacy & Security › Location Services › Uretara.
7. Children
Uretara is not directed at children under 14 (the age of digital consent in Spain, LOPDGDD art. 7). We don't knowingly collect personal data from children. The app has no accounts; the only place to send us anything is the optional spot-suggestion form (section 3a), where a name and an e-mail are optional.
8. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting what happened before).
Because Uretara has no accounts, we usually can't tell which server records relate to you. The exception is a spot suggestion you sent with a name or an e-mail (section 3a): we can find it from those. The data we hold doesn't contain your name, email or a user ID. In that case GDPR article 11 applies: we'll tell you we can't identify you, unless you give us extra information that lets us. Because we don't store IP addresses or any identifier, in practice there is usually nothing on our server that can be linked to you.
What you can always do yourself, straight away:
- Delete everything stored on your phone: delete the Uretara app.
- Stop location use: turn off location for Uretara in iOS Settings.
- Stop crash reports: Settings › Privacy & Security › Analytics & Improvements › turn off "Share with App Developers".
To exercise any right, email hello@uretara.com. We'll answer within one month.
You also have the right to complain to a data protection authority. In Spain that's the Agencia Española de Protección de Datos (AEPD), www.aepd.es. If you live elsewhere in the EU, you can also complain to your local authority.
9. International transfers
Our server is hosted by Google Cloud in Belgium (region europe-west1), inside the European Economic Area, so our own processing doesn't involve a transfer outside the EEA.
Apple, the map services of the spot-suggestion form (Cloudflare, EOX, the OpenStreetMap Foundation) and the websites you open from links process data under their own terms and may be in other countries.
10. Security
Every connection between the app and our server is encrypted (HTTPS). We keep as little as we can, for as short a time as we can, and nothing on our server is linked to a person.
11. Changes
If we change this policy, we'll update the date at the top and, if the change matters (for example, a new kind of data), tell you in the app before it takes effect. This is the first version. Earlier versions will be sent on request: write to hello@uretara.com.
12. Contact
Alessandro Voltan · Alameda Mazarredo 43, 48009 Bilbao, Spain · hello@uretara.com
Highlighted text in brackets is a placeholder that has not been filled in yet.