Privacy Policy

1. Information We Collect

Personal Information You Provide

We collect information that you voluntarily provide when creating an account and using the Service:

• Account Information: Email address, full name, password
• Profile Information: Location, bio, diving experience (years diving, number of dives, certifications, interests), profile photos
• Certification and Insurance Documents: Images of dive certification cards (front and back) and dive insurance cards that you choose to upload for your personal records. You may also optionally share insurance policy details (provider, plan name, policy number, expiration date) with experience attendees for safety purposes.
• Content: Photos, videos, messages, comments, and other content you upload or share
• Dive Trip Information: Trip details, attendee lists, payment tracking information
• Social Connections: Friend requests and connections you make
• Subscription Information: If you purchase a premium subscription (Scubaful Plus or Scubaful Pro), we collect information about your subscription tier, status, and usage within the app. Payment processing is handled entirely by Apple or Google; we do not receive or store your payment card details.

Information Collected Automatically

When you use the Service, we automatically collect certain information:

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Pages viewed, features used, time spent on the Service, navigation paths
• Location Data: Approximate and precise location (when you grant permission) for displaying nearby dive sites and trips
• IP Address: For security and analytics purposes

Information from Third Parties

If you authenticate using a third-party service (Google, Facebook, Apple), we receive:

• Email address
• Name
• Profile picture (if authorized)

Device Permissions

Scubaful requests certain device permissions to enable app features:

• Camera Access: Used for capturing dive media (photos and videos) to share with the community, scanning QR codes to view diver profiles and experiences, and capturing images of your dive certification and insurance cards for your personal reference. The QR scanner processes code data locally on your device—no images from the scanner are stored or transmitted.
• Location Access: Used to display nearby dive sites and experiences, and to provide location-based features.
• Photo Library Access: Used to select existing photos and videos from your device to share on the platform.
• Notification Access: Used to send you updates about messages, friend requests, and experience updates.

Photos and videos you capture are only uploaded to our servers when you explicitly choose to share or save them. Certification and insurance card images are stored securely and are only accessible to you. You can revoke any permission at any time through your device settings. Some features may be unavailable without certain permissions.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service: Create and manage your account, enable social features, facilitate dive trip organization
• Improve the Service: Analyze usage patterns, develop new features, fix bugs and technical issues
• Communication: Send notifications about trips, messages, friend requests, and Service updates
• Security: Detect and prevent fraud, abuse, and security incidents
• Subscription Management: Process and manage premium subscriptions, verify subscription status, enforce usage limits, and provide premium features to subscribers
• Legal Compliance: Comply with applicable laws and regulations, respond to legal requests
• Analytics: Understand how users interact with the Service to improve user experience

3. Sharing Your Information

We may share your information in the following situations:

With Other Users

Based on your privacy settings and use of the Service:

• Profile information is visible to other authenticated users
• Content you share on trips is visible to trip attendees
• Messages are visible to conversation participants

With Service Providers

We share information with third-party service providers who help us operate the Service (see Section 4 for details).

For Legal Reasons

We may disclose your information if required by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information to third parties.

4. Third-Party Service Providers

Authentication Services

• Google Sign-In
• Facebook Login
• Apple Sign In

Mapping and Location Services

• Google Maps Platform

Subscription and Payment Services

• Apple App Store (iOS payment processing)
• Google Play Store (Android payment processing)
• Subscription management services

When you subscribe to a premium plan, Apple or Google processes your payment directly. We use subscription management services to track your subscription status and entitlements. These services receive a unique customer identifier linked to your account but do not receive your name, email, or payment card details. Apple and Google are subject to their own privacy policies.

Infrastructure and Data Services

• Cloud database and authentication providers
• Media storage and content delivery networks
• Analytics and application monitoring services

These service providers are bound by confidentiality obligations and may only use your personal information as necessary to provide services to us. They may not use your information for their own purposes.

For a complete list of our service providers and links to their privacy policies, please contact privacy@scubaful.com.

5. Data Retention

We will retain your personal information for as long as your account is active or as needed to provide you with the Service. If you delete your account:

• Your personal information (name, bio, location, avatar) is anonymized
• Your profile is marked as deleted and hidden from other users
• Messages you sent are preserved for other users' conversation history but show "Deleted User" as sender
• Content you shared on trips remains accessible to trip participants but shows "Deleted User" as owner

We may retain certain information for legitimate business purposes (fraud prevention, legal compliance) or as required by law, even after account deletion.

Media Retention

We generally retain photos and videos you upload for as long as your account remains active. However, we reserve the right to delete media at our discretion, including:

• Media from inactive accounts (no login for 12 months or more)
• Media exceeding your subscription tier's storage limits
• Media as part of routine storage management or service optimization
• Deleted accounts: Media is deleted within 30 days of account deletion

If you downgrade from a paid to free tier, existing media remains accessible. You will not be able to upload new media beyond free tier limits until you upgrade or delete existing media.

We will make reasonable efforts to notify you before deleting media. You are responsible for maintaining your own backups of any media you upload. Scubaful is not a backup service.

6. Your Privacy Rights

Your Rights

You have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Request that we correct inaccurate or incomplete information
• Right to Deletion: Request deletion of your account and personal information
• Right to Data Portability: Request a copy of your data in a portable format
• Right to Withdraw Consent: Withdraw consent for data processing where we rely on consent
• Right to Object: Object to processing of your personal information in certain circumstances

How to Exercise Your Rights

To exercise any of these rights:

• Update profile information: Use the edit profile feature in the app
• Delete account: Use the account deletion feature in settings
• Request data export: Contact privacy@scubaful.com
• Other requests: Contact privacy@scubaful.com

We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request.

California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

European Union Residents

If you are located in the European Union or United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including those listed above. You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and you believe your child has provided us with personal information, please contact us at privacy@scubaful.com. If we discover that we have collected personal information from anyone under 18 without verification of parental consent, we will delete that information immediately.

8. International Data Transfers

Your information, including personal information, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction.

If you are located outside the United States and choose to provide information to us, please note that we transfer the information, including personal information, to the United States and process it there. Our service providers may also process data in other countries.

Your consent to this Privacy Policy followed by your submission of information represents your agreement to that transfer. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

9. Security

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it:

• Encryption: All data transmitted between your device and our servers is encrypted using HTTPS
• Password Security: Passwords are hashed and never stored in plain text
• Access Controls: Strict policies restrict data access to authorized users only
• Monitoring: We monitor for security incidents and suspicious activity
• Sensitive Documents: Certification and insurance card images are stored securely and are only accessible to you. These documents are not shared with other users or displayed publicly.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Effective Date" at the top of this Privacy Policy
• Sending you a notification (for material changes)

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: privacy@scubaful.com