Introduction
Salty Sanctum (“Company,” “we,” “us”) operates a web-based community platform for freediving enthusiasts at saltysanctum.com, with a companion iOS application in development (collectively, the “Platform”). This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information when you use the Platform and all related services (the “Services”).
By accessing the Services, you consent to the practices in this Policy. This Policy is part of our Terms of Service.
We comply with the California Consumer Privacy Act (CCPA/CPRA), General Data Protection Regulation (GDPR) where applicable, and CAN-SPAM Act.
Information We Collect
2a. Information You Provide Directly
- Account information: Email, password, name, profile details (display name, bio, avatar, certification level, home region)
- Private information: Phone number, date of birth, medical notes, emergency contacts, shipping addresses. These are accessible only by you and encrypted at rest where appropriate.
- Preferences: Privacy settings, notification preferences, display preferences (units, time format)
- Community profiles: Buddy profile (experience, availability, interests), instructor profile (bio, specialties, rates), business applications
- User-generated content: Posts, comments, event details, marketplace listings, reviews, photos, chat messages, dive site contributions
- Social connections: Friend/buddy connections, follows, block lists
- Certifications: Certification details, evidence photos (for staff verification)
- Payments: Transaction details and payment identifiers. Card numbers are processed by Stripe and never stored on our servers.
- Waivers: Digital acknowledgements with timestamps, IP address, and user agent for audit integrity
2b. Information Collected Automatically
- Device and access data: IP address, user agent, authentication method, used for security auditing, rate limiting, and fraud prevention
- Location: Coarse location when you opt in, used for nearby dive sites, buddy discovery, and event proximity
- Analytics: Page views and feature usage events via PostHog, used to improve the Platform. We do not use Google Analytics or ad-network analytics.
- Error data: Error traces and performance data via Sentry, with all user text, inputs, and media masked
- Push notification tokens: Device tokens via Firebase Cloud Messaging when you opt into push notifications
- Bot prevention: CAPTCHA challenge data via Cloudflare Turnstile on sign-up, sign-in, and password reset, with no persistent tracking
- Cookies: Essential authentication cookies for session management
2c. Information from Third Parties
- Google/Apple OAuth: Email, name, and profile photo (Google only) when you choose social sign-in
- Stripe: Transaction confirmations, payment status, refund status
2d. Information We Do NOT Collect
- We do not collect health data (beyond optional medical notes you provide)
- We do not collect biometric data
- We do not use advertising tracking pixels or ad-network analytics
- We do not sell your personal information
How We Use Your Information
- Provide Services: Authenticate accounts, display profiles, facilitate events, marketplace, chat, buddy matching, process payments, send notifications
- Safety: Enable check-ins, broadcast safety alerts, store emergency contacts for user-initiated sharing
- Security: Rate limiting, login auditing, fraud prevention, content moderation, bot detection
- Communication: Transactional and service emails. All non-essential emails can be opted out via Settings or one-click unsubscribe.
- Platform improvement: Error tracking (Sentry), product analytics (PostHog), aggregated usage patterns
- Legal compliance: Respond to legal requests, enforce Terms of Service
- CRM sync (optional): When enabled by administrators, email, name, and certification level may be synced to our CRM for onboarding communications. Off by default.
We do not sell, rent, or share your personal information for third-party advertising or marketing.
How We Share Your Information
4a. With Your Consent or Direction
- Public content (profiles, posts, events, listings) visible based on your privacy settings
- Emergency contacts shared only when you explicitly initiate (e.g., safety check-in)
- Location shared only when opted in and only with friends
4b. Service Providers
We use the following third-party services to operate the Platform:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase (US) | Authentication, database, file storage, real-time chat | All account data, uploaded files, chat messages |
| Vercel (US) | Application hosting | All HTTP traffic routes through Vercel |
| Stripe (US) | Payment processing | Email, name, payment amounts |
| Google (US) | OAuth sign-in, push notifications (Firebase Cloud Messaging) | OAuth tokens (sign-in); device push tokens, notification content (FCM) |
| Apple (US) | OAuth sign-in | OAuth token exchange |
| Resend (US) | Transactional email delivery | Email address, email content |
| Shippo (US) | Shipping labels and tracking | Names, street addresses, parcel dimensions |
| Mapbox (US) | Interactive maps, geocoding | Latitude/longitude queries, anonymous map telemetry |
| Sentry (US) | Error monitoring | Error traces (all user text/inputs/media masked) |
| PostHog (US) | Product analytics | Page views, feature usage events, anonymized user identifiers |
| Upstash (US) | Rate limiting | IP addresses, user identifiers (for rate-limit counters only) |
| Cloudflare (US) | Bot prevention (Turnstile CAPTCHA) | IP address, browser challenge signals |
| Go High Level (US) | CRM sync (when enabled) | Email, name |
| Open-Meteo (EU) | Marine weather data for dive sites | Latitude/longitude queries only (no user data) |
| NOAA CO-OPS (US) | Tide predictions for dive sites | Latitude/longitude queries only (no user data) |
4c. Moderation and Administration
Authorized staff (moderators, admins) may access:
- Public profile information for user management
- Reported content for review and moderation decisions
- Business applications for approval/rejection
- Certification evidence for verification
- Safety incidents for response coordination
All admin actions are logged in an audit trail.
Staff cannot access: your password, private profile data (phone, DOB, medical notes), emergency contact details, shipping addresses, or payment card information. These restrictions are enforced through database-level access policies and application-level controls.
4d. Legal and Safety
We may disclose information when required by law, to protect rights or safety, respond to legal process, or in connection with a business transfer (merger, acquisition).
4e. Aggregated Data
We may share anonymized, aggregated data (e.g., popular dive sites, platform statistics) that cannot identify individuals.
Data Security
- Encryption: Sensitive data (emergency contacts, shipping addresses) is encrypted at rest using industry-standard methods. All data is encrypted in transit.
- Password security: Passwords are securely hashed; we never store plaintext passwords
- MFA support: Optional two-factor authentication with hashed backup codes
- Access control: Database-level access policies ensure users can only access their own private data
- Security headers: Content Security Policy, HSTS, and related protections
- Audit logging: Login events and all administrative actions are logged
No system is completely secure. You are responsible for maintaining your account security. Report suspected breaches immediately to security@saltysanctum.com.
Your Rights and Choices
6a. All Users
- Privacy controls:Adjust profile visibility, location sharing, DM permissions, activity status in Settings > Privacy
- Notification preferences:Opt out of email categories or globally in Settings > Notifications. Every email includes a one-click unsubscribe link.
- App permissions: Manage location and notification permissions via your browser settings
- Account data: View and edit your profile, certifications, addresses, and emergency contacts in Settings
6b. California Residents (CCPA/CPRA)
- Right to know what personal information is collected and how it's used
- Right to delete personal information (subject to legal exceptions)
- Right to opt out of “sales” of personal information (we do not sell your data)
- Right to non-discrimination for exercising your rights
6c. EU/UK Residents (GDPR)
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure / right to be forgotten (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
- Right to withdraw consent
Lawful bases for processing: consent (location, optional features), contract performance (account, transactions), legitimate interests (security, platform improvement).
6d. Account Deletion
You can request deletion of your account at any time through your Security Settings. Upon request, your account enters a deactivation period during which you can cancel. After the deactivation period, your account and all associated data are permanently deleted, including removal from third-party services.
6e. Data Export
You can request a complete export of your personal data at any time through your Security Settings. The export includes your profile information, events, posts, marketplace activity, certifications, and related data in a machine-readable format.
6f. Exercising Your Rights
You can exercise your deletion and data export rights directly through self-service tools in your Security Settings. For any other privacy requests, contact privacy@saltysanctum.com. We verify identity before processing and respond within 30 days (GDPR) or 45 days (CCPA).
Data Retention
We retain your personal data for as long as your account is active and as needed to provide the Services. When you delete your account, all associated personal data and user-generated content (posts, events, listings, photos, messages) are permanently deleted.
Certain data is retained beyond account deletion where required:
- Legal and financial records: Payment records are retained as required by tax and financial regulations. Waiver acknowledgements are retained indefinitely for legal audit purposes.
- Safety records: Safety incident records survive account deletion in anonymized form (reporter identity removed) for legal and safety purposes.
- Anonymized records: We may retain anonymized records of account actions (such as order counts and event attendance) after deletion, with all personally identifiable information removed.
- Audit logs: Login audit logs are retained for 12 months. Administrative action logs are retained indefinitely.
- Third-party logs:Error logs (Sentry) and server-side application logs are retained per each provider's retention policy.
Cookies and Tracking
See our Cookie Policy for details. In summary:
- We use essential cookies for authentication
- We use Sentry for error monitoring (with full masking of user content)
- We use PostHog for product analytics. PostHog may set a first-party cookie to distinguish unique visitors. No data is shared with ad networks.
- Mapbox collects anonymous map usage telemetry
- Cloudflare Turnstile is used for bot prevention on authentication forms. It does not use persistent tracking.
- We do not use advertising or social media tracking cookies
Children's Privacy
The Services are intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we discover that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has provided personal information, contact us at privacy@saltysanctum.com.
International Data Transfers
Your data is primarily processed and stored in the United States through our service providers. For transfers from the EU/UK, we rely on Standard Contractual Clauses and adequacy decisions where available.
Changes to This Policy
We may update this Policy periodically. Material changes will be communicated via email and/or a prominent notice on the Platform. The “Last Updated” date at the top indicates the most recent revision. Continued use after changes constitutes acceptance.
Contact
- Privacy inquiries: privacy@saltysanctum.com
- General support: support@saltysanctum.com
- Mailing address: [Address to be provided]