Privacy policy
Last updated September 3, 2026. This covers superiorwaves.ca, run by SuperiorWaves.
What is stored, and why
| What | Why it exists | Who can see it |
|---|---|---|
| Your mobile number | It is your login. There is no password to leak, so an SMS code proves the number is yours. | Only the operator. Never shown to other riders. |
| Display name, bio and photo | So people know who they are riding with. | Public, on your posts and replies. |
| Your craft | Conditions are scored against the limits of what you actually ride. | Public, on your profile. |
| Home launch and saved spots | The fallback when GPS is off, and the spot your alerts are scored for. | Only the operator, unless you attach a location to a post. |
| Posts, replies, likes, RSVPs and condition reports | They are the community. A ride report nobody can read is not a ride report. | Public. |
| Alert settings | Which days, what time, how far ahead and how bad it has to be before we bother you. | Only the operator. |
| Sign-in codes | Only a salted hash of the code, never the code itself, so a database leak cannot be replayed. | Nobody. Expires within minutes. |
| Your IP address | Rate limiting. Sending SMS costs real money, so codes are capped per number and per connection. | Only the operator. |
| A log of every text sent to you | Enforces the daily caps and makes it possible to answer why a message arrived. | Only the operator. |
| Units, time zone and theme | So the site reads in feet or metres as you expect and alerts arrive at the right local time. | Only the operator. |
There is no account to make in order to read this site. Conditions, forecasts, the spots ranking and the safety page all work signed out, and none of them require anything from you beyond the location you choose to look at.
Location
The site asks your browser for your position so it can score the water where you actually are. That is a permission your browser controls and you can refuse it: if you do, the site falls back to your saved home launch, or to Thunder Bay, and everything still works. A position obtained this way is held for the length of your visit to work out the forecast. It is not written to the database and not attached to your account.
Locations you deliberately save are a different matter and are stored: your home launch, any saved spots, the location attached to a post you write, and the spot your text alerts are scored for. A post's location is public, because the whole point of a ride report is that it says where the water was like that. Photos are resized in your browser before they are uploaded, which also strips the GPS coordinates cameras embed in them, so uploading a photo does not quietly publish where you took it.
Text messages
Your number is used for three things: the sign-in code, the alerts you switched on, and replies to your own posts and threads. You choose all of it on the text alerts page, you can turn all of it off in one tap, and replying STOP to any message stops everything. There is a hard cap on messages per person per day, so a busy thread cannot flood your phone even if something goes wrong.
Every message sent is logged with the number, the message body and whether it succeeded. That log is what enforces the rate limits and what makes it possible to answer "why did I get this", so it is deliberately kept rather than discarded.
If somebody texted you a forecast and you have no account here, that is the share feature: a rider typed your number in. We were not given your number by you and we do not keep it for anything else. Reply STOP and that number will never be sent anything again. The limits on this are strict, per sender, per recipient and per pair, precisely because it is the one feature that can reach somebody who never asked for it.
Who else is involved
This site is not free of other people's servers, so here is the complete list of who receives anything and what they get. Loading a page means your IP address reaches the ones marked as such, which is unavoidable for anything served from another domain.
Open-Meteo. Weather, marine and place search data. Receives the coordinates being forecast and this server's IP address, never yours and nothing about you.their privacy terms
Twilio. Delivers the text messages. Receives the destination number and the message body, because that is what sending a text is.their privacy terms
National Weather Service (NOAA). Official marine warnings for the American shore. Receives the coordinates being checked and this server's IP address.their privacy terms
OpenStreetMap. Map tiles on the spot map and the location picker. Receives your IP address and the area of the map you are looking at, directly from your browser.their privacy terms
Google Fonts. The typeface. Receives your IP address when a page loads.their privacy terms
unpkg and jsDelivr. Serve the mapping and text editor libraries. Receive your IP address when a page loads.
OpenAI. Optional and off unless an operator turns it on. When on, it rewrites only the friendly "what to expect" paragraph and is sent nothing but weather figures and a place name. No account details, no post content and no phone numbers are ever sent to it, and every verdict, score and safety warning is computed in code and never altered by it.their privacy terms
There is no analytics package, no advertising network, no tracking pixel and no social media embed on this site. Nothing about you is sold or shared for anybody else's marketing.
Cookies
One cookie, named sw.auth, and only once you sign in. It says which account you
are and nothing else, it is encrypted, and your browser will not hand it to another site. It
is deliberately long lived, because getting signed out means another SMS code and another
interruption, and it renews itself for as long as you keep visiting. Signing out deletes it.
There are no advertising or analytics cookies to consent to, which is why this site does not
put a banner in your way.
Getting rid of it
Delete my account and all my posts at the bottom of your profile removes your profile, your craft, your photos, your posts, your replies, your RSVPs, your saved spots and your alert settings. It is a real delete, not a flag, and it cannot be undone. Message logs and sign-in records tied to your number are kept briefly afterwards because they are what stop somebody re-registering your number to text you, then they age out.
You can also just edit or delete individual posts, change or clear your saved locations, or turn every message off and keep the account. None of that requires asking anybody.
If you want a copy of what is held about you, or you want it corrected, or you want it deleted and cannot do it yourself, there is currently no contact address configured for this site, which the operator needs to fix. Depending on where you live you may have these rights under PIPEDA, the GDPR or a state privacy law; they are offered here regardless of which of those applies to you.
Two last things
Age. Accounts are not for under 16s. Signing up needs a mobile number and receiving safety information about cold water is not a substitute for adult supervision. If you believe a child has made an account here, say so and it will be removed.
Changes. If this policy changes in a way that affects what is collected or who it goes to, the date at the top changes and the change is described here rather than slipped in. Carrying on using the site after that is how you accept it.