Privacy Policy
Last updated September 22, 2026
PeelWatch is a small, independent surf forecast service. This page is a plain-language account of what we actually collect, why, and what we never do with it — not a boilerplate legal template.
Data we collect
The only thing we ever require is an email address. Everything else is optional, or generated simply by using the service.
Email address
Required to create an account. We use it to send you a passwordless sign-in link and, if you set one up, alert emails. It's stored against your account and used for nothing else.
Profile details (optional)
Your name, a preferred skill level or region, and — if you answer it — how you heard about us, which includes a free-text box. All optional, and none of it is required to use an account.
Account activity
When your account was created, whether your email is verified, and roughly when you were last active — kept only to keep your session working and to understand whether the service is actually being used.
Alerts
If you set up a surf or tide alert, we store which spot or station, your skill level, and the threshold that should trigger it. Every alert email we send is logged, so we can prove — to you and to ourselves — that an alert that should have fired, did.
Feedback
If you use the feedback form, we store your message and the page it came from. A reply email is optional — you can send feedback anonymously. If you happen to be signed in when you send it, we note your account so we can follow up.
Spot notes
Notes you write about a surf spot are tied to your account and checked before they're shown publicly. If a note is rejected, the reason is kept for our own record — it is never shown to other visitors.
Saved spots
Spots you save are kept in your browser's local storage while you're signed out, so they never reach our servers. Signing in syncs your shortlist to your account.
Who we share data with
We use a small number of outside services to run PeelWatch. Each one sees only what it needs to do its job.
Resend
Delivers our emails — sign-in links and alerts.
Google Analytics
Measures how the site is used — which pages and spots people actually visit. Google sets its own identifiers to do that and, unlike the others on this list, also uses what it collects for its own purposes. A browser-level analytics blocker stops it entirely.
Cloudflare Turnstile
A bot check on the feedback and account forms, running in your browser.
Hosting & infrastructure
The site runs on Vercel, its database on Railway, with Cloudflare in front as a content delivery network — standard infrastructure providers, none of whom use your data beyond running the service.
MEO Beachcam
The Beachcams page links out to MEO's own player rather than embedding it, so nothing loads from MEO until you choose to open a camera. When you do, it opens in a new tab and MEO sees that visit, as it would any link you follow.
Forecast & map data
Open-Meteo, Instituto Hidrográfico and OpenStreetMap supply the weather, tide and map data PeelWatch displays. These are sources we fetch from, not services we send data to — the one exception is that OpenStreetMap's map tiles are requested directly by your browser on pages with a map.
What we don't do
No passwords
We never ask for or store a password. Signing in means clicking a link we email you — there's no password to leak.
Location stays on your device
The "near me" filter uses your browser's own location only to centre a map and sort a list, and only when you tap it. It is never sent to, or stored on, our servers.
No selling, no advertising
We don't sell personal data, and we don't share it for advertising.
IP addresses
Your IP address is used only to rate-limit requests — so one machine can't spray sign-in links at other people's inboxes. Page-level limits are held in memory and never stored. Sign-in attempts are limited across all our servers, which means the address is written to a short-lived counter row in the database; those rows are discarded once the limit window expires. We never use your IP to profile or track you.
Your rights
You're in control of your data at every point:
Unsubscribe
Every alert email carries a signed unsubscribe link. It works with one click and needs no account.
Manage or delete
Turn off alerts, sign out, or ask us to delete your account entirely, from the Account page.
Under GDPR
If you're in the EU, you have the right to access, correct, delete, restrict or receive a copy of your data, and to object to how we use it.
To exercise any of these rights, or to ask us anything about this policy, use the feedback form — it's the only contact channel we have, and every message is read.
Changes to this policy
If what we collect or how we use it changes, we'll update this page and the date below.