Privacy Policy
Last updated October 16, 2026
PeelWatch is a small, independent surf forecast service. This page is a plain-language account of what we actually collect, why, and what we never do with it — not a boilerplate legal template.
Data we collect
The only thing we ever require is an email address. Everything else is optional, or generated simply by using the service.
Email address
Required to create an account. We use it to send you a passwordless sign-in link and, if you set one up, alert emails. It's stored against your account and used for nothing else.
Profile details (optional)
Your name, a preferred skill level or region, and — if you answer it — how you heard about us, which includes a free-text box. All optional, and none of it is required to use an account.
Account activity
When your account was created, whether your email is verified, when you were last active, and which days you used the site while signed in — kept to keep your session working and to understand whether the service is actually being used. The daily record is deleted after about 13 months.
Alerts
If you set up a surf or tide alert, we store which spot or station, your skill level, and the threshold that should trigger it. Every alert email we send is logged, so we can prove — to you and to ourselves — that an alert that should have fired, did.
Feedback
If you use the feedback form or the Report a problem button, we store your message and the page it came from: its address (with anything that looks like a token or an email address removed), its title, and a few details about your browser — language, light or dark theme, window size, and a short label for the browser and operating system, such as “Safari 17 on iOS”. We do not keep the full identification string (the user agent) your browser sends. A reply email is optional — you can send a report anonymously. If you happen to be signed in when you send it, we note your account so we can follow up.
Spot notes
Notes you write about a surf spot are tied to your account and checked before they're shown publicly. If a note is rejected, the reason is kept for our own record — it is never shown to other visitors.
Saved spots
Spots you save are kept in your browser's local storage while you're signed out, so they never reach our servers. Signing in syncs your shortlist to your account.
Who we share data with
We use a small number of outside services to run PeelWatch. Each one sees only what it needs to do its job.
Resend
Delivers our emails — sign-in links and alerts.
Vercel Web Analytics
Counts visits — which pages and spots are actually read — with Vercel Web Analytics, run by Vercel, the company that already hosts PeelWatch (see Hosting). It sets no cookie and stores nothing in your browser; to tell visitors apart within a day it uses a hash of the request that is discarded after 24 hours, never an identifier that follows you to other sites. We see totals, never a person. We also count a few actions as you take them — creating an account, submitting an alert form, saving a spot, opening a webcam, using “near me”, changing your level, choosing to share an idea, seeing or opening a partner's card — with the spot, the alert type, the level, or the partner and where its card appeared attached, never who you are. A browser-level analytics blocker stops it entirely.
Cloudflare Turnstile
A bot check on the feedback and account forms, running in your browser.
Hosting & infrastructure
The site runs on Vercel, its database on Railway, with Cloudflare in front as a content delivery network — standard infrastructure providers, none of whom use your data beyond running the service.
MEO Beachcam and other webcams
PeelWatch's camera links, on the Beachcams page and on spot pages, point to MEO Beachcam and other public webcam pages. Nothing is embedded or copied, so nothing loads from those sites until you choose to open a camera. When you do, it opens in a new tab on the provider's own site, and that provider sees the visit, as it would any link you follow.
Forecast & map data
Open-Meteo, Instituto Hidrográfico and OpenStreetMap supply the weather, tide and map data PeelWatch displays. These are sources we fetch from, not services we send data to — the one exception is that OpenStreetMap's map tiles are requested directly by your browser on pages with a map.
What we don't do
No passwords
We never ask for or store a password. Signing in means clicking a link we email you — there's no password to leak.
Location stays on your device
The "near me" filter uses your browser's own location only to centre a map and sort a list, and only when you tap it. It is never sent to, or stored on, our servers.
No selling, no advertising
We don't sell personal data, and we don't share it for advertising.
IP addresses
Your IP address is used only to rate-limit requests — so one machine can't spray sign-in links at other people's inboxes. Page-level limits are held in memory and never stored. Sign-in attempts and problem reports are limited across all our servers, which means the address is written to a short-lived counter row in the database; those rows are discarded once the limit window expires. We never use your IP to profile or track you.
Your rights
You're in control of your data at every point:
Unsubscribe
Every alert email carries a signed unsubscribe link. It works with one click and needs no account.
Manage or delete
Turn off alerts, sign out, or ask us to delete your account entirely, from the Account page.
Under GDPR
If you're in the EU, you have the right to access, correct, delete, restrict or receive a copy of your data, and to object to how we use it.
To exercise any of these rights, or to ask us anything about this policy, use the feedback form — it's the only contact channel we have, and every message is read.
Changes to this policy
If what we collect or how we use it changes, we'll update this page and the date below.