Privacy Policy
What This Means for You
Freedive Finder is a mobile app that helps you find dive buddies, organise freediving sessions, and discover dive sites. To provide this service, we collect some personal information from you — like your name, email, and diving certifications — and store it securely on cloud servers. Our cloud hosting provider (Amazon Web Services) holds this data in Singapore. We also use Google Firebase for crash reporting and push notifications, and Google Maps / Apple Maps for location features — these services may process some data in the United States. Images you upload (your avatar, dive site photos) are stored privately and served to the app via short-lived secure links.
The app is operated and moderated by a small number of authorised platform administrators. Administrators can access user data in order to keep the service safe and working; every administrative action is recorded in an append-only audit log.
If you signed up for our beta waitlist, your email, first name, device type, region, and the time you signed up are stored so we can tell you when access opens.
Your key rights:- You can access and correct your personal information at any time through the app
- You can control whether your profile is publicly visible in the app
- You can request deletion of your account and associated data
- You can lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC)
We do not sell your personal information. We do not use your data for advertising. We only share your information with third-party service providers that help us run the app (hosting, email delivery, crash reporting, push notifications) and with authorised administrators who operate the service.
1. About This Policy
This Privacy Policy explains how Freedive Finder ("we", "us", "our") manages personal information collected through the Freedive Finder mobile application ("the App") and associated website.
This Policy is published under the Privacy Act 1988 (Cth) and applies to all users of the App.
Contact details for privacy enquiries:
- Privacy Officer: Freedive Finder
- Email: christopher@freedivefinder.com
- Website: https://freedivefinder.com
2. Kinds of Personal Information We Collect and Hold
2.1 Account & Identity Information
| Data Field | Required / Optional | Source |
|---|---|---|
| Email address | Required (email auth) / Auto-populated (Google/Apple) | Provided by user or identity provider |
| Display name | Required | Provided by user during onboarding |
| Profile photo (avatar) | Optional | Uploaded by user; stored privately and served to the App via short-lived secure links (see §4.1) |
| Biography (bio) | Optional | Provided by user |
| City / Location text | Optional | Provided by user |
2.2 Diving Credentials
| Data Field | Required / Optional |
|---|---|
| Certification level (e.g. AIDA 2 Star) | Optional |
| Certification agency (e.g. AIDA, SSI, PADI) | Optional |
| First aid certified (yes/no) | Optional |
2.3 Activity Data
| Data Type | Description |
|---|---|
| Dive sessions | Dives you create or join (date, time, location, site, description) |
| Dive participation records | Your attendance at dive sessions |
| Chat messages | Messages you send in dive group chats |
| Buddy connections | Your connections with other divers (friend-request model) |
| Dive site contributions | Sites you create or images you upload |
| Notifications | In-app notifications and their read/unread status |
| Notification delivery logs | For deliverability and to avoid duplicate notifications, we retain a record of which notifications we attempted to send to which user and when. These logs contain the recipient profile ID, related dive ID, and the timestamp only — no message body. |
| Verification events | When you verify an email-based action (e.g. sign-up verification link), we record the request ID and completion timestamp. |
2.4 Technical & Device Data
| Data Type | Description |
|---|---|
| Device token (FCM) | A unique push notification token assigned by Firebase Cloud Messaging, stored per device and platform (iOS/Android) |
| Crash reports | Automatic crash diagnostics collected by Firebase Crashlytics (device model, OS version, stack traces — no PII intentionally included) |
| Authentication tokens | Session tokens used to keep you signed in, stored in device secure storage (see §4.2) |
2.5 Location Data
| Data Type | Description |
|---|---|
| Device GPS coordinates | Used to return "nearby dives" and nearby dive-site results. If you grant the App location permission, your coordinates are sent to our server to process these queries, but are not stored by the server |
| Dive site coordinates | Latitude/longitude of dive sites you create or interact with |
2.6 Beta Waitlist Information
If you sign up for our beta waitlist via freedivefinder.com, we collect the following so that we can contact you when beta access is granted:
| Data Field | Purpose |
|---|---|
| Email address | Waitlist identifier; used to email you when beta access opens |
| First name | Greeting personalisation in waitlist communications |
| Device type (iOS / Android / Other) | Prioritising invites by platform readiness |
| Region | Rollout sequencing (e.g. Australia first) |
| IP address (at signup) | Abuse prevention and deduplication |
| Timestamp (at signup) | Order of waitlist processing |
No further data is collected from waitlist participants until (and unless) they create an account. See §10 for the retention treatment of waitlist records.
2.7 On-Device Personal Metrics (Dive Log)
If you record personal dive metrics (e.g. target depth, time, field values you define) using the in-app dive log, these values are stored on your device only, in encrypted local storage. Dive metric fields and their recorded values are not transmitted to our servers unless you explicitly sync or export them.
2.8 Information We Do NOT Collect
- Financial or payment card information (no payment processing in the App)
- Government identifiers (tax file number, passport, driver's licence)
- Health information beyond first-aid certification status
- Racial or ethnic origin, political opinions, religious beliefs
- Advertising identifiers (IDFA/GAID)
- Browsing history or cross-app tracking data
3. How We Collect Personal Information
3.1 Directly from You
We collect most personal information directly from you when you:
- Create an account (via email/password, Google Sign-In, or Apple Sign-In)
- Complete your profile during onboarding
- Update your profile or privacy settings
- Create or join a dive session
- Send messages in dive group chats
- Upload photos (profile avatar or dive site images)
- Create dive site entries
- Sign up for the beta waitlist
3.2 From Identity Providers
When you sign in with Google or Apple, we receive:
- Google Sign-In: Your Google email address and display name (as authorised by you via Google's sign-in screen)
- Apple Sign-In: Your Apple ID email (or Apple's private relay email if you choose "Hide My Email") and optionally your name
We do not receive your identity provider password.
3.3 Automatically from Your Device
With your permission, we collect:
- Location data: GPS coordinates via the device's location services (only when you grant the App location permission)
- Crash data: Firebase Crashlytics automatically collects device diagnostics when the App crashes
- Push notification tokens: Firebase Cloud Messaging assigns a device token for push notification delivery
3.4 From Other Users
Other users may reference you indirectly through:
- Dive invitations sent to you
- Buddy connection requests
- Rating and review submissions about you as a dive buddy (where this feature is enabled)
4. How We Hold Personal Information
4.1 Server-Side Storage
Your personal information is stored in:
- A managed relational database hosted by Amazon Web Services (AWS) in the ap-southeast-1 (Singapore) region. The database holds your account and profile information, dives and participation records, dive messages, buddy connections, dive sites and images, device push-notification tokens, notification delivery logs (see §2.3), verification-flow records, and the administrative and audit-log records referenced in §6.2.
- Private cloud file storage (provided by AWS, in the same region) for uploaded images (profile avatars, dive site photos, dive photos). These objects are not publicly readable. The App obtains time-limited access via short-lived secure links generated on-demand by our server (default 24-hour expiry). See also §4.3 Security Measures.
- Server-side rate-limit counters and short-lived caches (in-region), used to prevent abuse and to temporarily speed up frequently requested data.
- Beta waitlist record store for beta waitlist signups (see §2.6).
- Beta waitlist / broadcast email log recording retained broadcast sends for delivery auditing; transactional account emails may be reflected only in server logs rather than a dedicated retained email-send history.
4.2 On-Device Storage
On your mobile device, the App stores:
- Encrypted local storage — general query cache: A local cache of server responses (dive lists, profiles, dive sites) to improve offline and low-connectivity performance.
- Encrypted local storage — on-device dive-metric fields and values: If you use the in-app dive log (§2.7), the metric fields you define and the values you record are kept in encrypted local storage on your device, partitioned by profile and dive. These are not sent to our servers unless you explicitly sync or export them.
- Encrypted local storage — app preferences: Unit settings, notification preferences, and similar lightweight configuration.
- Platform secure storage — authentication tokens: Session tokens stored in platform-native secure enclaves: the iOS Keychain, configured so tokens are not synced to iCloud; and the Android Keystore, with auto-backup disabled.
- Platform secure storage — pending sign-up credentials: During email-based sign-up, the email and password you entered are held locally and encrypted until you complete verification. Cleared automatically after successful verification or expiry of the verification window.
- Cached API responses (in-memory): Temporarily cached profile, dive, and participant data for performance.
4.3 Security Measures
We take reasonable steps to protect your personal information, including:
- All network communication uses HTTPS/TLS encryption
- Authentication via industry-standard session tokens with refresh rotation
- Server-side input validation on all endpoints
- Database-level constraints and access controls
- Uploaded images stored in private cloud storage, accessible only via time-limited secure links generated per-request by our server; links expire within 24 hours by default
- Device-side sensitive data stored in platform-native secure enclaves (the iOS Keychain and the Android Keystore) as described in §4.2
- Rate limiting on every server endpoint, applied at different thresholds depending on the sensitivity of the action (authentication, data mutations, standard reads, polling, public pages, administrative pages)
- Administrative audit log: every administrator action is recorded in an append-only record (see §6.2)
- Server access restricted to authorised developers via strong authentication
5. Purposes for Which We Collect, Hold, Use, and Disclose Personal Information
5.1 Primary Purposes
| Purpose | Data Used |
|---|---|
| Account creation and authentication | Email, name, auth provider ID |
| Profile management | Display name, avatar reference, bio, city, certifications |
| Dive session management | Dive details, participation records, location |
| Buddy discovery and connections | Display name, avatar, city, certification level, public profile |
| Dive group chat | Messages, sender identity |
| Push notifications | Device token, notification content (dive reminders, invitations, messages) |
| Location-based discovery | GPS coordinates (with your permission) |
| Beta waitlist communication | Waitlist email, first name, device type, region (see §2.6) |
5.2 Secondary Purposes
| Purpose | Data Used |
|---|---|
| App stability and crash resolution | Crash diagnostics (Firebase Crashlytics) |
| Service improvement and analytics | Aggregated usage patterns; administrator-run analytics (see §6.2) |
| Transactional email and broadcast | Email address (verification, password reset, dive invitations, beta waitlist updates) |
| Safety and moderation | Chat messages, reported content, dive images (reviewable by authorised administrators — see §6.2) |
| Security monitoring and abuse prevention | Rate-limit counters keyed by IP and/or user (§4.3); administrative audit log (§6.2) |
| Notification deduplication | Notification delivery logs (§2.3) |
5.3 We Do NOT Use Your Data For
- Targeted advertising
- Sale to third parties
- Profiling for automated decision-making that significantly affects your rights
- Direct marketing (unless you explicitly opt in)
6. Disclosure of Personal Information
6.1 Other App Users
When you use the App, certain information is visible to other users:
- Public profile (if enabled): Display name, avatar, bio, city, certification level, dive buddy rating
- Dive participants: Your name and avatar are visible to other participants in dives you join
- Chat messages: Visible to all participants in the relevant dive group
Your location is not visible to other users. If you grant the App location permission and use nearby-dive discovery, your coordinates are sent to our server to return dives and dive sites near you; they are not stored by the server, and they are never broadcast to, shared with, or shown on any public map for, other users.
Dive invitations are gated by buddy relationships. Only users who you have accepted as a dive buddy — through a mutual, explicitly-confirmed buddy connection — can send you dive invitations. There is no open invitation surface from strangers.
You control how you appear in the App through the Public Profile setting, which controls whether your profile appears in public browse and search. When public profile is off, your profile and dive buddy rating are not surfaced to users you have not already connected with.
6.2 Platform Administrators
The App is operated by a small number of authorised
platform administrators (including the Privacy
Officer). Authorised administrators access personal information through
a dedicated administrative interface (the Admin Panel, reached at
/admin on our domain), for the following purposes:
- Service operation and user support — reading account, profile, dive, buddy, invite, participant, and dive-site records to investigate user-reported issues and keep the service functioning.
- Safety and content moderation — reviewing dive images, dive-site descriptions, chat content, and reported material.
- Service analytics — running aggregated queries (cohort, funnel, geography, time-series) and, where needed, exporting results as CSV.
- Operational broadcast — counting and messaging users or waitlist participants about service status, required re-acceptance of Terms, outages, or beta availability.
- Administrator account management — granting, revoking, or disabling administrator accounts.
- Log review — reading live and historical server logs for operational purposes.
Accountability measures:
- Every administrative mutation (login, privilege grant or revocation, record mutation, broadcast send, analytics export, and so on) is recorded in an append-only administrative audit log, retaining the actor, action type, target, relevant context, and timestamp.
- Administrator accounts authenticate using password-based login under our strictest rate-limiting tier; sessions use short-lived tokens with refresh rotation. Administrators may be disabled without destroying their historical audit trail.
- Administrators are subject to confidentiality obligations and to the purposes listed above; they may not use administrative access for personal or unrelated purposes.
We disclose that platform administrators are a recipient category for the categories of information set out in §2. Administrator access is operational in nature, not a cross-border or third-party transfer.
6.3 Third-Party Service Providers
We use the following third-party services to operate the App:
| Provider | Purpose | Data Shared | Country |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, managed database, private file storage for images (served via short-lived secure links), email delivery, caching, rate-limit counters | All server-side data | Singapore (ap-southeast-1) |
| Google (Firebase) | Crash reporting (Crashlytics), push notifications (FCM) | Crash diagnostics, device tokens | United States |
| Google (Maps) | Map display for dive site locations | Device IP, map tile requests | United States |
| Apple (Maps) | Map display on iOS devices | Device IP, map tile requests | United States |
| Google (Sign-In) | Authentication | Sign-in tokens, email (during sign-in only) | United States |
| Apple (Sign-In) | Authentication | Sign-in tokens, email (during sign-in only) | United States |
These providers process your data solely on our behalf and under contractual obligations to protect it.
6.4 Legal & Safety Disclosures
We may disclose personal information if required or authorised by:
- Australian law (e.g. court order, subpoena)
- An enforcement body for law enforcement or public safety purposes
- A serious threat to the life, health, or safety of any individual
7. Cross-Border Disclosure
Your personal information is likely to be disclosed to, or stored by, recipients in the following countries:
| Country | Recipient | Purpose |
|---|---|---|
| Singapore | Amazon Web Services (AWS) | Cloud hosting, managed database, private file storage, email delivery, caching |
| United States | Google LLC (Firebase, Maps, Sign-In) | Crash reporting, push notifications, maps, authentication |
| United States | Apple Inc. (Sign-In, Maps) | Authentication, maps |
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it in accordance with applicable Australian privacy law, or we obtain your consent, or an applicable legal exception applies.
8. Access and Correction
8.1 Accessing Your Information
You have the right to request access to the personal information we hold about you. You can access and review most of your information directly through the App:
- Profile data: Viewable and editable in your Profile / Settings screens
- Dive history: Viewable in your Joined Dives list
- Chat messages: Viewable in dive group chats you participate in
- Privacy settings: Viewable and editable in Settings → Privacy & Sharing
For a full data access request — including a machine-readable copy (e.g. JSON) of the personal information we hold about you — contact our Privacy Officer at christopher@freedivefinder.com. Export requests are handled manually while an in-app self-serve export is being built; we will respond within 30 days of verifying your request.
8.2 Correcting Your Information
You can correct your personal information at any time through:
- Profile edits: Update your name, avatar, bio, city, and certifications
- Privacy setting changes: Toggle your Public Profile setting
If you believe any information we hold is inaccurate, incomplete, or out-of-date, contact us and we will take reasonable steps to correct it.
8.3 Response Timeframe
We will respond to access and correction requests within 30 days. If we refuse a request, we will provide written reasons and information about how to complain.
9. Complaints
9.1 How to Complain
If you believe we have mishandled your personal information, you can lodge a complaint by contacting us directly:
We will:
- Acknowledge your complaint within 7 business days
- Investigate and respond within 30 days
- Provide a written outcome with reasons
9.2 Escalation to the OAIC
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner:
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Email: enquiries@oaic.gov.au
- Post: GPO Box 5288, Sydney NSW 2001
10. Data Retention and Deletion
10.1 Retention
We retain your personal information for as long as your account is active or as needed to provide the App's services. Specific retention periods:
| Data Type | Retention Period |
|---|---|
| Account & profile data | Until account deletion |
| Dive session records | Until account deletion |
| Chat messages | Until account deletion |
| Notification delivery logs (§2.3) | Retained for service-operation and deduplication purposes; reviewed during periodic cleanup |
| Device tokens | Until deregistered (logout or token refresh) |
| Crash reports | As per Firebase Crashlytics retention (90 days) |
| Server-side cache | Temporary (5-minute TTL for profile/dive caches) |
| Rate-limit counters | Short-lived windows per tier; not linked to stored identifiers beyond the current window |
| Beta waitlist records (§2.6) | Retained while your waitlist signup is active; removed when you convert to a full account or when the waitlist is retired |
| Administrative audit log | Retained as an operational record of administrative actions; integrity of the log is preserved as a compliance and security control |
| Pending sign-up credentials (device) | Held locally under secure storage until verification completes or the verification token expires |
| On-device dive-log values (§2.7) | Retained on your device (in encrypted local storage) until you clear app data or delete the App |
| On-device query cache | Cleared on app uninstall or cache clear |
10.2 Deletion
You may request deletion of your account and associated personal information by contacting us at christopher@freedivefinder.com.
Upon deletion, we will:
- Remove your profile, dive participation records, chat messages, buddy connections, uploaded images, device tokens, and notification history
- Complete deletion within 30 days of your verified request
- Retain only such data as is required by law or for legitimate dispute resolution
You can delete your account directly from the App via Settings → Account → Delete My Account. You can also contact us at christopher@freedivefinder.com to request deletion if you cannot access the in-app flow.
11. Children and Minors
The App is intended for users aged 18 and over. Freediving is an inherently safety-critical activity requiring appropriate training and certification.
We do not knowingly collect personal information from children under the age of 18. If we become aware that we have inadvertently collected information from a child, we will take reasonable steps to delete it promptly.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at christopher@freedivefinder.com.
12. Notifiable Data Breaches
Under Part IIIC of the Privacy Act 1988 (Cth), we are required to notify the OAIC and affected individuals of eligible data breaches that are likely to result in serious harm.
If we become aware of a data breach, we will:
- Conduct a reasonable and expeditious assessment within 72 hours
- If serious harm is likely, notify the OAIC and affected individuals as soon as practicable
- Include in the notification: a description of the breach, the kinds of information involved, and recommendations about what individuals should do
We maintain a documented Data Breach Response Plan that sets out how we detect, contain, assess, and report eligible breaches. The plan is reviewed periodically and exercised through internal tabletop walkthroughs.
13. Cookies and Tracking Technologies
The App does not use cookies or web tracking technologies. We do not use advertising identifiers, cross-app tracking, or behavioural analytics.
Firebase Crashlytics collects crash diagnostics automatically. This is not used for advertising or user profiling.
14. Updates to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy within the App
- Updating the "Last Updated" date at the top of this document
- Where practicable, providing in-app notifications of significant changes
We encourage you to review this Policy periodically. Continued use of the App after changes constitutes acceptance of the updated Policy.
15. Applicable Law
This Privacy Policy is governed by the laws of Queensland, Australia, and the Privacy Act 1988 (Cth).
16. Contact Us
For privacy enquiries, access/correction requests, complaints, or data deletion requests:
- Privacy Officer: Freedive Finder
- Email: christopher@freedivefinder.com
- Website: https://freedivefinder.com
© 2026 Freedive Finder. All rights reserved.