1. Controller
The controller for the processing described here is:
Jan Brinkman, Thorner Strasse 12, 51469 Bergisch Gladbach, Germany
E-mail: support@mywatersessions.com
2. What data we process
Account: username, e-mail address and password. The password is stored only as a salted hash (PBKDF2-HMAC-SHA256) – we never know it in plain text. Optionally weight and height, which are used only for recommendations (e.g. sail size) and for the fun rankings.
Session and performance data: for each session we store the date, sport, spot, gear (board, sail/kite/wing, fin) and the values we compute – among them top speed over 2 s and 30 s, best 500 m and nautical mile, avg 5×10, Alpha 500, longest run, total distance, duration and active time, jumps and airtime, paddle strokes – plus the weather that matched the session (wind, gusts, wind direction, temperature) and an internal plausibility score used to keep clearly impossible values out of the rankings.
GPS data: the file you upload, or the session your watch sends, contains GPS points (a thinned route). This route is stored and used to compute your values and to draw the map in your personal area.
Only a short section of it becomes public: on the Live page and on Spot-TV we show the map of the fastest stretch of a session (in the order of 500 m). The complete route is never shown publicly, so neither where you started nor where you parked can be seen. You can delete your sessions including their track at any time under “Delete account & data”.
Watch link: to attribute sessions from your watch we store a random device identifier (a token or a short connect code).
Safety check-in (optional): if you switch the check-in on, we store the emergency e-mail address you enter, the time you expect to be back and the spot, and we send an e-mail to that address if you are overdue. Please only enter addresses whose owner agrees to this – it is another person's data. The entry can be deleted at any time.
Spot photos and ratings: if you upload a spot photo or rate a spot, we store it together with your username; photos are shown publicly in the spot gallery. Please upload only your own, suitable photos, to which you hold the rights. We may remove unsuitable images at any time, and we delete your uploads on request.
Contact form: your message and, if given, your name and e-mail address so that we can reply.
Guest entry: the QR code on Spot-TV lets people take part without an account. We then store the name entered and the values from the uploaded file. Please do not enter a name under which you do not wish to appear publicly.
3. What is publicly visible
MyWaterSessions is a community leaderboard, and part of its content is visible without an account and to search engines. Public are: username, date, spot, sport, gear, the speed and distance values and the weather, plus the short map section described above. This applies to the rankings, the spot pages, the Live page, the record overview and Spot-TV.
In private groups, results are visible only to confirmed members. If you prefer not to appear publicly, use a username unconnected to your identity, or delete your sessions or your account.
4. Purposes and legal bases
- Account and sign-in to provide the service – Art. 6 (1) (b) GDPR (performance of a contract).
- Publishing your results in the rankings and on the public pages – Art. 6 (1) (a) GDPR (consent, given at registration and withdrawable at any time with effect for the future).
- Safety check-in – Art. 6 (1) (a) GDPR (consent; the feature is optional and switched on individually).
- Operation, security and abuse prevention, including the plausibility check of sessions – Art. 6 (1) (f) GDPR (legitimate interest in a leaderboard that cannot be gamed).
5. Cookies, measurement and advertising
If you tick “Stay signed in” at login, we store one functionally necessary
cookie (surf_auth) holding a random sign-in token. Without that
option no cookies are set.
For audience measurement we use Cloudflare Web Analytics (Cloudflare, Inc.). The service works without cookies and without cross-device recognition; what is collected is aggregated information such as the page viewed, the referrer and technical parameters.
Spot pages and Spot-TV may show sponsor logos and product listings. There is no personalised ad tracking and no profiling.
6. Hosting and database
Website and application run at Render Services, Inc. (USA), the database at Neon, Inc. (USA), with Cloudflare, Inc. (USA) in front for delivery and protection of the domains. Connection data (e.g. IP address) is technically necessarily processed, including in the USA. Transfers are based on the EU standard contractual clauses and/or the EU-US Data Privacy Framework.
7. Third-party services
When certain features are used, data is transmitted to the following providers – usually your IP address, in some cases coordinates:
- Open-Meteo – weather and forecast; the spot's coordinates are transmitted.
- OpenStreetMap (map tiles) and Esri (satellite imagery) – map display; your browser fetches the image tiles directly from them.
- unpkg – delivery of the map library.
- Nominatim (OpenStreetMap) – deriving a place name from coordinates for newly created spots.
- is-on-water – checking whether coordinates are on water (plausibility check); single coordinates are transmitted, with no account reference.
- Anthropic – generating spot descriptions from spot and weather information; no account data is transmitted.
- Resend (Resend, Inc., USA) – sending the account e-mails: the registration confirmation and, when you change your e-mail address, the confirmation to the new address and the security notice to the old one. Recipient address and message content are transmitted.
- Brevo (Brevo SAS, France) – sending the safety check-in e-mails. The emergency address you entered and the message content are transmitted.
- Polar – only if you explicitly connect your Polar account: exchange of access tokens and import of your activities.
- Webcams – on some spot pages we embed the live image of the respective operator. Loading it gives that operator your IP address. We have no influence over this content.
8. Retention
We keep account, session and group data until you delete your account or the individual entries, or ask us to delete them.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw consent with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.
To exercise your rights or delete your account, an informal message to support@mywatersessions.com is enough. When signed in you can also remove your account and all related data yourself under “Delete account & data”.
Last updated: August 2026. This policy is amended whenever our processing changes.