Privacy Policy
This policy explains what data Setto uses, why, and what you can do about it. Setto is built to keep as little as possible: by default, your sessions stay on your phone.
Who is responsible
Luís Belo (Setto), Portugal. Contact for anything privacy related: setto.surf@gmail.com.
What data we use
- Surf sessions: timed GPS positions (recorded by the watch or phone app, or imported by you from GPX, TCX or FIT files). From them we calculate your waves: count, length, duration and speed.
- Watch sensors: while recording, a per-second summary of the accelerometer and gyroscope, used to improve wave detection.
- Health Connect, only if you allow it: we read your workouts (type, start and end, title and the GPS route of the sessions you choose to import) and write Setto sessions as surfing workouts, with route and waves. You can revoke this at any time in Health Connect settings.
- Profile (optional): username, country, photo and app preferences.
- Account (optional, when available): if you sign in with Google, we receive your identifier, email and name to create the account.
- Strava (optional, when available): if you connect Strava, we store the access authorisation and read your surf activities to count the waves; if you allow it, we send Setto sessions to Strava or add the waves to the activity description.
Why we use it
Only to make Setto work: counting and showing your waves, the map and 3D view, records, the sea conditions of each session, the forecast for your spots, the leaderboard (if you choose to appear) and syncing with the services you connect. The legal basis is providing the service you ask for and, for Health Connect, Strava and the public leaderboard, your consent, which you can withdraw at any time.
Where it is stored
- On your phone, by default. Sessions recorded on the watch go straight to the phone over the Wear OS connection.
- In your account, if you create one: sessions and profile are stored in Google Firebase (Google Cloud), on servers in the European Union (Belgium), so you can see them on other devices.
External services the app contacts
To show some information, the app requests data from public services. They receive the beach area (approximate coordinates) and the request's IP address, but not your name or your sessions:
- Open-Meteo: forecast and sea conditions (swell, wind and tide).
- OpenStreetMap (Nominatim and Overpass): beach and town names.
- Esri: satellite map imagery.
- Google Play: Setto Plus purchases and subscriptions. We never see your card details.
Website statistics
On settosurf.com we count visits without cookies. We only keep daily totals: the page viewed, the referring site, the browser language and the device type. To count unique visitors we use an irreversible digest of the IP address and browser that changes every day; the IP address is not stored. If your browser sends "Do Not Track", the visit is not counted.
Sharing
We do not sell your data, use it for advertising or use it to train artificial intelligence models. The app has no ads and no third-party analytics. The leaderboard only shows what you choose to make public: username, country, photo and your totals and records. Sessions and routes are never public.
How long
Sessions are kept until you delete them in the app or uninstall it. If you have an account you can delete it; server data is deleted within 30 days. If you disconnect Strava, we delete the access authorisation immediately.
Your rights
You can access, correct, delete, restrict, object to and port your data (in the app you can export each session as GPX). For any request, write to setto.surf@gmail.com. You can also complain to your data protection authority; in Portugal, the CNPD.
Children
Setto is not intended for children under 16 and does not knowingly collect their data.
Changes
If this policy changes, we publish the new version here with an updated date and, for important changes, let you know in the app.