Privacy
brrreaks is a surf forecast for Sweden's coasts, run by one person. The map, the forecasts and the built-in spots need no account, and nothing about you is stored for them. An account lets you save your own spots and log sessions. There are no cookies, no analytics, no advertising and no tracking. This page says what is stored, why, for how long, and how to have it deleted.
Who is responsible
brrreaks is run by a private individual in Sweden, who is responsible for the personal data described here. Contact: hello@brrr.se.
What is stored, and why
| Your account | Your email address, and your password as a one-way hash: it cannot be read back, by anyone. Used to sign you in, to send a password reset link when you ask for one, and to keep your spots and sessions yours. With it, your settings: the wave model shown and the units. |
|---|---|
| Your spots | The name, position, facing and photo framing of each spot you add, where its forecast is read (a point of the wave model's sea near it), and which spots you have starred as favourites, in your order. The wave period forecast at that sea point, and the weather forecast at the spot's position, are kept in our forecast archive for a year, linked to no one. |
| Your sessions | The date, time and length of each session, your rating and note, and the forecast conditions looked up for those hours. |
| Server logs | Each request to the site: time, page or data asked for, result, size, the page that linked here, browser type, and your IP address shortened to its network (the last part of an IPv4 address removed; an IPv6 address cut to its first three groups). Requests the server refuses or fails on are logged with the full address. The account service keeps its own log of requests, without any address. Used to keep the site running and to stop abuse. |
| Your location | Only when you press the map's locate button: your browser asks you, then gives the page your rough position once. The map moves there and forgets it. It is never stored or sent to us. |
| In your browser | Your sign-in token, your theme and a few view choices, the site's own files, and cached map tiles and forecast data, so the site loads faster and opens without a connection. These stay on your device. |
| Mail to hello@brrr.se | Your address and what you write, kept as long as the conversation needs. |
Legal basis
- Your account, spots and sessions: to provide the service you signed up for (GDPR Article 6(1)(b)).
- Server logs, and the bot check below: our legitimate interest in keeping the site secure and working (Article 6(1)(f)).
- Mail: answering you (Article 6(1)(f)).
An email address is needed to have an account; without one you can still use everything except your own spots and sessions. The sign-in token and the cached data in your browser are strictly necessary for what you asked the site to do, so no consent banner is needed.
Who else handles it
- netcup GmbH, Germany hosts the server where your data and the logs are stored.
- Backblaze, Inc. keeps a weekly backup in its EU region (Amsterdam), encrypted on our server before it leaves, with a key Backblaze does not have: it cannot read it. Backblaze is in the United States and certified under the EU–US Data Privacy Framework.
- Brevo (Sendinblue SAS), France delivers the password reset mail to your address, and nothing else.
- Cloudflare, Inc. runs Turnstile, the check that you are not a program, when you create an account or ask for a reset link. For that check it sees your IP address and details of your browser; nothing about your spots or sessions. Cloudflare is in the United States and certified under the EU–US Data Privacy Framework. It also forwards mail sent to hello@brrr.se to the owner's inbox.
Forecasts, observations, maps and aerial photos come from MET Norway, the Finnish Meteorological Institute, the Danish Meteorological Institute, the German Weather Service (DWD), SMHI, Copernicus Marine, Lantmäteriet and EMODnet. Our server asks them on your behalf: they see our server and the place being looked at, never your address or who you are. The map itself (OpenStreetMap), the page's fonts and its map library are served from brrr.se itself.
Nothing is sold or shared for marketing.
How long it is kept
- Account, spots and sessions: until you delete them or your account. Deleting is immediate; the server's nightly backups hold a copy for up to 7 more days, and the encrypted weekly copy for up to 4 weeks.
- A password reset link: 30 minutes, and once.
- Server logs: 14 days; the account service's log, 7 days.
- In your browser: your sign-in until you sign out; the rest until you clear this site's data.
Your rights
You can ask for a copy of your data, including as a file to take elsewhere; have it corrected; have it deleted; have its use restricted; and object to how it is used. In the account menu, Download my data saves your spots, favourites and sessions as a file, and Delete account removes your account, spots and sessions at once. For anything else, write to hello@brrr.se; you will get an answer within a month.
If you think your data is mishandled, you can complain to the Swedish Authority for Privacy Protection (IMY).
Children
brrreaks is not meant for children under 13, and accounts should not be created for them.
Changes
When this page changes, the date at the top changes with it.