This Privacy Policy describes how GoCoast ("we", "us", "our") collects, uses, discloses, stores, and protects your personal information when you use the GoCoast mobile and web application, including any related services, features, or content (collectively, the "Service").

We are committed to protecting your privacy and handling your personal information responsibly in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable to international users, we also have regard to the principles of the General Data Protection Regulation (GDPR).

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein. If you do not agree to this policy, you must not use the Service.

This policy should be read in conjunction with our Terms of Service, which govern your use of GoCoast.

GoCoast is operated by Fraser Lowe trading as GoCoast, based in Gold Coast, Queensland, Australia (the "Operator"). References to "GoCoast", "we", "us", or "our" in this policy refer to the Operator.

For privacy enquiries, requests, or complaints, you can contact us at:

We will respond to privacy requests within 30 days. For complex requests, we may require up to 60 days, and will notify you if additional time is needed.

We collect personal information in the following categories depending on how you use the Service. Not all categories apply to all users — for example, GPS ride data is only collected if you use the Ride Recording feature.

3.1 Account and Authentication Information

• Full name or display name
• Email address
• Password (stored as a salted cryptographic hash — we never store your raw password)
• Account creation date and last login timestamp
• Authentication provider (email/password or social login, if applicable)

3.2 Profile Information

• Username / handle
• Profile photo (optional)
• Bio or description (optional)
• Vessel type, size, and name (optional)
• Preferred riding regions
• Experience level and gear details (optional)
• Public profile settings and visibility preferences

3.3 Ride and Trip Data

• Trip plans you create, save, or share
• Ride log entries including destination, date, distance, and notes you enter
• GPS route data recorded during active sessions (see Section 4)
• Anchor spots and waypoints you save
• Boat ramp and food stop selections

3.4 Community and Social Data

• Posts, captions, and text you publish to the community feed
• Photos and videos you share publicly
• Likes and reactions you give to other users' content
• Comments you post
• Users you follow and users who follow you

3.5 Marketplace Data

• Listing title, description, price, and category
• Photos of listed items
• Contact method you choose to display (e.g. phone, email)
• Listing status (active, sold, removed)

3.6 AI Interaction Data (Skipper AI)

• Messages and queries you submit to the Skipper AI assistant (see Section 5)

3.7 Technical and Device Information

• Browser type and version
• Operating system and device type
• IP address (used transiently for security and rate limiting — not stored long-term)
• App version
• Session duration and page views (aggregated, not individually identified)
• Error logs (technical, non-personal)

3.8 Communications

• Emails or messages you send us directly
• Support requests and feedback submissions

3.9 Payment and Subscription Information

If you subscribe to GoCoast Pro, payment processing is handled entirely by our third-party payment processor. We do not receive or store your full credit card number, CVV, or raw bank account details. We receive confirmation of your subscription status, plan type, and billing period from the payment processor. See Section 12 for details of third-party processors.

When you use the GPS Ride Recording feature:

• During a session: Your GPS coordinates are sampled at regular intervals and stored temporarily in your device's local memory to draw your route on screen.
• If you save a ride: The completed route, total distance, duration, start time, and any notes you add are saved to your account on our servers (Supabase). This data is linked to your user account and visible to you in your Ride Log.
• If you discard a ride: The temporary GPS data is deleted from your device and never sent to our servers.
• Ride sharing: If you choose to share a recorded ride, the route summary may be visible to other users according to your profile visibility settings.
• We do not continuously track your location when the app is running in the background or when you are not actively recording.

Free-tier usage limits for GPS recording (where applicable) are enforced using per-device counters stored in your browser's local storage. These counters are not linked to your account on our servers and are not accessible to us.

The Skipper AI is an in-app assistant designed to help you plan trips, answer boating questions, and provide local knowledge. When you use Skipper AI:

• Your messages are transmitted to an AI language model provider to generate responses.
• We may use your region context (e.g. "Gold Coast") to provide more relevant answers. We do not transmit your name, email, or account ID to the AI provider by default.
• Conversations are not stored on our servers beyond the current session. When you close the Skipper chat, the conversation history is cleared.
• Free-tier usage counts for Skipper AI are tracked using a per-device counter stored in your browser's local storage. This counter is not linked to your user account and is not accessible to us remotely.
• Our AI provider processes queries subject to their own terms and privacy policy. We select providers who commit to not training on user inputs by default.

Do not include sensitive personal information (e.g. full name, address, phone number, financial details) in your Skipper AI queries. The AI is designed for boating and lifestyle queries only.

GoCoast includes a community feed where users can post updates, photos, and experiences. You should be aware of the following:

• Public by default: Content you post to the community feed is visible to all GoCoast users. Do not post content containing private personal information about yourself or others.
• Your display name and profile photo are displayed alongside your posts. Your email address is never shown publicly.
• Follow relationships: Your follower count and following count may be displayed on your profile. Your followers can see your public posts in their feed.
• Likes and reactions are attributed to your account. Other users may be able to see who liked their content.
• Removal: You can delete your own posts at any time. Deleted posts are removed from the feed immediately and permanently deleted from our database within 30 days.
• Moderation: We reserve the right to remove content that violates our Terms of Service. Content reported by users is reviewed and may be stored temporarily for moderation purposes.

Once content is posted publicly, other users may have seen or screenshotted it before it is deleted. We cannot guarantee the removal of copies held by third parties.

The GoCoast Marketplace allows users to list watercraft, equipment, and related items for sale. When you create a listing:

• Your listing details (title, description, price, photos, and any contact information you choose to include) are visible to all GoCoast users.
• Your display name is shown on your listing. Your email address is only shared with prospective buyers if you explicitly choose to include it in your listing.
• Listings you create are stored on our servers and remain active until you remove them or your account is deleted.
• You are solely responsible for the accuracy of information in your listings and any contact details you choose to disclose.

Do not include your home address or other sensitive personal information in listing descriptions. Use general area descriptions (e.g. "Gold Coast") for your location.

GoCoast uses location data in the following contexts:

8.1 Real-time location (non-stored)

Several features request your device's location for immediate, in-session use only:

• Finding your nearest boat ramp
• Centering the interactive map on your current position
• Estimating your distance from points of interest

For these features, your location coordinates are used on your device only and are not sent to our servers and not stored beyond the current session.

8.2 GPS Ride Recording (user-initiated, stored if saved)

See Section 4 for full details. Location data is only recorded and stored when you explicitly start a GPS recording session and choose to save it.

8.3 Map rendering

GoCoast uses Mapbox to render interactive maps. When you view the map, your approximate location (if you grant permission) or tile requests are sent to Mapbox's servers to load the appropriate map tiles. Mapbox's own privacy policy governs this data. See Section 12.

8.4 Location permissions

You can control location access through your device or browser settings at any time. Revoking location access may limit some features (e.g. "Find nearest ramp") but will not affect access to the majority of the app.

When you upload photos or videos to GoCoast (to your profile, community feed, or marketplace listings):

• EXIF metadata stripping: We automatically remove EXIF metadata from images before they are stored and served. This includes GPS coordinates, device model, and timestamp data that may be embedded in photos taken on smartphones. This protects your privacy by ensuring your uploaded photos cannot reveal your precise location or device identity.
• Storage: Uploaded media is stored on Supabase Storage, which is hosted in the United States. See Section 13 regarding overseas data transfers.
• Public visibility: Media uploaded to your profile or the community feed is publicly accessible. Do not upload photos that reveal sensitive personal information about yourself or others without their consent.
• Deletion: When you delete a post or listing, associated media files are queued for deletion from storage. Complete removal from storage typically occurs within 30 days.
• Content moderation: We reserve the right to remove media that violates our Terms of Service, including illegal content, content that endangers safety, or content involving minors.

10.1 Local Storage (browser-side)

GoCoast uses your browser's local storage (not cookies) to store certain data locally on your device. This data is stored on your device only and is not transmitted to our servers unless explicitly stated. Local storage data we use includes:

10.2 Cookies

GoCoast does not currently use tracking cookies or advertising cookies. Authentication state is managed via Supabase session tokens stored in local storage. Cloudflare, as our hosting and security provider, may set security cookies (such as challenge tokens for bot protection) on your device. These are strictly necessary for service delivery and security, and are governed by Cloudflare's privacy policy.

10.3 Clearing local storage

You can clear local storage at any time through your browser or device settings. Clearing local storage will log you out of GoCoast and reset any per-device usage counts. It will not delete data saved to your account on our servers.

We use the personal information we collect for the following purposes:

11.1 Providing and operating the Service

• Creating and managing your account
• Enabling you to plan trips, log rides, follow other users, and use all app features
• Displaying your content to other users according to your privacy settings
• Processing subscriptions and managing access to GoCoast Pro features

11.2 Communications

• Sending account verification and password reset emails
• Notifying you of important changes to the Service or this policy
• Responding to your support requests and enquiries
• Sending marketing and promotional communications where you have consented (see Section 18)

11.3 Safety and security

• Detecting and preventing fraudulent, abusive, or illegal activity
• Enforcing our Terms of Service
• Monitoring for and responding to data security incidents
• Rate limiting and bot protection

11.4 Improving the Service

• Analysing aggregated and anonymised usage data to understand how features are used
• Diagnosing and fixing technical errors
• Developing new features and improving existing ones

11.5 Legal compliance

• Complying with applicable Australian and international laws and regulations
• Responding to lawful requests from law enforcement or government agencies
• Establishing, exercising, or defending legal claims

We will not use your personal information for any purpose that is incompatible with the purposes described above without first obtaining your consent, except where permitted or required by law.

We engage the following third-party service providers to operate GoCoast. Each provider is given access only to the data necessary to perform their specific service. We take reasonable steps to ensure our providers handle your data securely and in accordance with applicable privacy laws.

We do not sell your personal information to any third party. We do not use advertising networks or share data with advertisers. We do not allow third-party service providers to use your data for their own commercial purposes beyond what is necessary to provide their contracted services to us.

In the event of a business acquisition, merger, or sale of substantially all our assets, your personal information may be transferred to the acquiring entity. We will notify you of any such transfer via a notice within the app and at the email address on your account.

GoCoast is an Australian service and we endeavour to keep your data in Australia wherever practical. However, due to the nature of cloud infrastructure, some of your personal information is transferred to and stored in overseas countries, primarily the United States, as outlined in Section 12.

Where personal information is disclosed to overseas recipients, we take the following steps to protect your privacy:

• We only engage providers who maintain industry-standard security certifications (e.g. SOC 2, ISO 27001) and commit to data protection obligations in their terms of service.
• Supabase, as our primary data processor, is compliant with SOC 2 Type II and operates under data processing agreements that impose obligations consistent with Australian and international privacy standards.
• Cloudflare maintains robust security standards including SOC 2, ISO 27001, and GDPR compliance programs.
• Mapbox processes location and map interaction data subject to its own privacy policy and data processing agreements.

By using GoCoast, you acknowledge and consent to your personal information being transferred to and stored in the United States and other countries in which our service providers operate. These countries may have different privacy laws than Australia. We take reasonable steps to ensure your information continues to be protected consistently with this policy and applicable Australian law.

The Service involves water activities and marine environments that carry inherent safety risks, and is designed for use by adults or minors aged 16 and over. We do not knowingly collect personal information from children under 16 without verifiable parental or guardian consent.

If you are a parent or guardian and you believe your child under 16 has provided us with personal information without your consent, please contact us immediately at frlo7136@gmail.com. If we become aware that we have collected personal information from a child under 16 without appropriate consent, we will take steps to promptly delete that information from our systems.

Users who create an account represent that they are 16 years of age or older, or have obtained verifiable parental or guardian consent. We reserve the right to terminate accounts where we have reason to believe the user is under 16 and consent has not been provided.

We take data security seriously and implement a range of technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction. Our security practices include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS). We do not serve any content over unencrypted HTTP.
• Encryption at rest: Data stored in Supabase is encrypted at rest using AES-256 encryption.
• Password security: Passwords are never stored in plain text. They are hashed using industry-standard algorithms via Supabase Auth before storage.
• Row-level security (RLS): Our database enforces row-level security policies, ensuring that authenticated users can only access their own private data — not data belonging to other users — at the database level.
• Rate limiting: API endpoints are rate-limited to prevent brute-force attacks and automated abuse.
• Bot protection: Cloudflare's security layer provides protection against malicious bots and DDoS attacks at the network level.
• Access control: Administrative access to production data is restricted to the minimum personnel required to operate the service.
• Dependency management: We monitor and update third-party dependencies to address known security vulnerabilities.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your information. You are also responsible for maintaining the security of your account credentials and should not share your password with anyone. If you suspect your account has been compromised, contact us immediately at frlo7136@gmail.com and change your password immediately.

We retain your personal information only for as long as is necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

When retention periods expire, data is securely deleted or irreversibly anonymised. You may request early deletion of your data at any time by deleting your account (see Section 22) or by contacting us at frlo7136@gmail.com.

Under the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles, you have the following rights in relation to your personal information:

17.1 Right to access
You have the right to request access to the personal information we hold about you. We will respond to access requests within 30 days. We will provide the information in a commonly used electronic format unless another format is agreed. We do not charge a fee for access requests unless they are manifestly unfounded or excessive.

17.2 Right to correction
If you believe any personal information we hold about you is inaccurate, incomplete, out of date, irrelevant, or misleading, you have the right to request that we correct it. You can update most profile information directly in the app. For corrections to other data, contact us at frlo7136@gmail.com.

17.3 Right to deletion (erasure)
You have the right to request deletion of your personal information. You can delete your account and all associated data at any time through the app (see Section 22). For specific data deletion requests without full account deletion, contact us directly.

17.4 Right to restrict processing
In certain circumstances, you may request that we restrict the processing of your personal information (for example, while you contest its accuracy). We will comply unless we have a legitimate legal basis to continue processing.

17.5 Right to data portability
You can request a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format. Contact us at frlo7136@gmail.com to make this request.

17.6 Right to object
You have the right to object to the processing of your personal information for direct marketing purposes at any time. See Section 18 for marketing opt-out options.

17.7 Right to complain
If you believe we have breached the Australian Privacy Principles, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC). See Section 23 for details.

To exercise any of these rights, contact us at frlo7136@gmail.com. We may need to verify your identity before processing your request. We will not discriminate against you for exercising any of your privacy rights.

We may send you marketing or promotional communications about GoCoast features, updates, special offers, or partner promotions only where you have provided explicit consent, in accordance with the Spam Act 2003 (Cth).

You may opt out of marketing emails at any time by:

• Clicking the "Unsubscribe" link in any marketing email we send you; or
• Contacting us at frlo7136@gmail.com with a request to be removed from marketing communications.

Even if you opt out of marketing communications, we will still send you transactional and account-related emails that are necessary for the operation of your account, including:

• Email verification and password reset emails
• Subscription receipts and billing notifications
• Important security alerts
• Material changes to this Privacy Policy or our Terms of Service

We do not sell, rent, or share your email address with third parties for their own marketing purposes.

GoCoast is operated from Australia and is primarily designed for Australian users. If you access GoCoast from outside Australia, you do so voluntarily and your personal information will be transferred to and processed in Australia and the countries described in Section 13.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland: To the extent that any EU General Data Protection Regulation (GDPR) or UK GDPR obligations apply to our processing of your data, we acknowledge your rights under those frameworks, including rights to access, rectification, erasure, restriction, portability, and to object to processing. Your lawful basis for processing is generally your consent (given when you create an account) or the performance of a contract (your use of the Service). Contact us at frlo7136@gmail.com to exercise any GDPR rights.

We cannot guarantee that the laws of the country from which you access GoCoast provide a level of data protection equivalent to Australia. By using the Service, you consent to your information being processed in Australia and the United States as described in this policy.

In the event of a data breach that is likely to result in serious harm to you, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

Our breach response process includes:

• Containment: Immediately containing the breach to prevent further unauthorised access or disclosure.
• Assessment: Assessing the nature and scope of the breach, and the information and individuals affected.
• Notification: If we determine that the breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals within 30 days of becoming aware of the breach, or as soon as practicable.
• Notification content: Where required, affected individuals will be notified of the nature of the breach, the types of information involved, recommended steps they should take to protect themselves, and how to contact us with questions.
• Remediation: Taking steps to prevent similar breaches in the future.

If you believe your GoCoast account or personal information has been compromised, please contact us immediately at frlo7136@gmail.com.

You can view and update most of your personal information directly within the GoCoast app:

• Profile information (display name, handle, bio, vessel details, profile photo): Go to Profile → Edit Profile
• Email address and password: Go to Settings → Account
• Ride logs: View, edit notes on, or delete individual ride entries from the Ride Log section
• Community posts: Delete your own posts by pressing and holding or using the post menu
• Marketplace listings: Edit or remove your listings from the Marketplace section

For information that cannot be updated through the app, or to request a full copy of all personal information we hold about you, contact us at frlo7136@gmail.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.

If we are unable to give you access to the information you request, we will tell you why (subject to any legal restrictions on disclosure) and outline any alternative process available to you.

You can permanently delete your GoCoast account and all associated personal information by navigating to Settings → Account → Delete Account within the app.

Upon account deletion:

• Your profile, ride logs, community posts, marketplace listings, follows, and all other account-linked data are marked for permanent deletion.
• Your account will be immediately inaccessible and you will be logged out.
• Personal data is permanently deleted from our active databases within 30 days.
• Anonymised, aggregated data (which cannot be linked back to you) may be retained indefinitely for analytics purposes.
• We may retain certain information for longer periods where required by law (e.g. financial records for tax purposes) or to resolve disputes or enforce our agreements.
• Content that other users have already seen, shared, or copied cannot be recalled after deletion.

If you have an active GoCoast Pro subscription, ensure you cancel your subscription before deleting your account to avoid further billing. Account deletion does not automatically cancel subscriptions managed through third-party app stores or payment processors.

If you encounter difficulties deleting your account, contact us at frlo7136@gmail.com and we will assist you.

If you believe that we have handled your personal information in a manner that does not comply with the Australian Privacy Act 1988 (Cth) or Australian Privacy Principles, we encourage you to contact us first so that we have the opportunity to resolve your concern.

Step 1 — Contact GoCoast directly:

Step 2 — If you are not satisfied with our response:

If you are not satisfied with how we handle your complaint, you may escalate it to the Office of the Australian Information Commissioner (OAIC):

For EEA/UK users, you may also lodge a complaint with the relevant supervisory authority in your country of residence.

We may update this Privacy Policy from time to time to reflect changes to our practices, the features of the Service, or applicable laws. When we make changes, we will:

• Update the "Last updated" date at the top of this policy;
• Post a notice within the GoCoast app for material changes; and
• Where required by law, seek your renewed consent before processing your personal information under the updated terms.

We encourage you to review this policy periodically. Your continued use of GoCoast after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated policy, you must stop using the Service and may request deletion of your account.

For significant changes that materially affect how we use your data — such as introducing a new data sharing partner, a new purpose for processing, or changes to your rights — we will provide at least 30 days' advance notice before the changes take effect.

For any questions, concerns, requests, or complaints about this Privacy Policy or the way we handle your personal information, please contact us:

We aim to respond to all privacy enquiries within 5 business days and to resolve requests within 30 days. For complex requests, we may notify you that additional time (up to 60 days) is required.

When contacting us about a privacy request, please include:

• Your full name and GoCoast account email address (so we can verify your identity)
• A clear description of your request or concern
• Any relevant reference numbers or dates if applicable