Sendoa Privacy Policy
Version 1.0, effective 5 September 2026
This policy applies to the Sendoa app and the sendoa.app website, in every country where Sendoa is offered: France, the United States, the United Kingdom, Australia, South Africa and Spain. Country-specific rules are set out in section 14.
In short
- No account, no advertising, no usage analytics, no trackers, no location tracking.
- Your profile, favourites and secret spots stay on your iPhone. We have no access to them.
- We receive personal data in three cases only, all at your initiative: when you send feedback on an answer, when you ask us to add a spot, and when you write to us.
- We do not sell, rent or share any data, and we do no targeted advertising.
1. Who is responsible
The data controller is Makkr, a French SAS with a share capital of 5,000 euros, 47 rue Vivienne, 75002 Paris, France, Paris Trade and Companies Register 108 153 446, publisher of Sendoa.
Contact for any question about your data: [email protected]. Makkr has not appointed a data protection officer, as this is not required for its activity.
2. What stays on your iPhone
The following data is stored on your iPhone and is never sent to us:
- your settings (language, units, favourite spots and ports);
- your surf profile (board, level, maximum wave size, preferences);
- your secret spots (name, position, characteristics), in a file protected by iOS encryption;
- your phone's region code (for example FR), used for display;
- cached forecasts and pending submissions (sections 3.3 and 3.4).
The widgets read this data on the phone and make no network calls.
This data is included in your iPhone backups (iCloud or computer), which are governed by Apple. It stays on your phone until you delete the app, which erases it. You can also delete a secret spot, a favourite or a port from within the app.
3. What the app sends, and why
3.1 Forecasts for catalogue spots
To show swell and wind for a spot, the app queries our gateway with the spot identifier (for example "la-torche"). If the gateway does not know that spot yet, the app sends its public coordinates instead, rounded to about 1 km. No device identifier and no profile are sent.
Like any web server, our gateway, hosted by Cloudflare, receives your IP address. We use it only in memory, to limit the number of requests and protect the service; we do not store it. As hosting provider, Cloudflare processes IP addresses to route requests and secure its network, under its own policy.
The gateway obtains forecasts from Open-Meteo using only the public coordinates of the spot. Open-Meteo receives no data about you.
3.2 Forecasts for secret spots
For a secret spot, the app sends only its position rounded to one hundredth of a degree, a cell of about 1 km. Neither its name, nor its exact position, nor any identifier leaves your phone. The forecast for that cell is kept for 30 minutes in our hosting provider's cache, with no link to you. Open-Meteo receives the same rounded cell.
You place your secret spots by hand on an Apple map: the app uses neither GPS nor your phone's location. To display the map, your iPhone downloads map images from Apple, under Apple's privacy policy.
3.3 Feedback on an answer
If you choose to send feedback ("Right" or "Off"), the app sends us:
- an installation identifier: a random code created the first time you open the app. It contains no information about you or your device, but it links together the feedback and requests sent from the same phone. You can see it in the app's settings;
- the spot, the date, Sendoa's answer and your assessment, with the tags you chose;
- your comment, if you write one (500 characters at most);
- the day's conditions (swell height, period and direction, wind, tide, score);
- your surf profile;
- the app version and language.
We do not receive your name, e-mail address or location. This data is pseudonymous, not anonymous: please do not write anything in your comment that could identify you or anyone else.
Why. To check and improve the accuracy of answers and correct spot descriptions.
Legal basis. Our legitimate interest in improving Sendoa's reliability (Article 6(1)(f) GDPR). Sending feedback is optional and you can object at any time (section 9).
Recipients. Makkr; Cloudflare, which hosts the database; Resend, which e-mails us a summary of negative feedback, including comments.
Retention. The installation identifier and the comment are erased 12 months after the feedback is received. The remaining data (conditions, score, tags, profile) can then no longer be linked to anyone; we keep it to calibrate the score. If sending fails, the feedback waits on your phone and is erased after 30 days.
3.4 Request to add a spot
If you ask us to add a spot ("My spot isn't there"), the app sends us:
- your e-mail address, which we need to reply to you;
- the spot name, the place and, if you provide them, directions to find it;
- if you place it, the position of the pin on the map: this is the position of the spot you choose, not your own;
- the installation identifier (section 3.3), the app version and language.
Why. To reply to you about this spot and expand the catalogue. Your e-mail address is used only to reply to you about this spot: no newsletter, no marketing.
Legal basis. Handling your request as part of your use of Sendoa (Article 6(1)(b) GDPR).
Recipients. Makkr; Cloudflare, which hosts the database; Resend, which e-mails us each request, including your e-mail address and the pin position.
Retention. 12 months at most after the request is received. If sending fails, the request waits on your phone and is erased after 30 days.
3.5 Purchases
Purchases of the app and of the Secret spots option are handled by Apple. Makkr receives neither your name, nor your e-mail address, nor your payment details: only aggregated sales figures. Your purchase is verified on your phone, without going through our servers. Apple's privacy policy applies.
3.6 Usage analytics
None. The app does not measure what you do and contains no audience measurement, advertising or tracking tool. If this ever changes, this policy will be updated beforehand and measurement will be off by default.
4. When you write to us
Messages sent to [email protected] are hosted by Infomaniak Network SA, in Switzerland. We use them to reply to you (legal basis: our legitimate interest in answering people who contact us, or our legal obligations for requests about your rights) and keep them for one year after the last exchange.
5. The sendoa.app website
The website uses no cookies, no local storage, no audience measurement, no pixels and no forms. It is hosted by Cloudflare, which processes visitors' IP addresses to serve pages and secure its network. Fonts are served from the website itself: no call is made to any third-party service.
6. Who processes your data for us
| Provider | Role | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of the website, gateway and database | IP addresses in transit, feedback and spot requests | United States and global network |
| Resend, Inc. | Sending notification e-mails to Makkr | E-mail address and pin position of spot requests, feedback comments | European Union (Ireland) |
| Infomaniak Network SA | [email protected] mailbox | Content of your messages | Switzerland |
Open-Meteo, our forecast supplier, receives no data about you. Apple acts on its own behalf for app sales, maps and backups.
There are no other recipients: no advertising network, no data broker, no resale.
7. International transfers
Makkr processes your data in France. Cloudflare and Resend are US companies: your data may therefore be processed in the United States and, for Cloudflare, in the countries of its network, whatever your country of residence. Transfers from the European Union and the United Kingdom to these providers are covered by the European Commission's standard contractual clauses and the UK Addendum included in their data processing agreements and, for Cloudflare, by its certification under the EU-US Data Privacy Framework and its UK Extension. Infomaniak is established in Switzerland, a country the European Commission recognises as providing an adequate level of protection. You can obtain a copy by writing to [email protected].
8. Retention periods
| Data | Period |
|---|---|
| Local data (settings, profile, secret spots) | On your iPhone, until the app is deleted |
| Feedback: installation identifier and comment | 12 months after receipt |
| Feedback: conditions, score, tags, profile | Kept in a form that cannot be linked to a person |
| Spot requests | 12 months at most after receipt |
| Pending submissions on the phone | 30 days |
| Notification e-mails received by Makkr | Same period as the corresponding data |
| Messages sent to [email protected] | One year after the last exchange |
| IP addresses processed by Cloudflare | Under Cloudflare's policy; Makkr does not store them |
9. Your rights
Wherever you live, you can ask to access, correct or erase your data, restrict or object to its processing, and receive it in a portable format. In France, you can also give instructions on what should happen to your data after your death.
To exercise these rights, write to [email protected]:
- for a spot request, give the e-mail address you used;
- for feedback, since we know neither your name nor your e-mail address, include the installation identifier shown in the app's settings. Failing that, give the spot and the date of the feedback.
We reply within one month. Your local data is entirely under your control: deleting the app erases it.
If you believe your rights have not been respected, you can contact the competent authority in your country (section 14).
10. Security
Exchanges between the app and our gateway are encrypted (HTTPS). Secret spots are stored with iOS file protection. Access to feedback and spot requests is restricted to Makkr. We keep the data we receive to the strict minimum.
11. Minors
Sendoa collects no data specific to minors and is not directed at children. Before sending a spot request with your e-mail address, ask a parent if you are under 15 in France, 13 in the United States, the United Kingdom or Australia, 18 in South Africa, or 14 in Spain. If we learn that a request was sent without that consent, we delete it.
12. No profiling
Sendoa's answer is calculated on your phone from your profile. It has no legal effect and is not shared with anyone. We do no profiling and make no automated decisions about you.
13. Changes
The version and effective date appear at the top of this policy. If we make a significant change, we will inform you in the app or on sendoa.app before it takes effect.
This policy is available in French, English and Spanish. The French version is the reference version. In case of discrepancy, the interpretation most favourable to you applies.
14. Country-specific information
France
The GDPR and the French Data Protection Act apply. Supervisory authority: the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr).
United States
- Data collected and recipients: sections 3 to 6. We do not sell or share personal information as defined by state privacy laws, including the California Consumer Privacy Act, and we do no targeted advertising.
- Wherever you live in the United States, you can ask to access, correct or delete your data at [email protected]. We will not treat you differently for exercising these rights.
- Do Not Track: the app and the website do not track your activity, on Sendoa or elsewhere, so there is nothing for us to change in response to this signal.
- Children: Sendoa is not directed at children under 13 and we do not knowingly collect personal information from them. If a parent believes their child has sent us an e-mail address, they can write to us and we will delete it.
- Changes: section 13.
- If you have a concern, you may contact your state Attorney General or the Federal Trade Commission (ftc.gov).
United Kingdom
The UK GDPR and the Data Protection Act 2018 apply: you have the rights set out in section 9, on the same legal bases. Supervisory authority: the Information Commissioner's Office (ico.org.uk).
Australia
We apply the Australian Privacy Principles of the Privacy Act 1988. Your data is held outside Australia, in France and the United States, by Makkr and the providers listed in section 6. You can ask to access or correct your data at [email protected]. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
South Africa
To the extent the Protection of Personal Information Act 4 of 2013 (POPIA) applies to our processing, Makkr is the responsible party; its information officer is Jean Dubearnes, President of Makkr, reachable at [email protected]. You have the rights set out in section 9. Transfers outside South Africa are made to countries or providers offering adequate protection, in accordance with section 72 of POPIA. Supervisory authority: the Information Regulator (inforegulator.org.za).
Spain
The GDPR and Organic Law 3/2018 (LOPDGDD) apply. Supervisory authority: the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid (aepd.es). This policy is available in Spanish at sendoa.app/es/privacidad.