Privacy Policy

1. Data controller

The controller of personal data collected through BlueAtlas™ is BlueAtlas ("we", "us"). For any question about this policy or your data, write to privacy@blueatlas.app.

BlueAtlas™ is a digital dive logbook for recreational scuba divers and freedivers. We only process the data needed to provide the service.

2. Data we collect

Account data

• Email address (account creation, transactional emails, waitlist).
• Display name and avatar (if you set them).
• Preferences (language, visibility settings, PRO subscription).
• Strava access and refresh tokens, encrypted, if you link your Strava account (see "Services you connect").

Dive data

• Imported dive profile files (.fit, .uddf, .ssrf, .json) and their content (depth, duration, temperature, site geolocation when present).
• Underwater photos and videos attached to each dive.
• Annotations, descriptions, buddy groups, tagged friends.

Technical data

• Server logs (IP address, user-agent, timestamps) for security and error diagnostics.
• Anonymous session id for aggregate audience measurement (Vercel Analytics, Vercel Speed Insights).
• Crash reports and performance measurements from the mobile app (Sentry): the error trace, the screen involved, device model, OS and app version. Never your photos or your dive files.

3. Purposes and legal bases

• Provide the service (store your logbook, parse your files, social sharing) — legal basis: contract performance (Art. 6.1.b GDPR).
• Send transactional emails (confirmation, password reset, opt-in notifications) — contract performance.
• Waitlist (one email at launch) — explicit consent collected on the landing page (Art. 6.1.a GDPR). Unsubscribe in one click.
• Security and anti-abuse (Cloudflare Turnstile, spam detection, audit logs) — legitimate interest (Art. 6.1.f GDPR).
• Automated moderation of published photos, videos, captions and comments, to protect the community — legitimate interest.
• Aggregate audience measurement (no cross-site tracking) — legitimate interest.
• Crash diagnostics for the site and the mobile app — legitimate interest.

4. Retention

• Account and dive data: as long as your account is active. After account deletion, full erasure within 48 hours (backups included). One exception: content subject to a legal report (child sexual abuse material) is preserved for the duration of the proceedings, under Art. 17(3) GDPR.
• Waitlist email: until public launch, then merged with your account if you sign up, or deleted on request.
• Server logs and crash reports: 90 days maximum.
• Invoices and accounting (PRO subscription, when applicable): 10 years (legal obligation).

5. Sub-processors

We rely on carefully selected providers. All operate within the European Union or have Standard Contractual Clauses approved by the European Commission in place.

Services you connect

If you link your Strava account, we keep the access and refresh tokens it issues to us, encrypted. When you publish a dive to Strava, by hand or through automatic publishing, it is sent there as an activity: title, description (key stats and a link to the dive on BlueAtlas), date, duration, site position and the dive's technical identifier. Neither your depth profile nor your media are sent. Once published, the activity falls under Strava's privacy policy. You can unlink Strava at any time from the settings: sending stops, and activities already published stay on your Strava account, where you can delete them.

6. Security

• TLS 1.3 encryption for all traffic between your device and our servers.
• AES-256 encryption at rest on the database and the media storage.
• Authentication via signed, expiring session tokens.
• Data access restricted on a least-privilege basis.

7. Your GDPR rights

Under Articles 15–22 GDPR, you have the following rights:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: correct inaccurate information.
• Right to erasure ("right to be forgotten"): delete your account and all your data. This is self-service from the app (Settings → Account → Delete my account): the account is closed immediately, the data is erased within 48 hours. The full procedure, including without access to the app, is on the Delete your account page.
• Right to portability: receive your data in a structured, reusable format (JSON / ZIP).
• Right to object: object to processing based on legitimate interest.
• Right to restriction: request the temporary freeze of a processing.

To exercise these rights, write to privacy@blueatlas.app. We respond within one month maximum. If you believe your rights are not respected, you may lodge a complaint with your local data protection authority (e.g. CNIL in France).

8. Cookies and trackers

BlueAtlas™ uses no advertising cookies nor third-party trackers for profiling. We only set:

• An encrypted session cookie (authentication, expires on logout or inactivity).
• A Turnstile cookie (Cloudflare) on the waitlist signup page, to block bots. No personal data, no tracking.

9. Minors' data

BlueAtlas™ is not directed at children under 16. We do not knowingly collect data from minors. If you believe we have, contact us at privacy@blueatlas.app for immediate deletion.

10. Changes to this policy

We may update this policy over time (new provider, regulatory evolution). The last-updated date is shown at the top of the page. For substantial changes, we will notify you by email.