What we collect, and why

Who this is

surf.stats (@surf.stats on Instagram, thesurfstats.com) is the data controller for anything collected on this site. Questions or requests: reports@thesurfstats.com.

What we collect

• Email address — only if you type it in on the quiz's email step and tick the consent box. Skipping that step means we collect nothing about you.
• Your quiz result (your answers, your score, a random ID for that one game) — sent when a game ends so we can score it and keep the leaderboard, and linked to the email if you signed up. If you skip the email step, your result is still sent anonymously, with no email attached.
• Fin Selector email and Instagram handle (both optional) — only if you type an email on the Fin Selector's last step and tick the box. The Instagram handle is kept only together with an email, and we don't use it to contact you. Skipping the step costs nothing: your fins show up either way.
• Which Pro Surfer quiz answers — your ten answers are sent to our server only to look up your result, and are not stored.
• Nickname or Instagram handle (optional) — only if you type one in, so your score can show on the leaderboard. This is a public display name you choose, not used to contact you.
• Anonymous site analytics — we use Cloudflare Web Analytics (no cookies; it does not track individual visitors) to see aggregate traffic like which pages get visited. We also log anonymous quiz-funnel events (whether you started, whether you finished, whether you tapped share) — never tied to your email or identity. On the Fin Selector's surf-trip question, if you type a destination we don't list, we keep that place name (shortened, without accents), with no email or other answers attached; we don't keep it at all if it looks like an email, a phone number or a link.
• Games per connection — to stop automated copying of the quiz, we count how many games are started from one internet connection in a day. We never store your IP address for this: only a scrambled code made from it that changes every day and cannot be turned back into the address.
• Competition Report feedback — only if you received a report from us and open the link we sent you: your answers to the feedback form, the time you sent them, and the code in your link. The link is personal: it was made for you, so we know the answers are yours without asking your name. The link itself contains no name or personal data, and we do not store your IP address or device with your answers. Sending the form again replaces your earlier answers.
• Contribute answers — only if you use the Contribute page: each answer you send (or that you skipped a question), how sure you said you were, anything you wrote in the optional boxes (including a link and the topic you picked), the page language, and the time. Your Instagram handle and your email are sent only if you type them in. Each answer carries a random code kept in your browser, so we never show you the same question twice; it is not linked to your name. We never store your IP address itself: we keep two scrambled codes made from it with a secret key — one that changes every day (to count answers per connection per day) and one that stays the same (so one connection cannot count as several people when answers are tallied). Neither is shown to anyone or used for anything else.
• Apart from the Meta Pixel below, which runs only on the Fin Selector and only if you tap Accept, we do not use tracking cookies or ad trackers. The site remembers a few things between visits, all only in your own browser (localStorage): that you have already been through the email step, the leaderboard name you chose, which is sent with your next game so it shows under the same name, and, if you use the Contribute page, its random code, your language and the Instagram handle you typed there.

Meta Pixel (ads)

We advertise the Fin Selector on Instagram and Facebook. To learn which ads bring people, and to show our ads again to people who visited, the Fin Selector page can load the Meta Pixel. It runs only on the Fin Selector, and only after you tap Accept on the bar that asks. Tap Decline and nothing is sent to Meta.

• What Meta receives: the page address, the time, browser and device data, your IP address, Meta's cookies (_fbp, plus _fbc when you came from an ad), and three events: selector started, result shown, and shop link tapped with the shop's name.
• What Meta does not receive: your answers, your email, or your weight.
• Who processes it: Meta Platforms, under its own privacy policy. This data may be transferred outside Brazil, to the United States.
• Legal basis: your consent (LGPD Art. 7, I).
• How to change your mind: the “Ad cookies” link at the bottom of the Fin Selector clears your choice and asks again; you can also manage ads in Meta's ad preferences.
• How long: the _fbp cookie lasts up to 90 days in your browser; Meta keeps the data under its own policy.

Why, and on what basis

We email signups about new quizzes and CT event previews; Fin Selector signups also get new gear tools, as the box on that step says. The two lists are kept apart and never merged. That's it — we don't sell, share, or rent this list to anyone. The legal basis is your consent, given explicitly by ticking the checkbox before submitting — not implied by playing the quiz.

We use report feedback only to improve the Competition Reports and to decide what to build next. We never publish it with your name or share it. The legal basis is your consent (LGPD Art. 7, I): filling in the form is optional, and you can withdraw it at any time.

We use Contribute answers to fill gaps in our records of coaches, shapers, sponsors and results. When enough people agree, an answer can enter our database. If you typed your Instagram handle, we may thank you by that handle on surf.stats (on the site or on Instagram); otherwise we never publish it. If you gave an email, we use it only to reply about your contribution. The legal basis is your consent (LGPD Art. 7, I).

How long we keep it

Signups are kept until you unsubscribe or ask us to delete them. We review the list periodically and remove entries we no longer have an active use for.

Report feedback is kept for 12 months after the event it is about, then deleted, or sooner if you ask.

Contribute answers are kept for as long as they help us check our records. Ask us and we delete yours, along with your handle and email. Answers you sent without a handle or email are not linked to you, so we cannot pick them out to delete them.

Your rights

Under LGPD (Brazil) and equivalent laws elsewhere, you can ask us to confirm what we have on you, correct it, delete it, or export it. Two ways:

• Unsubscribe — removes your email from future sends immediately.
• Email reports@thesurfstats.com for anything else (access, correction, full deletion, export). We'll handle it directly — there's no automated self-service for these yet.

Where it's stored

On a server we run, physically located in Brazil. We don't transfer it internationally, except the Meta Pixel data described above, which Meta may process in the United States, and only if you accepted it. Anonymous analytics (page traffic, quiz-funnel events — never your email or identity) pass through Cloudflare's global network as our processor.