Privacy Policy

Makai is run by Anthony Chávez (Mexico), who co-founded it with Gema Domínguez (Portugal). Anthony Chávez is the data controller: the person responsible for how your data is used. For any privacy matter, write to hola@makaisurf.app. We reply within 30 calendar days at the latest.

You can explore the website without an account. To post, log your surf, request photos, send messages or keep your account across devices, you sign in in one of three ways:

• A one-time link or code sent to your email. We receive only your email address.
• Google. Google gives us an account identifier, your email, your name and your profile picture. Makai may show that picture as your avatar until you add your own.
• Apple. Apple gives us an identifier and, if you allow it, your email. If you choose to hide it, Apple gives us a relay address and we never see the real one.

Your session stays in this browser until you sign out. In the iOS app you can also start as a guest: the app creates an anonymous identity (a random identifier, with no email, phone number or name) so you can browse beaches, conditions and sessions, and you can sign in with Apple if you want to keep your profile across devices.

• Email and sign-in identifiers: to sign you in and, when needed, to reply to you about your account.
• Your profile: public name, username, role (surfer, photographer or both), profile photo, bio, board, where you shoot from, home beach and Instagram handle, so others know who they are meeting. You pick the name; it does not have to be your legal one.
• Account identifier: to tie your sessions and photos together. Others see you through a public identifier that differs from the internal one.
• Location for nearby beaches: the website can use an approximate area derived from your IP address. If you choose “Use my location”, or open the beach search when creating a shoot in Sessions → Shoots, your browser asks permission for a single location reading. Makai uses it to sort beaches, without saving it to your account or sending it to a map provider. You can instead choose a beach manually. In the mobile app, location is optional and used while you use the app; we keep no location history.
• Photos and videos you pick: only the files you explicitly select in the system picker. Makai cannot reach the rest of your library or the microphone. In the iOS app, the camera is requested only when you choose to scan a QR code to connect to the web studio. When you post a photo, your browser reads the time and, if present, the position stored in it, so we can find the beach and the sea conditions at that moment. We keep the time; the position is used for that lookup only and never stored.
• What you share in Makai: moments (photos or videos with their caption, beach, capture time and sea conditions), comments, likes, saved moments, plans, sessions (title, notes, times), messages, coverage offers and reviews, so the community and your plans work.
• Operational activity: actions such as creating a session, requesting photos, messaging and saving content are processed to provide those features. We also record a few product events tied to your account (for example, opening a delivered album or starting a download) to see whether features work. Makai does not use this activity for advertising or cross-app tracking.
• Reports and blocks: to keep the community safe.
• Push notification device token: if you grant permission in the mobile app, we keep an installation token so Makai can deliver messages, session updates and photo-delivery alerts. You can turn these notifications off in iOS Settings or inside Makai.
• Waitlist: if you joined our waitlist, we keep the email, name, role and beach you gave us and use them only to tell you when Makai opens near you.

We process this data to provide the service you ask for, with your consent where we ask for it (location, notifications, connecting Instagram), and in our legitimate interest in keeping Makai safe and working (reports, blocks and product events).

Session photos stay private until the photographer decides. Surfers who logged a session at the same beach and time can see protected, watermarked previews to find themselves and request the photos they appear in. The originals reach only the people the photographer approves, in Makai or through a delivery link the photographer shares.

Your profile, moments and plans are visible to anyone if your profile is public, including visitors to makaisurf.app who have not signed in. If you make your profile private, only people you already coordinate with can see them. Comments and likes are visible to anyone who can see the moment. A photographer’s portfolio is a private draft until they publish it; published portfolio items are public.

Storage is never public, with one exception: profile photos, which anyone can see. Everything else is served through temporary signed links or through our own server, and only to people allowed to see it. Before storing a photo we remove its EXIF and XMP metadata, including the location cameras and phones embed by default; videos lose their container metadata too.

Connecting Instagram is optional and always started by you. We ask Instagram only for its basic permission (instagram_business_basic) and use it for two things:

• Importing to your portfolio (photographers): you pick photos, videos and reels from your own Instagram professional account, including the items inside carousels, and Makai copies the ones you tick into your private portfolio draft. While you pick, previews load straight from Instagram’s servers.
• Filling in your Instagram handle (anyone signed in): “Connect Instagram” on your profile reads your Instagram username and saves it as your handle. It is shown on your profile, publicly if your profile is public.

Right after you connect, we read your account’s IDs, only to link your Instagram account to your Makai account for deletion requests. Besides that we read your username (profile only), the list of your media with its IDs, type and file links (portfolio import only), and the files you pick. We never read captions, links to your posts, dates, comments, likes, followers or statistics, and we never publish anything to Instagram.

Imported photos are re-encoded as JPEG (up to 1600 px) with all metadata removed. Videos and reels are repackaged as MP4 without re-encoding, removing their container metadata, chapters, subtitles and data tracks, and get a clean JPEG cover frame. Everything stays in your private draft until you publish it or share it as a community moment; published portfolio items and moments are public.

The access Instagram grants us is short-lived and never stored in our database. It lives only in an encrypted cookie in your browser that scripts cannot read and that expires within 55 minutes. We delete it as soon as an import finishes, fails or is cancelled, when you close the picker, and when the profile connection succeeds or fails.

What we keep: the photos and videos you imported, and any moment you shared from them, each marked with the Instagram account it came from; your handle, noting that Makai filled it from Instagram; and a keyed one-way hash (HMAC-SHA256) of your Instagram account’s IDs, never the ID itself. The hash exists only so we can find your data if you ask Instagram to have it deleted.

How to delete it:

• “Remove from portfolio” deletes an item and its files. A moment you already shared from it is a separate post: delete it from the moment.
• Clear the Instagram field on your profile and save to remove your handle.
• “Delete account” removes your account and content (except originals already delivered to surfers, as below), including the link to your Instagram account.
• From Instagram: remove Makai in Instagram’s settings (Apps and websites) and ask for your data to be deleted. We then delete every portfolio item imported from that Instagram account and every community moment you shared from one of them, with their files and video covers; clear your handle if it is still the one Makai saved from Instagram (a handle you later typed yourself stays); and delete the link. You get a confirmation code and can check the real status at makaisurf.app/instagram/deletion. We record the request (code, status, how many items were removed, whether your handle was cleared, and dates) without your Instagram ID or its hash.

Items imported up to and including September 21, 2026 may not be marked with their Instagram account, so a deletion request may not find them automatically. Remove them with “Remove from portfolio” or “Delete account”, or write to hola@makaisurf.app and we will do it. If you only remove Makai from Instagram without asking for deletion, we delete nothing, so a later deletion request can still find your data; the short-lived access simply expires.

• We do not track you across other companies’ apps or websites. No advertising identifiers (IDFA), no Apple tracking prompt and no advertising SDKs.
• We measure visits to the website only in aggregate: Vercel Web Analytics counts page views without cookies and receives no Instagram data.
• We do not sell or rent personal data to anyone.
• We do not use Instagram data for advertising, profiling or anything beyond the two uses above and honouring deletion requests.
• We do not read your contacts or any health data.
• We do not use push notifications for advertising. When you opt in, they are limited to functional updates such as messages, sessions and photo delivery.

These providers receive data when you use Makai. Vercel, Supabase and Resend process it on Makai’s behalf under their data-processing terms; the others receive only what is described next and handle it under their own terms:

• Vercel Inc. hosts the website. Our server functions, including the ones that process Instagram data, run in Vercel’s Dublin region (Ireland, EU). Like any host, Vercel receives technical data such as your IP address, from which it derives the approximate area we use for nearby beaches. Its Web Analytics counts page views without cookies.
• Supabase: database, sign-in and file storage, on servers in Ireland (AWS eu-west-1).
• Resend: sends our emails, such as sign-in codes and waitlist messages.
• Google and Apple: if you choose to sign in with them. Apple’s sign-in button loads from Apple on the sign-in screen, so Apple sees your IP address there. Apple also delivers push notifications in the iOS app, and we keep the waitlist in a private Google Sheet.
• Instagram (Meta): only if you connect it, as described above.
• Open-Meteo: sea and wind conditions. We send it a beach’s or a photo’s coordinates and a time, never who you are.
• Esri and Wikimedia Commons: beach preview images load from them directly in your browser. Like any website they see your IP address, but nothing about your account.

Several of these companies are based in the United States, so your data may also be accessed from outside the European Union when they provide their service.

We keep your profile and content while your account exists. Delete your account and we delete it immediately, with one exception: original photos and videos a photographer already delivered to a surfer stay in that surfer’s library, without the photographer’s name or profile. Abuse reports may be kept as long as needed to handle the complaint, even if the reported account is gone.

Instagram access lasts at most 55 minutes. The hashes that link your Instagram account, and the handle Makai saved from it, are kept until you ask Instagram to delete your data, delete your Makai account or ask us at hola@makaisurf.app to remove them. Records of deletion requests contain no Instagram identifier and are kept so their status page keeps working.

You can access, correct and delete your data. The fastest route is inside the app:

• Correct: edit your profile (name, role, photo and the rest) whenever you like.
• Delete: Profile → Settings → Delete account. Deletion is immediate and final. If you signed in with Apple, write to hola@makaisurf.app and we’ll delete your account: the website can’t revoke Sign in with Apple yet.
• Access or export: write to hola@makaisurf.app and we will send you a copy.
• Block and report: you can block anyone and report content from within the app.

You can also object to or ask us to restrict how we use your data, and withdraw any consent at any time, for example by turning off location or notifications, by clearing your Instagram handle, or by asking Instagram to delete the data Makai got from it. If you believe we handle your data poorly, you may complain to your country’s data protection authority.

Makai is not aimed at children under 13 and we do not knowingly ask them for data. If you are under the age of digital consent in your country, you need a parent’s or guardian’s permission to use Makai. If you find that a child has given us information, write to us and we will delete it.

If we change how we handle data, we update this page and its date. When the change matters, we will also say so inside the app. The rules for using Makai are in the Terms of Service.

Questions? Support.