DiveSphere (“we”, “us”) is operated by VCA Design, operating as DiveSphere, 604-302 Morrissey Road, Port Moody, BC V3H 0M1, Canada. This policy explains what personal information we collect when you use divesphere.app, why, who we share it with, and the choices you have. We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Who is accountable

Our Privacy Officer is reachable at hello@divesphere.app. Contact them with any question, request or complaint about your personal information.

What we collect

• Account details from Google. When you sign in with Google we receive your name, email address and profile photo. We don’t receive your Google password.
• Account details from Facebook. If you sign in with Facebook we receive your name, email address and a Facebook account ID for DiveSphere. We don’t receive your Facebook password, friends or posts, and we never post to Facebook for you.
• Profile details you add. Display name, username, real name, city, province, country, certification level, bio, home region, photo, unit preferences and privacy settings.
• Your dive logs. Date and time, dive site, depth, duration, gas, temperature, visibility, weights, tank pressures, buddy, rating and notes — and, when you import from a dive computer, the full depth profile and device data the file contains.
• Connected services. If you connect Suunto, we store an encrypted access token and your Suunto username so new dives can sync. You can disconnect at any time.
• Things you post. Messages to other divers, comments on dives and photos, site comments, condition reports, suggested site edits, reports of content, and photos and videos you upload. Location data is removed from photos and videos in your browser before they’re uploaded.
• Relationships. Dive buddies, buddy requests, blocks and saved sites.
• Usage and technical data. Page views and performance measurements (Vercel Analytics and Speed Insights, which don’t use cookies), when you were last active, and email delivery events (sent, delivered, bounced, complained).

Why we use it

• To run your account, your logbook and the features you use.
• To show your profile and dives to the people you’ve chosen (see below).
• To send the notifications you’ve asked for, by email or in the app.
• To keep DiveSphere safe: preventing abuse, and acting on reports.
• To understand how DiveSphere is used, so we can improve it.
• With your separate consent only: to send you news and updates about DiveSphere (see “Email”).

We don’t sell your personal information, and we don’t show third-party ads.

Who can see what

• Dives. Each dive is Public (anyone, including people who aren’t signed in), Buddies (your confirmed dive buddies) or Only me. New dives use the default you choose; you can change any dive, and your default, at any time. Public dives appear on the dive site’s page with your display name; notes are never shown there.
• Profile. A public profile is listed in the community and visible to signed-in divers. A private profile shows only your name and photo to people who aren’t your buddies, and your public dives become visible to buddies only.
• Events. An event’s attendee list is shown to whoever can see the event, which its organiser sets as Public, Buddies or Invite only.
• Messages are visible to the people in the conversation. You control who can message you in your settings.
• Site comments, condition reports and site suggestions are public, with your display name.
• DiveSphere staff (admins and moderators) can see account and content data where needed to run and moderate the service. That includes every photo, video and comment, including ones shared only with buddies or kept to yourself, so they can review them and remove ones that break the rules. If staff remove something of yours, we tell you why.

Service providers and where data is stored

We use these providers to run DiveSphere. They process personal information on our behalf and only for that purpose. Some are located outside Canada — mainly in the United States — so your information may be stored and processed there and be subject to those countries’ laws.

• Vercel — hosting, analytics and performance monitoring
• Neon — database hosting (Amazon Web Services, Virginia, USA)
• Google — sign-in; address lookup when you add a dive site
• Meta (Facebook) — sign-in, if you choose it
• Amazon Web Services — storage for photos and videos you upload (Oregon, USA)
• Resend — sending email
• Trigger.dev — scheduling email and background jobs
• Suunto — only if you connect your Suunto account
• Map, weather and tide providers (such as CARTO, Open-Meteo and NOAA) — they receive the location of the dive site being viewed, and your IP address when your browser loads map tiles

We may also disclose information where the law requires it, or to protect someone’s safety.

Email

We send service emails (for example account and security notices) because they’re part of running your account. Notification emails (buddy requests, messages, digests) follow your notification settings. You can pause all non-essential email at any time in notification settings.

News, events and offers (our marketing emails, and DiveSphere news in your digest) are sent only if you say yes, as required by Canada’s anti-spam law (CASL). We ask with a box you can tick when you sign up, which is never ticked for you, and you can turn it on or off later in notification settings. When you say yes we record when, and where you did it. You can withdraw at any time: turn it off in settings, or use the unsubscribe link in any of these emails (unsubscribing from all DiveSphere email withdraws it too). We keep the record of when you agreed and when you withdrew. These emails always include our mailing address and a one-click unsubscribe.

Cookies and local storage

We use only the cookies needed to keep you signed in and protect sign-in from forgery (NextAuth session, CSRF and callback cookies). Your light/dark theme choice is stored in your browser’s local storage. We don’t use advertising or cross-site tracking cookies.

How long we keep it

We keep your information while your account is open. When you delete your account, your profile, dives, messages, notifications and connected-service tokens are deleted straight away. So are our records of emails sent to you. Dive sites you added, and photos used on them, stay without your name because other divers rely on them. Our email provider keeps its own delivery logs for up to 30 days, and backups held by our database provider expire within 7 days.

Your rights and choices

• Access and correction. You can view and edit your profile and dives at any time. To request a copy of the personal information we hold about you, contact our privacy officer; we’ll respond within 30 days.
• Deletion. You can delete your account yourself in account settings. That deletes everything you gave us, including what came from Google or Facebook sign-in. You can also remove DiveSphere from your Facebook settings (Apps and websites); to have your data deleted that way, delete your account here or contact our privacy officer.
• Withdrawing consent. You can make dives private, make your profile private, disconnect Suunto, or unsubscribe from email at any time. Some features won’t work without the information they need.
• Complaints. If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Safeguards

Data is encrypted in transit; connected-service tokens are also encrypted at rest. Access to production data is limited to the people who run DiveSphere. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we’ll notify you and the Privacy Commissioner as PIPEDA requires.

Children

DiveSphere is not intended for children under 16, and we don’t knowingly collect their information.

Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email before the change takes effect.