Last updated: 10 July 2026
Sessions (the "Service") is operated by Rodrigo J. Pla Escalante, trading as Stōhkt (VAT ID ES26888711D), based in Spain. This policy explains what personal data we collect through the Service, why, and what rights you have over it under the EU General Data Protection Regulation (GDPR).
We collect the minimum we need to run the Service, and we don't sell or share your data with advertisers. If anything here is unclear, email us at ola@stohkt.es.
Account data. If you create an account, we store your name, email address, and a securely hashed password (we never see or store your password in plain text) via our authentication provider, Supabase.
Surf alerts. If you set up an alert, we store the spot and conditions you're watching for, and — only if you choose to add them — an email address or phone number to notify you.
Session logs. If you log a surf session, that entry is saved only in your own browser's local storage. It is not sent to or stored on our servers, and we can't see it.
Location. If you allow location access, your coordinates are used only inside your browser, to sort spots by distance. They are never sent to or stored on our servers.
Billing data. If you subscribe to Pro or purchase Lifetime, our payment processor, Stripe, handles your card details directly and securely — we never see or store your full card number. We store only your subscription tier and status (e.g. "Pro," active or cancelled) to control access to paid features.
Nothing else. We do not run analytics, advertising, or tracking scripts of any kind on this site.
We use a small number of service providers (data processors) to run Sessions. None of them are permitted to use your data for their own purposes:
Two further third-party services are called directly by your browser while you use the site, without any of your personal data being sent to them:
Sessions does not use tracking or advertising cookies. We use your browser's local storage for a few strictly necessary purposes: keeping you signed in (via Supabase), storing session logs, and remembering alert drafts if you're not signed in. None of this is used to track you across other sites.
We keep your account and alert data for as long as your account is active. If you delete your account, your alerts and profile data are permanently removed.
Under GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to how we process it. You can:
Sessions is not directed at children under 16, and we don't knowingly collect data from them.
If we make material changes to this policy, we'll update the date at the top of this page. Continued use of the Service after a change means you accept the updated policy.
Rodrigo J. Pla Escalante (Stōhkt) · Spain · ola@stohkt.es