Privacy notice
You can use VamoSpot without a user account, a name or an email address. This page explains what data the service still processes, why and for how long.
Updated 14 November 2026. This notice has been prepared in accordance with Article 13 of the EU General Data Protection Regulation (2016/679). This is an English translation of the Finnish privacy notice.
Controller and contact details
Soaris Oy (Business ID 3536576-3), registered office in Vantaa, Finland.
The company has no data protection officer.
In brief
- The service has no user accounts. We do not ask for your name, email address or phone number.
- The site uses no cookies, no advertising and no ad tracking.
- Your settings, favourites and nickname are stored primarily in your own browser.
- Data is stored on the server only when you do something yourself: send a spot report, subscribe to notifications or create a transfer code.
- Spot reports are deleted automatically after 48 hours at the latest. You can delete your own report straight away.
- Your own location (the location button) is only shown on the map. It is not sent to the server.
What data is processed and why
1. Using the site
When you open a page, your browser sends the server the usual technical information: your IP address, the address of the requested page, the time and details of your browser. These are needed to deliver the page and to protect the service against misuse and denial-of-service attacks. Cloudflare, which hosts the service, keeps technical logs, which may contain your IP address, for up to 7 days.
We track visitor numbers with Cloudflare Web Analytics. It tells us, for example, which pages are read, where visitors come from and which browsers they use. According to Cloudflare, the service does not use cookies, does not store IP addresses and does not track visitors from one site to another. We see only aggregated figures.
Legal basis: legitimate interests (Article 6(1)(f) GDPR). Our interest is to deliver the site, keep it running and secure, and know which parts of the service are used so that we can develop it.
2. Spot reports ("On spot" and "I'm coming")
When you send a report, the following is stored on the server:
- the spot, sport, gear size, conditions and extra details (e.g. gusty), and for an "I'm coming" report, the time window
- an optional comment and nickname
- a random identifier for your device, created by your browser. It lets you edit and delete your own report. The identifier contains no information about you or your device.
- your IP address, which we use to block spam and over-frequent reports
Reports are public. All users of the site can see the spot, sport, gear size, conditions, comment, nickname and time. The device identifier and IP address are not shown to anyone. Do not put anything in the comment or nickname that you do not want to make public, such as your full name or phone number.
Retention: an "On spot" report is shown for 2 hours, and an "I'm coming" report until the end of its time window, for 48 hours at most. After that, the report is deleted together with the IP address and identifier. In addition, a permanent statistics row (spot, sport, gear size, conditions and time) is kept from each report to track how many visits each spot gets. The statistics row contains no device identifier, IP address, nickname or comment, so it cannot be linked to you.
Legal basis: legitimate interests (Article 6(1)(f)). Our interest is to provide a feature you have asked for yourself and to let other riders know who is at the spot. As regards the IP address, our interest is to protect the service against misuse.
3. Notifications about new surf conditions
If you turn on notifications, the following is stored on the server:
- your browser's notification address and its encryption keys (Web Push), or your ntfy topic if you use the ntfy app
- your favourite spots and their settings (wind direction and minimum wind), whether you want notifications only while the sun is up, and the language of the notifications
- a record of the surf windows you have already been notified about, so that you do not get the same notification twice
The notification address lets us send a message to your device, but it does not tell us who you are.
Retention: the subscription is deleted as soon as you turn notifications off. Otherwise it is deleted 90 days after your browser last updated it. Your browser updates the subscription whenever you change your favourites or spot settings. The subscription is also deleted if the push service reports that the address is no longer valid.
Legal basis: legitimate interests (Article 6(1)(f)). Our interest is to send you the notifications you have subscribed to yourself. Sending notifications also requires your permission in your browser's notification settings. You can withdraw that permission at any time.
4. Settings transfer code
When you create a transfer code, your settings are stored on the server: favourites, spot settings, map layers, the selected forecast model and base map, and your home view if you have saved one. The home view is the centre point of the map, so it may reveal the area where you spend time. Anyone who knows the code can retrieve the data.
Retention: 30 days from when the code was created, after which the data is deleted.
Legal basis: legitimate interests (Article 6(1)(f)). Our interest is to transfer your settings to another device when you ask us to.
Other information
Providing data is voluntary. Without it you cannot send a spot report or receive notifications, but otherwise the service works normally. The service makes no automated decisions and does no profiling, and the data is not used for advertising.
Data stored on your device
VamoSpot stores your settings, favourites, nickname, your own reports, the device identifier and whether you have already seen the tour in your browser's local storage (localStorage). This data stays on your device and is not sent to the server except in the situations described above. You can delete it by clearing the site data in your browser settings.
We do not use cookies. The Finnish Act on Electronic Communications Services (917/2014, section 205) allows information that is strictly necessary to provide a service the user has explicitly requested to be stored on the device without separate consent. That is why the site has no cookie banner.
Service providers and transfers outside the EU
We do not disclose data to anyone other than the service providers listed below, which are needed for the service to work.
| Service provider | What it does |
|---|---|
| Cloudflare, Inc. (United States) | Hosts the server and stores reports, subscriptions and transfer codes. Produces the visitor statistics. Processes data on our behalf. |
| GitHub, Inc. (United States) | Runs the forecast updates and sends notifications after them. Processes subscription data while the notifications are being sent. |
| Your browser's push service: Google, Apple, Mozilla or Microsoft | Delivers the notification to your device. The service depends on your browser. |
| ntfy.sh | Delivers the notification to the ntfy app, if you have chosen it. |
Cloudflare and GitHub are US companies, so data may be transferred to the United States. Both state that they comply with the EU-U.S. Data Privacy Framework. In its decision (EU) 2023/1795, the European Commission found that data transferred to companies certified under the framework is adequately protected. The companies also use standard contractual clauses approved by the Commission.
When you open the map, your browser also loads the map library from unpkg.com and the base map from OpenStreetMap or, if you choose the Esri base map, from Esri. These services see your IP address and browser details just as any website does, and their own privacy policies apply to them.
How to delete your data
- Spot report: tap I left or Cancel arrival on the spot card. Your report is deleted from the server straight away. Otherwise it is deleted automatically after 2 hours, or after 48 hours at the latest.
- Notifications: turn notifications off under Notifications in the Surf view. The subscription is deleted from the server straight away.
- Transfer code: deleted after 30 days.
- Data stored on your device: clear the site data for vamospot.com in your browser settings.
Your rights
You have the right to
- know what data about you is processed and get a copy of it
- ask for inaccurate data to be corrected and for your data to be erased
- ask for processing to be restricted
- object to processing on grounds relating to your particular situation (Article 21). As all processing is based on legitimate interests, you can object to any of it.
- lodge a complaint with a supervisory authority if you consider that your data is processed unlawfully (Article 77). In Finland the supervisory authority is the Data Protection Ombudsman (Data Protection Act 1050/2018, section 8).
The service has no user accounts, so we cannot tell which stored data concerns you unless additional information is available that allows it to be found (Article 11 GDPR). A report, for example, can be found by its spot and time. The quickest way is to exercise your rights yourself: you can delete reports, the notification subscription and the data stored on your device straight away as described above.
Changes
We update this notice when the service changes. The date of the update is shown at the top of the page.