Privacy Policy

Last updated: June 25, 2026

BeachScan ("we", "our", "the app") is a beach conditions app that provides real-time environmental data. This policy describes how we collect, use, and protect your information.

Data Controller

The data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) is:

Dino Tretinjak Mesarić, operating BeachScan as an individual based in the Republic of Croatia. Once the operating obrt (sole proprietorship) is registered, this designation will update to reflect the registered business name and registered seat. Contact: contact@beachscanapp.com.

Legal Bases for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): creating your account, processing subscriptions, syncing entitlements, storing your saved beaches and ratings.
• Legitimate interest (Art. 6(1)(f)): security and fraud prevention, crash and error reporting, debugging, protecting our service against abuse. Our legitimate interests are balanced against your rights and freedoms; you may object to processing on this basis at any time.
• Consent (Art. 6(1)(a)): access to your device location. Consent is given through the operating system permission prompt and may be withdrawn at any time via your device settings.
• Legal obligation (Art. 6(1)(c)): tax records relating to subscription purchases, where required by Croatian and EU law.

1. Information We Collect

Account information: When you sign in with Google (or Apple), we receive your name, email address, and profile photo. We use this to create your BeachScan account and personalize your experience.

Location data: With your permission, we use your device's location to show nearby beaches and relevant weather data. Location data is processed on your device to find the nearest reference point. We do not store or track your location history.

User-generated content: Beach ratings and saved beaches are stored on our servers and linked to your account.

Technical data: We may collect anonymous crash reports, device type, and OS version to diagnose issues and improve the app.

2. Information We Do Not Collect

• We do not collect or store your precise GPS coordinates on our servers
• We do not read your contacts, messages, or files
• We do not record audio or video
• We do not sell, rent, or share your personal data with third parties for advertising purposes

3. How We Use Your Information

• To provide and maintain the BeachScan service
• To authenticate your account and protect against unauthorized access
• To save your preferences, ratings, and saved beaches
• To improve app performance and fix bugs

4. Third-Party Services

BeachScan uses the following third-party services:

• Google Sign-In: For account authentication. Subject to Google's Privacy Policy.
• Google AdMob: To display ads. AdMob may collect device identifiers and usage data. Subject to Google's Privacy Policy.
• Mapbox: For map rendering. Subject to Mapbox's Privacy Policy.
• Stay22: For accommodation booking referrals. When you tap a "Stay nearby" link or interact with hotel suggestions, Stay22 may set cookies and receive your selected beach's location to return relevant accommodation options. We receive a commission if you book through these links at no additional cost to you. Subject to Stay22's Privacy Policy.
• RevenueCat: For processing in-app purchases of Premium subscriptions. RevenueCat receives your anonymous user ID, App Store / Play Store purchase receipts, and device platform information to validate purchases and sync entitlements across devices. Payment information is handled by Apple / Google and never reaches RevenueCat or BeachScan. Subject to RevenueCat's Privacy Policy.
• Sentry: For crash and error reporting so we can fix bugs. Sentry receives stack traces, device platform information, and your app session breadcrumbs when an error occurs. Personal identifiers are limited to your internal user ID. Subject to Sentry's Privacy Policy.

5. Data Storage and Security

Your account data is stored on servers located in the European Union (Germany). We use industry-standard security measures including encrypted connections (HTTPS), JWT-based authentication, certificate pinning on the mobile clients, and rate limiting to protect your data.

International transfers: some third-party processors listed in Section 4 (notably RevenueCat and Sentry) may process limited data in the United States. These transfers are protected under the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. The data transferred is limited to anonymous identifiers, purchase receipts, and error diagnostics — never your real name, email, or precise location.

Data breach notification: in the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (the Croatian Personal Data Protection Agency, AZOP) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Articles 33 and 34.

6. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Account data (profile, preferences, saved beaches, ratings): retained while your account is active; deleted within 30 days of an account deletion request.
• Subscription transaction records: retained for the period required by Croatian tax and accounting law (currently 11 years from the end of the fiscal year of the transaction).
• Crash reports and error diagnostics: retained for up to 90 days, then automatically purged.
• Anonymous analytics (no personal identifiers): retained for up to 24 months.

You can delete your account and all associated data at any time via our account deletion page, or by contacting us at the email below.

7. Children's Privacy

BeachScan is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

8. Your Rights

Under the GDPR and equivalent laws in your jurisdiction, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing based on legitimate interest
• Right to data portability — receive your data in a structured, commonly-used format
• Right to withdraw consent — for any processing based on consent

To exercise any of these rights, contact contact@beachscanapp.com. We respond to requests within 30 days as required by GDPR Article 12(3).

Right to lodge a complaint: if you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or with the supervisory authority in the EU member state of your habitual residence.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes through the app or by updating the date at the top of this page.

10. Contact

If you have questions about this privacy policy or your data, contact us at:
contact@beachscanapp.com