Privacy policy

Who we are

SurfTrip.ph is a Philippine surf forecasting and surf guide website. We operate under Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and the regulations of the National Privacy Commission (NPC).

To reach us on privacy matters, use the contact form or email: .

What data we collect and why

We collect minimal data. The site does not require registration to use.

Server logs. When you visit, our server and Cloudflare (our CDN and security provider) automatically record your IP address, browser type, pages visited, and timestamps. These logs exist for security and operational purposes and are retained for up to 30 days.

Contact form. If you use the contact form at /contact, we collect your name, email address, and message. We use this only to respond to your inquiry. We do not add you to any mailing list.

Google Analytics. If you consent, we load Google Analytics (GA4), which collects anonymized usage data: pages visited, session duration, and approximate location (country/region level only). This data is processed by Google and governed by Google's privacy policy. GA is never loaded without your explicit consent.

SurfTrip Forecast Widget (Android app)

This section applies to the SurfTrip.ph Android app and its home screen widget. The app does not require an account, and it does not ask for your name, email address, phone number, or location.

Anonymous install ID. When you open the app, it creates a random identifier on your phone and sends it to our server together with the app version, the source you installed the app from (for example Google Play or a direct download), and the dates the app was first and last seen. The identifier is randomly generated by the app. It is not your advertising ID, your device hardware ID, or linked to an account, and we do not use it to identify you. We use it only to count installs and understand how the app is used.

Forecast requests. To show a forecast, the app asks our server for the spot you chose. As with the website, our server and Cloudflare record your IP address and request details in server logs, which are kept for up to 30 days (see Data retention below).

Data stored on your phone. The app keeps your chosen spot, display settings, and the last downloaded forecast on your phone so the widget can show data without a connection.

The website inside the app. The app can also show the SurfTrip.ph website. When you use it, the rest of this policy applies, including the cookies and Google Analytics consent choice described below.

Deleting this data. Because the install ID is random and is not linked to anything that identifies you, we cannot tell which record belongs to you, so we cannot look it up on request. Uninstalling the app, or clearing its storage in your phone settings, removes the ID from your phone. If you want to ask about server log data connected to your IP address, or make any other privacy request, use the contact form or email .

Lawful basis

Under the DPA, we process data on the following bases:

• Server logs and operational data: legitimate interest (security and site operation)
• Contact form submissions: consent (you choose to contact us)
• Google Analytics: consent (you accept via the cookie banner)
• Android app install ID and forecast requests: legitimate interest (counting installs, operating the service)

Cookies

st_units, st_consent, and preferred_spot are strictly functional and do not require consent. Google Analytics cookies are only set after you click “Yes, that’s fine” on the cookie banner. You can change your choice at any time via the “Cookie settings” link in the footer.

Third parties

Cloudflare. We use Cloudflare for CDN, DDoS protection, and DNS. Cloudflare processes your IP address and request metadata as part of normal network operation. See Cloudflare's privacy policy.

Google Analytics. Analytics data is processed by Google under their privacy policy. GA is only active if you have given consent.

Agoda. Some accommodation links on the site are Agoda affiliate links. When you click one, you leave SurfTrip.ph and Agoda's own privacy policy applies. We receive a commission if you book. We do not share any personal data with Agoda.

Data retention

• Server logs: up to 30 days
• Contact form messages: retained as long as operationally needed, typically up to 12 months
• Android app install records: kept as long as they are useful for usage statistics

Your rights

Under the Data Privacy Act, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to processing; and withdraw consent at any time (withdrawal does not affect prior processing).

To exercise any of these rights, use the contact form or email . We will respond within 15 days.

Security

We use Cloudflare, HTTPS, and server-side access controls to protect the site and any data in transit. No system is perfectly secure. In the event of a breach that poses risk to personal data, we will notify affected users and the NPC as required by the DPA.

Changes to this policy

We may update this policy. The effective date at the top will reflect the latest revision. Continued use of the site after changes constitutes acceptance.