Momentum Privacy Policy

1. What we collect

• Account: name, email, and birth date (age check), via Sign in with Apple or Google. If you use Hide My Email, we only see the relay address.
• Onboarding answers: your self-described skill, mindset, goals, equipment, spots, and cadence — used to personalize coaching.
• Sessions and content: sessions you log, subjective check-ins (like survive/thrive), videos and photos you upload, and posts, comments, and likes.
• Conditions and spots: the surf spots you pick; conditions data is fetched for those spots.
• Device and usage: device type, app version, crash reports, and product analytics (which screens and features are used). No advertising trackers.
• Push tokens: if you enable notifications.
• Waitlist: if you join the waitlist on our website, your email, and then your name, phone number, age and where you surf. We use it to place you in the beta and to reach you about your spot. We do not share it with anyone.

2. What we do NOT do

We do not sell your personal information. We do not run third-party advertising or share your data for behavioral advertising. We do not license your footage to anyone else, and we never use it to identify you.

3. A human coach reviews your footage

When you upload a session video, it is analyzed with the help of our coaching engine and reviewed by expert human coaches on our team, who watch your footage to score it and write your coaching. Your videos are visible to those coaches and to you — they are never posted publicly unless you share them to the feed yourself. Coaching requests and responses are kept as records so we can improve coaching quality.

Improving the coaching models: we may also use your footage to improve Momentum's own coaching and analysis models. Accepting the Terms turns that on. You can turn it off at any time in Settings, under Privacy, and from then on your footage is not used that way. Footage already used to train a model cannot be pulled back out of it. Turning it off never changes your coaching, your scores, or your streak.

4. Who processes your data

We use service providers to run Momentum, each only as needed to provide the service: Supabase (database and authentication), Vercel (hosting and analytics), Cloudflare (media storage and delivery), ElevenLabs (generating coach voice audio; your personal data is not used to clone voices), conditions data providers (Open-Meteo and NOAA; they receive spot coordinates, not your identity), and Apple (notifications and sign-in). PostHog (product analytics) and Sentry (crash and error reporting) receive usage and diagnostic data: screens opened, timings, and error details. We do not send them your account ID, your name or your email, so what they hold is tied to a random device identifier rather than to you. Both record occasional session replays, PostHog on the website and Sentry in both the website and the app, and every replay masks all inputs and all on-screen text, so your onboarding answers, profile details and coaching content are never captured in them. Anthropic PBC helps draft personalized coaching from limited session details, never your email or full name. When you message the coach in the app, your message goes to Anthropic along with your recent conversation and the same limited session details used for your memos (never your email or full name), so a reply can be written right away. Your chat history is stored with your account, our coaches can read it to review and improve the replies, and it is deleted when you delete your account. When you upload a clip, a few small still frames from it go to Anthropic first, to check the clip is surf and safe to upload; the frames are not stored, and the clip itself is never sent to them. Anthropic API inputs and outputs are deleted within 30 days under its standard commercial retention terms, except when longer retention is required for safety or legal reasons, and Anthropic does not use API data to train its models unless the customer opts in. Payment processing, if subscriptions launch, will be handled by Apple and/or Stripe; we never see full card numbers.

5. Sharing within the app

Your profile and the sessions you post are visible to your friends in the feed per your settings. Privacy choices never cost you progress: keeping things private doesn't reduce your streak or score.

6. Retention and deletion

We keep your data while your account is active. You can delete your account in Settings, under Danger zone, with "Delete my account". Deletion removes your account, profile, sessions, videos, posts, and sign-in records (including revoking Sign in with Apple tokens) within 30 days, except minimal records we must keep for legal compliance (like waiver acceptance records) or de-identified analytics. You can also delete individual posts and videos any time. If you joined the waitlist without an account, we keep what you gave us until the beta ends or you ask us to take you off the list, whichever comes first. Email legal@onmomentum.co and we will remove you.

7. Kids

Momentum is not for children under 13, and during the beta it is limited to adults 18+. We ask your birth date before collecting anything else; if we learn an account belongs to someone under the minimum age, we delete it and its data.

8. Your rights

Email legal@onmomentum.co to access, correct, export, or delete your data. California residents: we honor CalOPPA and, where applicable, California privacy-law rights; we do not sell or share personal information as those terms are defined in California law.

Do Not Track: some browsers can send a Do Not Track signal. There is no common industry standard for how to respond to one, and Momentum does not currently respond to them.

Third-party tracking: our analytics and error-reporting providers, PostHog and Sentry, collect information about how you use Momentum, as described in section 4. Nothing in Momentum tracks what you do on other sites or apps.

9. Security

Data is encrypted in transit; storage and database access are restricted by role; videos live in access-controlled storage. No system is perfectly secure — use a strong sign-in method.

10. Changes

When this policy changes we post the updated version here and change the date at the top; that date is how you can tell it has changed. For material changes we will make reasonable efforts to tell you in the app before they take effect, and continuing to use Momentum after that means you accept the updated policy. If we ever want to use data we already hold for something significantly new, we will ask you separately rather than rely on a policy update.