Privacy Policy

Wakeboarding Gizmo is operated by Kohort Software Limited, a company registered in England and Wales, at 71-75 Shelton Street, London, England, WC2H 9JQ. Kohort Software Limited is the data controller for the personal data described in this policy.

You can reach us about anything in this policy at support@kohort.io.

Account details. If you create an account, we collect your email address and an account identifier, plus a rider name. Rider names are not written by you: the game generates them from two fixed, pre-approved word lists (for example "Glassy Grommet") and you choose one of the options offered or shuffle for others. Your referral code is derived from that generated rider name and a random string — it contains no part of your email address, and your email address is never shown to other players. Accounts use email and password only. Authentication is handled by Supabase on our behalf. We use this to create your account, sign you in, keep your progress attached to you, and contact you about the service. Lawful basis: performance of a contract with you.

Gameplay data. Scores, individual runs (score, duration, wipeouts), tricks landed, and progression such as XP, level, unlocked boards and venues. We use this to save your progress, show your personal best and career stats, run leaderboards, and validate scores so leaderboards stay fair. Lawful basis: performance of a contract with you.

Guest play (on your device only). You can play without an account. In that case your high score, plays, landed tricks, your five best runs, your settings (such as tilt steering and its calibration) and a randomly generated player identifier are stored in your browser's or app's local storage on your device. None of it is sent to us as account data, and if you later create an account we offer to copy those runs and tricks into it. Clearing your app or browser data erases it.

Analytics events. We record in-game events — opening the game, starting and finishing a run, opening the leaderboard or trick book, tapping share or sign in — together with a session identifier, a randomly generated player identifier stored on your device, the score, duration, tricks and wipeouts of the run, and whether you are on a desktop, mobile or tablet. We do not collect or retain your IP address in our own database, and we do not derive or store your country or any other location from it (see "IP addresses" below). Where you are signed in, the event is also linked to your rider account. We use this to understand how many people play, how long they play, and which parts of the game work or don't. We use our own server endpoint for this — there is no third-party analytics or advertising SDK in the game, and no cookies are used for tracking. Lawful basis: our legitimate interests in understanding usage and improving the game.

Attribution data. Where you open the game from a web link, we record any campaign tags in that link (source, medium, campaign) and the referral code of the player who shared it, so we can credit referrals. We do not record the address of the page you came from. In the mobile app there is no link to read, so attribution is simply recorded as "app". Lawful basis: our legitimate interests in measuring how the game is discovered and shared.

IP addresses. Our application does not collect, store or analyse your IP address: it is not written to our database, not attached to analytics or attribution events, and never used to work out your country or location. It is, however, unavoidably processed on our behalf by the providers that deliver the service. Every request to a website or app carries the IP address it came from, so our hosting and content delivery provider sees it in order to route traffic and to protect the service against abuse, and our authentication provider (Supabase) records it when you sign in, sign out or reset your password, as a security and abuse-prevention record. That processing is transient and operational: those logs are held by each provider in line with that provider's own retention policy, which we do not set or control. They are kept separately from the game data, are not used for analytics, profiling, advertising or location targeting, and are not combined with your rider account by us. Lawful basis: our legitimate interests in delivering the service securely and preventing abuse.

We do not sell personal data, we do not share it with advertisers, and we do not track you across other apps or websites. We do not collect your name, address, phone number, precise location, contacts, photos or payment details, and the game has no purchases.

We do not process your data entirely by ourselves. The following providers process it on our behalf, on our instructions, in order to run the service:

• Supabase, Inc. — our database, account storage and authentication provider. It holds your account details, gameplay data, progression and analytics events, and records sign-in security logs.
• Lovable Labs Incorporated — our hosting provider, which builds and serves the website and the app's web content.

Our hosting provider engages Cloudflare, Inc. as a sub-processor, to deliver and protect that traffic through its content delivery and edge network. We have no direct contractual relationship with Cloudflare; it is engaged by our hosting provider, under that provider's own arrangements with it.

These providers are engaged on the terms of service they publish for their platforms, which govern how they may handle data processed through them. If you want to know the exact arrangements or safeguards that apply to your data, ask us and we will tell you what we have.

Some of these providers operate infrastructure outside the United Kingdom and the European Economic Area, so your data may be transferred to and stored in other countries. Where that happens, we rely on the transfer safeguards each provider sets out in its own published terms rather than on any separate arrangement of our own.

Account details, gameplay data and progression: for as long as your account exists. Deleting your account removes it immediately from our live systems; encrypted backups roll off within 30 days. We keep nothing beyond that unless a legal obligation requires it.

Analytics and attribution events: up to 24 months from the date of the event. Events linked to your rider account are deleted with your account; the remaining events keep only the random on-device player identifier and can no longer be connected to you.

Leaderboard entries: removed with your account, so deleting your account removes your rider name and scores from public leaderboards.

Deleting your account, in the app. Open ⚙️ Settings → Delete account in the game, confirm by typing DELETE, and we permanently erase your account and all of its data: your sign-in record and email address, your profile (rider name, high score, career stats, referral code), every saved run, your landed tricks, your progression (XP, level, boosters, boards, boats, venues, avatar), your roles, referral records that point at you, and the analytics events linked to your rider account. Deactivation is not used — the rows are deleted. You are then signed out and returned to guest play. The same flow is available on the web at /delete-account, or email us and we will do it for you within 30 days.

Guest progress lives only on your device; delete it by clearing the app's or browser's storage for the game.

Under the UK GDPR and the Data Protection Act 2018 — and, where you are in the EU, the EU GDPR — you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected. You can shuffle to a different generated rider name in the game at any time.
• Erasure — ask us to delete your account and associated data.
• Restriction — ask us to pause our use of your data while a concern is resolved.
• Portability — receive your account and gameplay data in a common machine-readable format, or have it sent to another provider.
• Objection — object to processing we carry out on the basis of legitimate interests, including analytics and attribution.
• Withdraw consent — where we ever rely on consent, you can withdraw it at any time without affecting earlier processing.

To exercise any of these rights, email support@kohort.io from the address on your account, or tell us your rider name so we can find it. We will respond within one month. Deletion requests remove your account, profile, runs, landed tricks and progression. There is no charge for making a request.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint. If you are in the EU, you may instead complain to the data protection authority in your country of residence.

Data is transmitted over encrypted HTTPS connections and is encrypted at rest by our hosting and database provider. Access to production data is limited to people who need it to run the service. Passwords are stored as salted hashes by our authentication provider and are never visible to us. Scores and progression are validated on the server so they cannot be altered from your device.

No online service can be completely secure. If a breach affects your rights, we will notify the ICO and, where required, you.

Wakeboarding Gizmo is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, email us at support@kohort.io and we will delete the account and its data.

If we change how we use personal data, we will update this page and the "last updated" date above. Significant changes will be highlighted in the game.

Kohort Software Limited
71-75 Shelton Street, London, England, WC2H 9JQ
support@kohort.io