DiveOne Planner — Privacy Policy
Effective date: June 20, 2026
Data controller: Individual Entrepreneur Ilya Pavlovich Shurenkov (ИП Шуренков Илья Павлович) — registered in the Kyrgyz Republic (registration No. 001-2024-169-5164; Taxpayer ID / ИНН 21108198750110), Bishkek, Kyrgyz Republic ("DiveOne", "we", "us", "our").
Privacy contact: privacy@diveoneclub.com
In plain language (the 60-second version)
- DiveOne Planner is a free dive-planning tool at planner.diveoneclub.com.
- We collect the minimum needed to run it: your account (email + sign-in identity), the dive plans and logs you choose to save, and privacy-first usage analytics.
- We do not sell your data. We do not use third-party advertising or cross-site tracking.
- The decompression math runs in your browser and is openly published ("Verify our math").
- You can export your data and delete your account yourself, in the app, at any time.
- The full legal detail is below. If anything conflicts, the detailed sections govern.
1. Scope
This Policy explains how we process personal data when you use the DiveOne Planner web application and related back-end services (the "Service"). It does not cover third-party websites or services that may be linked from the Service.
2. What we collect, and why
We practise data minimisation — we collect only what the Service needs.
| Category | Examples | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|---|
| Account & identity | email; sign-in provider and subject id (Apple/Google) or password hash; optional display name | you / your sign-in provider | create and secure your account; authenticate you | Contract — Art. 6(1)(b) |
| Dive plans & logbook | depth, time, gas, gradient factors, dive site, notes, trips you save | you | provide save / sync / export | Contract — Art. 6(1)(b) |
| Usage analytics | anonymised events (e.g. "app opened", "plan created"), device type, app surface — no names, emails, GPS, or health data | your device | understand and improve the Service | Consent — Art. 6(1)(a) (opt-out anytime) |
| Technical & security | transient IP address, request metadata, a device identifier, error logs | your device | security, abuse prevention, reliability | Legitimate interests — Art. 6(1)(f) |
| Support | messages you send us | you | answer your request | Legitimate interests / contract |
We do not collect special-category ("sensitive") data. A dive plan describes a planned activity (depth/time/gas) — it is not your health record. The web Service does not read HealthKit, heart-rate, or other biometric data.
3. Analytics, cookies, and local storage
- We use local storage in your browser to remember your settings and saved plans. These are not advertising cookies.
- Analytics are privacy-first: events carry no personal data, GPS, or health fields (this is technically enforced — for example, a site search is recorded only as a length, never the text you typed).
- Analytics are consent-gated: if you do not consent, nothing is sent, and you can withdraw consent at any time in Settings.
- For signed-in users, analytics events may be linked to your account so that we can honour your deletion request; they are deleted when you delete your account.
4. We do not sell your data
We do not sell, rent, or trade your personal data, and we do not use third-party advertising or cross-site tracking. For California residents: we do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA.
5. Service providers (processors)
We use a small set of vetted providers to operate the Service, bound by data-processing terms and acting only on our instructions — for example:
- Hosting & deployment — web app on Vercel; API and database on Hostinger VPS.
- Authentication — Apple, Google (only when you choose to sign in with them).
- Database — self-managed PostgreSQL on the Hostinger VPS.
They may not use your data for their own purposes. A current list of processors is available on request: privacy@diveoneclub.com.
6. International data transfers
The Service may process data in Malaysia (planner API+DB) and on global edge infrastructure (Vercel CDN). Personal data is processed in Malaysia and on global edge infrastructure.
7. How long we keep your data
- Account, plans, logbook: while your account is active, and deleted or anonymised within 30 days of account deletion.
- Analytics: retained for 24 months, then aggregated or deleted.
- Security logs: 90 days.
8. Your rights
Subject to applicable law, you may:
- Access and export your data (self-serve export in the app).
- Rectify inaccurate data (edit in the app).
- Erase your data — delete your account yourself in the app, which cascades to your plans, logbook, and account-linked analytics; or contact us.
- Restrict or object to certain processing, and withdraw analytics consent at any time (Settings).
- Port the data you provided to us.
- Complain to your data-protection authority (EU: your local authority).
US residents (California and others) have equivalent rights to know, delete, correct, and opt out, without discrimination for exercising them.
To exercise your rights, use the in-app tools or contact privacy@diveoneclub.com. We respond within 30 days.
9. Security
We use industry-standard measures, including encryption in transit (TLS), access controls, least-privilege, and storage hygiene. No system is perfectly secure and we cannot guarantee absolute security. If a personal-data breach is likely to affect your rights, we will notify you and the relevant authority as required by law.
10. Children
The Service is not directed to children and is intended for users who are at least 18 (or the age of digital consent in your country, and the minimum age required for diving/certification). We do not knowingly collect data from children; if you believe a child has provided data, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy. We will post the new version with a new effective date and, for material changes, notify you in the app or by email. Continued use after the effective date means you accept the updated Policy.
12. Contact
Individual Entrepreneur Ilya Pavlovich Shurenkov (ИП Шуренков Илья Павлович), Kyrgyz Republic. Privacy: privacy@diveoneclub.com.
*Pair with the DiveOne Planner Terms of Service.*