Waveriders Privacy Policy

Waveriders Collective Inc. · Effective: September 1, 2026 · Version 2.0

Applies to: the SurfScan™ app for Android (com.waveriders.surfscan), the SurfScore™ platform (surfscore.live), our websites (surfscan.app, waveriders.live), and interactions with us such as demo bookings and support. This policy replaces the January 2025 website privacy policy and incorporates and extends the SurfScan™ for Android policy dated 5 August 2026.

Who we are: Waveriders Collective Inc., a Delaware corporation, 8 The Grn Ste A, Dover, DE 19901 ("Waveriders", "we", "us").

SurfScan™ and SurfScore™ are professional tools for measuring and analyzing cellular network performance. This policy explains what data we handle, why, where it goes, and what stays on your device. The short version: we collect what the product needs to work, we do not sell your data, and the app contains no advertising or third-party analytics SDKs.

This Privacy Policy is a legal agreement between you and Waveriders Collective Inc., and by creating an account on surfscore.live or purchasing a subscription you are accepting everything in it. If you are accepting on behalf of a company or organization, you confirm you have authority to bind that organization, and "you" means not only the organization itself, but also includes you individually, as well as your organization's employees, independent contractors, agents, or any other third parties using the SurfScore™ platform on the organization's behalf.

Data we collect and why

Account information

Email address. You sign in with a one-time email code (via our backend provider, Supabase). Your email identifies your account and organization. Required for the app and platform to function. Your organization admin may also record your name and role.

Billing information

Subscription payments are processed by Stripe. Your card or bank details go directly to Stripe and are governed by Stripe's privacy policy — we do not store full card numbers. We keep billing records (plan, invoices, payment status) for accounting and tax purposes.

Precise location

During a walk-test session, the app records your precise GPS position — sampled continuously (about once per second) for live display and persisted in snapshots (about every 10 seconds). Recording continues while the app is in the background only during an active session, via a foreground service with a persistent notification; ending the session stops collection.
When you run a scan on a connected SurfScan™ device, your phone's location may be used to geotag the scan session.
Walk-test location data is uploaded, with the measurements below, to Waveriders' backend so you and your organization can view coverage results.

Cellular and RF measurements

Radio telemetry from your phone during walk tests: signal strength and quality (RSRP, RSRQ, SINR), serving cell identifiers (PCI, EARFCN/NR-ARFCN), bandwidth, carrier name, and network codes (MCC/MNC). This is the product's core data and is uploaded with the associated location.

Device information

A device identifier (Android's ANDROID_ID) plus the phone's manufacturer and model, sent with walk-test uploads to distinguish measurement sources.

Physical activity

With your permission, the app uses step detection to improve indoor position estimates (pedestrian dead reckoning). Raw activity data is processed on the phone; only the derived positions are part of session data.

Wi-Fi information

The app scans for and connects to SurfScan™ devices' Wi-Fi networks and reads local network details (e.g., gateway address) to talk to your scanner hardware. This is used on-device for connectivity.

Platform and website usage

When you use surfscore.live we process the technical data any web service does: IP address, browser type, and authentication session data (cookies used for sign-in and session security, not advertising). We run no third-party analytics on our websites or platform. When you book a demo or contact us, we collect the details you provide (name, email, company, message). Demo scheduling uses TidyCal; data collected through their booking flow is governed by their privacy policy.

Data that never leaves your phone

Scanner credentials — router admin passwords and device update tokens are stored only on your phone, in Android's encrypted storage (EncryptedSharedPreferences), and are sent only to your own scanner hardware on your local network. They are never transmitted to Waveriders.
When you claim a scanner, your email, organization name, and the device nickname are written to your own device so it can identify its owner.

Where data goes

Uploaded data (walk-test measurements, scan sessions) is stored in Waveriders' backend, operated on these infrastructure providers:

Supabase — authentication and database hosting.
Cloudflare — edge ingestion and hosting for our services.
Stripe — subscription payment processing.
Brevo — delivery of product update emails. We send these only if you opt in, and you can unsubscribe at any time.
OpenFreeMap — the in-app map loads tiles from tiles.openfreemap.org; like any web server, it receives your IP address and the map area requested. No measurement data is sent to it.
OpenStreetMap Foundation — the device location-confirmation preview loads a small grid of map tiles from tile.openstreetmap.org; it receives your IP address and the map area requested (which corresponds to the scanner location being confirmed). No measurement data is sent to it. Use is subject to the OSMF tile usage policy.
TidyCal — demo scheduling on our websites.

Device software updates

When you update a scanner's software from the app and the scanner has no internet connection of its own, the app relays the scanner's download traffic through your phone's connection (which may be mobile data). During an update, the package servers involved — pkgs.surfscan.net, deb.debian.org, security.debian.org, archive.raspberrypi.com, packagecloud.io, and github.com — receive your phone's IP address, as with any download. No personal or measurement data is sent to them; the relay is active only while an update you started is running.

These providers process data on our behalf. We do not sell your data, and we do not share it with advertisers or data brokers. Your measurement data is visible to your own organization's account(s) in our reporting tools.

Access within your organization

Access control is enforced at the database layer, scoped to your organization: your organization's scan data is visible only to your organization's authorized users, unless you use a sharing or publication feature.

Anonymized network intelligence

We use measurement data to build anonymized, aggregated network intelligence — area-level statistics about network coverage and capacity. Before any measurement enters an anonymized or published dataset, we remove everything that identifies you: organization and account identifiers, user identities, device identifiers and serial numbers, free-text fields such as session names and notes, and precise GPS coordinates. What remains is the measurement itself — network, band, and signal metrics — presented at hexagonal map-cell granularity (currently H3 resolution 9, roughly 0.1 km² per cell), together with the scanner type and the date of the scan session. We never label published data with your identity, and recipients of published data are contractually prohibited from attempting to re-identify contributors.

For subscribers, this use is part of the SurfScore™ Subscription Terms (see "Your Data and Our Data" there); the description here and the description there are intended to match exactly. If you ever find they don't, tell us — the stricter reading applies until we fix it.

Retention and deletion

Active accounts: we keep your account data and measurement data for as long as your account is active — the kept record is a core function of the platform.
After cancellation: account and measurement data are retained for 90 days so reactivation restores your record, then deleted from active systems. Backup copies are purged on our normal backup cycle.
On request: you can ask for deletion sooner — we act on deletion requests within 30 days, subject to legal retention obligations (e.g. billing records we must keep for tax purposes).
Anonymized data (including anonymized geolocation data) contains no identifiers and persists after account deletion per the section above.
Geolocation data (non-anonymized) is retained for 90 days after your account is closed, then deleted from active systems.
Website contact data: demo and inquiry records are kept only as long as needed to handle your request and any follow-up you've opted into.

Your rights

You may request access to, correction of, deletion of, or a copy of your personal information by contacting support@waveriders.live. You can withdraw consent at any time. Subscribers can export their measurement data directly from the platform (CSV/JSON) at any time. We honor applicable rights under state privacy laws, which can be found at the end of the Privacy Policy. Data is hosted in the United States, in the AWS us-west-2 region (Oregon); where required, transfers rely on standard contractual clauses.

Security

Data in transit to our backend uses TLS. Credentials stored on the phone use Android's encrypted storage. Measurement data is stored with organization-scoped access control enforced at the database layer. Connections from the app to your own scanner hardware occur over your local network (your scanner's Wi-Fi or a direct USB link). No internet transmission or storage system is 100% secure; if a breach affects your personal data, we will notify you as required by law.

Children

SurfScan™ and SurfScore™ are not permitted to be accessed or used by anyone under 13 years old. We do not knowingly collect data from children.

Changes

We will update this policy as the product changes and revise the effective date above. Material changes will be noted in the app's release notes and, for platform subscribers, by email.

Contact

Waveriders Collective Inc. (a Delaware corporation), 8 The Grn Ste A, Dover, DE 19901, USA · support@waveriders.live

Consumer Privacy Notice

The following terms are applicable only to residents of the listed jurisdictions.

1. About this Privacy Notice

Pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Data Privacy Act, New Jersey Data Privacy Act, Oregon Consumer Privacy Act, Rhode Island Data Transparency and Privacy Protection Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act and their respective implementing regulations (collectively, "U.S. Consumer Privacy Laws"), and pursuant to the EU General Data Protection Regulation (EU GDPR) in the European Economic Area (EEA), and the UK General Data Protection Regulation (UK GDPR), and their respective implementing regulations (collectively, "EU/UK Consumer Privacy Laws"), Waveriders Collective Inc. ("we," "us" or "our") are providing this Consumer Privacy Notice ("Notice"). This Notice supplements our Privacy Policy.

2. Personal Information Collected, Processed and Disclosed

We collect and disclose, and have collected and disclosed in the preceding 12 months, the following categories of personal information:

Identifiers such as your name, Internet Protocol address, email address, account name, and other similar identifiers.
Personal information as defined in applicable customer records law, such as name and contact information.
Commercial information, such as transaction information, purchase history, financial details, and payment information.
Internet or other electronic network activity information, such as interactions with our websites, applications, and systems.
Geolocation data, such as approximate device location.

We collect this personal information from you and we may use this personal information to operate, manage, and maintain our business, to provide our products and services, to communicate with you, for our vendor management purposes, and to accomplish our business purposes and objectives, including, for example, using personal information to: develop, improve, repair, and maintain our products and services; process or fulfill a request or other transactions submitted to us; conduct research, analytics, and data analysis; maintain our facilities and infrastructure; undertake quality and safety assurance measures; conduct risk and security control and monitoring; prevent, detect and investigate fraud or other illegal actions; perform identity verification; perform accounting, audit, and other internal functions; comply with law, legal process, and internal policies; maintain records; exercise and defend legal claims; and fulfill legal obligations.

We disclose, and have disclosed in the preceding 12 months, each of the above categories of personal information for our operational business purposes to all of the following categories of recipients: service providers and contractors, such as cloud service providers, data providers, and providers of security, technical, and operational services; agents and representatives; and other parties where required by law or to protect our rights.

Subject to your consent where required by applicable law, we may use sensitive personal information specifically for the following purposes: perform our services or provide products or services as requested by you; prevent, detect and investigate security incidents or malicious, deceptive, fraudulent or other illegal actions; short-term, transient use such as displaying first party, non-personalized advertising; perform services on our own behalf, such as maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, or providing analytic services, storage or similar services for the business; and activities relating to quality and safety control or product improvement.

For EEA Data Subjects: The above list does not apply to special category personal information, which we will only process with your explicit consent.

3. Personal Information Sold

We do not knowingly sell any personal information.

We do not knowingly sell the personal information, including the sensitive personal information, of consumers under 16 years of age within the scope of the application of the CCPA. We also do not collect, use, or sell personal information for the purpose of training large language models.

4. Personal Information Shared

We do not knowingly share personal information with advertisers or data brokers.

We do not knowingly share the personal information, including the sensitive personal information, of consumers under 16 years of age within the scope of the application of the CCPA.

5. Retention

We retain your personal information for as long as necessary to provide our products and services to you and fulfill the transactions you have requested, or for other essential purposes such as complying with our legal obligations, maintaining business and financial records, resolving disputes, maintaining security, detecting, and preventing fraud and abuse, and enforcing our agreements. The criteria used to determine retention periods includes the legal limitation of liability period, agreed contractual provisions, applicable regulatory requirements, and industry standards.

6. Consumer Rights

If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia consumer:

Right to Know. You may request to know whether we process your personal information and to access such personal information.

In addition, if you are a California consumer, you may request that we disclose to you the following information as required by law: (i) the categories of personal information we collected about you and the categories of sources from which we collected such information; (ii) the business or commercial purpose for collecting, selling or sharing personal information about you; (iii) the categories of personal information about you that we sold or shared and the categories of third parties to whom we sold or shared such information; (iv) the categories of personal information about you that we disclosed for a business purpose and the categories of service providers and contractors to whom we disclosed such personal information; and (v) the categories of third parties to whom we disclosed your personal information.

If you are a Minnesota or Oregon consumer, you may also request that we disclose to you (i) the categories of personal information we process about you and (ii) the third parties to which we have disclosed your personal information.

If you are a Connecticut resident, you may also request that we disclose to you the third parties to whom we have sold your personal information.

If you are a Delaware or Maryland consumer, you may also request that we disclose to you the categories of third parties to whom we disclosed your personal information.

You may request to receive a copy of your personal information, including specific pieces of personal information, including, where applicable, to obtain a copy of your personal information in a portable, readily usable format.

Right to Delete. You may request that we delete your personal information, subject to certain exceptions.

Right to Correct. You may request to correct inaccuracies in your personal information.

Right to Opt-Out. We do not sell your personal information to third parties. However, if we decide to do so in the future, you may request to opt-out of the sale of your personal information to third parties, as defined by applicable law. This right may be exercised by submitting a request via email to support@waveriders.live.

We do not share your personal information for cross-contextual behavioral advertising or targeted advertising. However, if we decide to do so in the future, you may request that we do not share your personal information for cross-contextual behavioral advertising or targeted advertising by utilizing the "Cookie Settings" link on our websites that use tracking technologies for such purposes or by sending an opt-out preference signal supported by your device or browser. Your use of an opt-out preference signal will apply only to your device or browser and not to other personal information that is not linked to your device or browser.

No Retaliation. We will not retaliate against you because you exercise any of your rights under the U.S. Consumer Privacy Laws.

Metrics. We compile certain metrics related to California consumer requests for the previous calendar year which are available here.

7. How to Make a Request

You may make a request described above via email to support@waveriders.live or U.S. Mail:

Waveriders Collective Inc.
8 The Grn Ste A
Dover, DE 19901
USA

You may be required to submit proof of your identity for certain of these requests to be processed. Such information may include your name, address, or government ID. This information will be used only for the purpose of verifying your identity and processing your request. We may not be able to comply with your request if we are unable to confirm your identity or to connect the information you submit in your request with personal information in our possession.

You may designate an authorized agent to make a request on your behalf subject to proof of identity and written authorization. Requests made through an authorized agent should be made via the same methods above. As part of our verification process, we may request that the agent provide, as applicable, proof concerning his or her status as an authorized agent. In addition, we may require that you verify your identity as described above or confirm that you provided the agent permission to submit the request.

We will respond to your request consistent with applicable law. If we refuse to take action on your request, you may appeal this refusal within a reasonable period after your receipt of the decision by submitting a request for appeal via email to support@waveriders.live with the subject line "Appeal," or by U.S. Mail to the address above.

8. Rights of EEA Data Subjects

(A) Your Rights Under the EU GDPR.

Right to Be Informed — the right to know or be notified about the collection and use of your personal information.
Right to Access — the right to be provided with a copy of your personal information.
Right to Rectification — the right to require us to correct any mistakes in your personal information.
Right to be Forgotten — the right to require us to delete your personal information — in certain situations.
Right to Restriction of Processing — the right to require us to restrict processing of your personal information — in certain circumstances, e.g., if you contest the accuracy of the data.
Right to Data Portability — the right to receive the personal information you provided to us, in a structured, commonly used, and machine-readable format and/or transmit that data to a third party — in certain situations.
Right to Object — the right to object at any time to your personal information being processed for direct marketing (including profiling), and in certain other situations to our continued processing of your personal information, e.g., processing carried out for our legitimate interests.
Right Not to be Subject to Automated Individual Decision-Making — the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

(B) Where Your Personal Information is Held. Information may be held at our offices and third-party service providers, representatives and agents as described above (see "Personal Information Collected, Processed and Disclosed").

Some of these third parties may be based outside the EEA. For more information, including on how we safeguard your personal information when this occurs, see below: "Transferring Your Personal Information Out of the EEA."

(C) Transferring Your Personal Information Out of the EEA. To deliver services to you, it is sometimes necessary for us to share your personal information outside the EEA, e.g.: with our offices outside the EEA; with your and our service providers located outside the EEA; if you are based outside the EEA; or where there is an international dimension to the services we are providing to you. These transfers are subject to special rules under European and UK data protection law. Non-EEA countries do not have the same data protection laws as the United Kingdom and EEA. We will, however, use our best efforts to ensure the transfer complies with data protection law and all personal information will be secure. If you would like further information, please contact us at support@waveriders.live.

(D) How to File a GDPR Complaint. We hope that we can resolve any query or concern you raise about our use of your information. The GDPR also gives you the right to lodge a complaint with a supervisory authority, in the EEA state where you work, normally live, or where any alleged infringement of data protection laws occurred. The supervisory authority in your country is the entity who you should contact.

9. Notice of Financial Incentives

We do not offer financial incentives, including price or service differences, to consumers in exchange for the collection, retention, sale or sharing of their personal information.

10. De-Identified Information

Where we maintain or use de-identified data, we will continue to maintain and use the de-identified data only in a de-identified fashion and will not attempt to re-identify the data.

11. Changes

We will update this Notice from time to time. Any changes will be posted on this page with an updated revision date.

12. Contact

If you have any questions or concerns regarding this Notice or our processing of your personal information, please contact us at support@waveriders.live.