Privacy Policy

1. Introduction

This Privacy Policy describes how Mojibake Ltd, a company registered in the United Kingdom, processes personal data when you use the Service at divingaroundtheworld.com or our mobile application.

Data controller: Mojibake Ltd is the data controller for the personal data described in this policy, except where we act as a processor for content you publish to other users.

How to contact us: You can reach our support and privacy team at [email protected]. We respond to privacy enquiries as quickly as we reasonably can, and within statutory deadlines where they apply.

Governing law: The Service is operated from the United Kingdom and is governed by the laws of England and Wales. The UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 apply to our processing of your personal data. The Service is available globally, but use of the Service is on the basis of these terms.

2. Strict 18+ Age Limitation

The Service is intended exclusively for adults aged 18 or over. We enforce this at signup by requiring a date of birth and rejecting any account where the user would be under 18. The minimum age is also enforced when you edit your profile.

We do not knowingly collect personal data from anyone under 18. If we become aware that an account belongs to a person under 18, we will delete the account and any associated personal data. If you believe a child has created an account, please contact us at [email protected].

3. Information You Provide Directly

We collect information you give us when you create an account, complete your profile, or use Service features.

Account and authentication:

• Email address and a password (minimum 8 characters, mixed case, including a number).
• First name (required), last name (optional), and date of birth (required, must be 18+).
• If you sign in with Google, Apple, or Facebook, we receive an authorization code that our backend exchanges for limited profile information. For Apple, on first authorization the provider also sends your first name, last name, and email address.
• Linked social-account metadata: the provider, the email address from that provider, the display name, an avatar URL, and timestamps for when the link was created and last used.
• Email-verification status and password-reset tokens sent to your email when you request a reset.
• Authentication tokens (JWT access and refresh tokens) which the Service issues to keep you signed in.

Profile information:

• First name (required), last name, date of birth, a short bio (up to 500 characters), city, country (as an ISO country code), and languages you speak (up to 10, as ISO 639-1 codes).
• An avatar image, up to 5 MB.
• Buddy-matching age preferences (a minimum and maximum age between 18 and 60).
• Display preferences such as temperature unit (Celsius or Fahrenheit), distance unit (metric or imperial), and app language.
• An optional phone number, which can only be set from the mobile app and is read-only on the web.
• Your notification preferences for each notification category and channel.
• An opt-in preference for whether travel operators may contact you with relevant offers.

User-generated content: reviews you post, travel plans you create, messages you send to connected users, photos you upload (avatars and message attachments), and dive sites you save. See the dedicated section on user-generated content below for details on visibility.

4. Information Collected Automatically

When you use the Service, certain information is collected automatically about your device and usage.

• Technical and log data: your IP address, browser or device identifiers, operating system, referring pages, and timestamps. We use this for security, abuse prevention, fraud detection, and operational stability.
• Product analytics events: page views, clicks, and specific events such as signup, login, logout, viewing a site, searching, filtering, creating a plan, sending a message, and opening the map. These are processed by PostHog (see the third-party section).
• Session replay: PostHog records on-page interactions (clicks, scrolls, and page navigation) so we can diagnose issues and improve usability. We configure session recording to mask all form input values (including passwords, email addresses, dates of birth, phone numbers, search queries, and free-text fields), so the contents of what you type into forms are not captured. Replays show page structure and where you clicked, but not the text you entered.
• Feature flags: PostHog also delivers feature flags that determine which features are visible to you.
• Real-time notifications: while you are signed in, the Service maintains an authenticated Server-Sent Events connection to deliver in-app notifications.

PostHog is initialised only when an API key is configured for the build, and our integration honours the Do Not Track browser signal.

5. Location Data

We use location data only in limited and predictable ways.

• On-demand browser geolocation: when you click "Find nearby sites" or "Use my location", your browser asks your permission and sends your latitude and longitude to our API as query parameters so we can return nearby dive sites. This location is not stored on your device beyond the current session and is not saved to your profile.
• Travel-plan destinations: when you create a travel plan, the location you choose (latitude and longitude as a GeoJSON Point, plus a free-text place name) is stored on our servers so we can match your plan with nearby plans, sites, and divers.
• Notification radius: if you use travel-plan matching, you can set a notification radius between 10 and 100 km.
• Profile visibility: if you enable "show on profile" for a travel plan, the plan (including its location and dates) becomes publicly visible on your profile.

We do not collect precise background location, and we do not track your location continuously. Map tiles displayed in the Service are loaded from third-party tile providers (see the third-party section); when you view a map your IP address will be visible to those providers as a normal part of how the web works.

6. User-Generated Content and Visibility

Some of the data you create on the Service is intended to be visible to others. Please consider what you share.

• Reviews: a 1–5 star rating, an optional title (up to 100 characters), and an optional comment (up to 2000 characters). You may post a review anonymously, in which case your identity will not be displayed alongside the review, but we still associate the review with your account internally for moderation and abuse-prevention purposes.
• Travel plans: location, name, start and end dates, and free-form fields such as certification and experience. Visibility flags you set on a plan determine whether it is shown publicly on your profile and whether it is matched with other users.
• Messages: 1:1 private chat between connected users, including text and image attachments. Edits and deletions are recorded. "Delete for me" only removes a message from your view; the message remains visible to the other party. Please do not assume messages are confidential beyond the recipient.
• Photo uploads: avatars and message attachments are uploaded directly to S3-compatible object storage using presigned URLs. Profile photos are visible to other users; message attachments are visible to the other participant in the conversation.
• Saved places: dive sites you save are stored against your account.
• Connections: you can send connection requests by user ID or by email address. If you invite someone by email who is not yet a user of the Service, we will send them an invitation email; we do not use that address for any other purpose. You can see your accepted connections, your incoming and outgoing pending requests, and any users you have blocked.

Once content is visible to other users, those users may see it, screenshot it, or recall it even after you later delete or edit it.

7. Cookies and Similar Technologies

We use a small number of cookies and browser-storage entries to operate the Service. These are summarised below.

First-party cookies:

• hl: stores your preferred language. One-year expiry. SameSite=Lax. Secure when served over HTTPS.

Browser localStorage:

• auth_token and refresh_token: JWT tokens used to keep you signed in. They are sent in Authorization headers to our API.
• user_data: a JSON copy of your profile, kept locally so the app can render quickly without re-fetching.
• Small UI preferences such as siteDetailMapZoom.

Browser sessionStorage:

• oauth_state: a transient anti-CSRF token used during OAuth sign-in (lifetime around 15 minutes).

Third-party cookies and storage: when product analytics are enabled, PostHog sets its own cookies and localStorage entries to identify your device for analytics and session replay.

We do not register a service worker on the web app and we do not use web push notifications on the web. You can clear cookies and storage from your browser at any time; doing so will sign you out and reset your local preferences.

8. How We Use Your Information and Our Legal Bases

Under UK GDPR Article 6, we must rely on a lawful basis to process your personal data. The table-style breakdown below shows what we do and why.

To provide the Service (Article 6(1)(b) — performance of a contract):

• Creating and authenticating your account.
• Storing your profile, preferences, and content.
• Matching travel plans, suggesting buddies, and showing nearby sites when you ask us to.
• Sending and receiving messages between connected users.
• Uploading and serving photos via object storage.

To keep the Service safe and reliable (Article 6(1)(f) — legitimate interests):

• Detecting, investigating, and preventing abuse, fraud, spam, harassment, and security incidents.
• Maintaining basic operational logs (including IP and device data) to keep the Service stable.
• Moderating content, including content that has been deleted by the author but is still subject to dispute or report.
• Improving the Service through aggregated analytics and bug diagnosis.

With your consent (Article 6(1)(a)):

• Using your browser geolocation when you click a button asking us to use it.
• Sending you marketing communications or sharing limited details with travel operators if you have opted in to be contacted by partners.
• Loading optional analytics, including session replay, where consent is required by your jurisdiction.

To comply with our legal obligations (Article 6(1)(c)):

• Responding to valid legal requests, court orders, or regulatory enquiries.
• Keeping records necessary to comply with tax, accounting, and other statutory obligations.

We do not carry out automated decision-making with legal or similarly significant effects on you, and we do not engage in profiling for such decisions.

9. Sharing Your Information

We do not sell your personal data. We share it only with the categories of recipient described below, and only to the extent necessary.

Other users of the Service: your public profile, public reviews, public travel plans (where you have enabled "show on profile"), and messages you send to your connections are visible to those users.

Third-party processors and sub-processors: we use the following providers to run the Service. Each operates under appropriate contractual safeguards.

• PostHog — product analytics, session replay, and feature flags. Default host app.posthog.com (United States).
• S3-compatible object storage provider — stores avatar images and message attachments and serves them via presigned URLs.
• CartoCDN basemap tile servers — deliver map tiles on the Discover and Map Search pages.
• OpenStreetMap — we embed an OpenStreetMap iframe on the travel-plan detail page; OpenStreetMap will see the request your browser makes to load the map.
• Google, Apple, and Facebook — OAuth identity providers, used only when you choose to sign in with one of them.
• Our backend infrastructure — our API at api.divingaroundtheworld.com (and api-staging.divingaroundtheworld.com for staging environments) and the underlying hosting, database, and email-delivery providers we use to run it.

Authorities and legal requirements: we may disclose information to courts, regulators, or law enforcement where we are legally required to do so, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of users, the public, or Mojibake Ltd.

Corporate transactions: if Mojibake Ltd is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will tell you in advance and your rights under this policy will continue to apply.

10. International Transfers

Mojibake Ltd is based in the United Kingdom, but some of our processors and infrastructure operate outside the UK and the European Economic Area, including in the United States. When we transfer personal data outside the UK, we use one or more of the following safeguards required by the UK GDPR:

• UK Adequacy Regulations, where the destination country has been recognised by the UK as providing an adequate level of protection.
• The UK International Data Transfer Agreement (IDTA), or the European Commission Standard Contractual Clauses (SCCs) together with the UK Addendum, executed with the relevant processor.
• Additional technical and organisational measures, such as encryption in transit, access controls, and contractual restrictions on use, where these are necessary to ensure an essentially equivalent level of protection.

If you would like more information about the safeguards we have in place for a specific transfer, please contact us at [email protected].

11. Data Retention

We keep personal data only for as long as we need it for the purposes described in this policy or as required by law. The general principles we follow are:

• Account data: retained for as long as your account is active. If you ask us to delete your account, we will delete or anonymise your account data within 30 days, except where we must retain certain information for legal, tax, accounting, or fraud-prevention reasons.
• Profile and content: retained while your account exists. Public reviews and travel plans are removed from public view when your account is deleted; messages may remain visible to the other party where they have already been delivered.
• Messages: retained while either participant retains a copy. "Delete for me" removes a message from your account but does not delete the recipient's copy.
• Authentication logs and security data: retained for a limited period for fraud prevention and incident investigation.
• Backups: personal data may persist in encrypted backups for a short additional period after deletion from production systems before being overwritten on the normal backup rotation.
• Analytics data: PostHog event and session-replay data are retained for the period set in our PostHog configuration, after which they are deleted automatically.
• Email-invitation data: if you invite a non-user by email, we keep the invitation record only as long as needed to manage that invitation.

12. Your Rights Under UK GDPR

Subject to the conditions in the law, you have the following rights in relation to your personal data:

• Right of access: you can ask us for a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete personal data.
• Right to erasure: you can ask us to delete your personal data in certain circumstances (also called the "right to be forgotten").
• Right to restriction of processing: you can ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: you can ask us to provide your personal data in a structured, commonly used, machine-readable format, or to transmit it directly to another controller, where it is technically feasible.
• Right to object: you can object to processing based on our legitimate interests, including profiling, and to processing for direct marketing.
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
• Rights related to automated decision-making: we do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, email [email protected]. We may need to verify your identity before acting on a request, and we will respond within the timeframes set by law (usually one month).

Right to complain: if you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

13. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using HTTPS / TLS.
• Hashing of passwords using industry-standard algorithms.
• Authentication using short-lived JWT access tokens and refresh tokens.
• Access controls and least-privilege principles for staff who can access production systems.
• Use of presigned URLs for media uploads so that uploads go directly to object storage and are not staged on our application servers.
• Logging and monitoring to detect and respond to suspicious activity.

No system can be guaranteed to be completely secure. You also have an important role to play: choose a strong, unique password, do not share it, and sign out of devices you no longer use. If you believe your account has been compromised, contact us immediately at [email protected].

14. Account Deletion and Data Export

Account deletion: the web app does not currently include an in-app delete-account flow. To delete your account, please email [email protected] from the email address associated with your account, or otherwise verify your identity. We process verified deletion requests within 30 days. Some information may be retained for limited legal, accounting, or fraud-prevention purposes, as described in the retention section.

Data export: to receive a copy of the personal data we hold about you, email [email protected]. We will provide your data in a commonly used machine-readable format.

Please note that messages you have sent to other users may remain visible to those users after your account is deleted, because they are part of the recipient's conversation history.

15. Communications and Marketing

Service messages: we send you transactional and Service-related messages such as email verification, password resets, security alerts, and notifications you have configured. These are part of providing the Service and are not marketing.

Notification preferences: you can configure each notification category (messages, connection requests, travel-plan matches, nearby divers, promotions and deals, site updates) to be delivered by push, email, or not at all. You can change these settings at any time in the app.

Travel-operator marketing: if you have enabled the "contact by travel operators" preference, we may share limited details with travel operators or send you offers from them. This preference is opt-in and you can switch it off at any time. Withdrawing consent does not affect the lawfulness of any sharing carried out before you withdrew it.

16. Children

The Service is for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use the Service or submit any personal data to us.

If we discover that an account has been created by a person under 18, we will delete the account and any personal data associated with it. If you are a parent or guardian and believe a child has provided us with personal data, contact us at [email protected].

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices, or applicable law. The "Last updated" date displayed on this page indicates when the policy was last changed.

If we make material changes, we will take reasonable steps to notify you, for example by an in-app message or by email to the address associated with your account. Your continued use of the Service after the updated policy comes into effect means you accept the updated policy.

18. Contact and Complaints

Contact us: for any privacy questions, requests, or concerns, email [email protected].

Operator: Mojibake Ltd, registered in the United Kingdom.

Supervisory authority: if you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom at ico.org.uk, or with the data protection authority in your country of residence or place of work.