HomeBreak Privacy Policy

HomeBreak is operated by Mangold Holdings, LLC, a California limited liability company, 67410 N Laguna Dr, Cathedral City, CA 92234, USA ("HomeBreak", "we", "us"). This policy explains what we collect when you use the HomeBreak apps for iOS and Android, the website at homebreak.app, and school websites hosted on HomeBreak (together, the "Service"), and what we do with it. The English version controls; translations are provided for convenience.

HomeBreak connects surf and other action-sport schools with their students. A school runs its lessons, its students and its video coaching on HomeBreak. Students use the app to book, send clips, get reviews and drills, and keep a Surf Passport of the skills they have learned.

1. Information we collect

Account information. Your email address, your name and preferred name, an optional profile photo, your home city and stance if you add them, and a confirmation that you are 13 or older. We do not collect your date of birth. If you sign in with Apple or Google instead of a password, we receive your name and email from them (Apple may give you a private relay email instead of your real one, which keeps that account separate from any other you have with your real email).

School information. If you run or work at a school: the school's name, address, spot, contact details, lessons, prices, schedule, team members and their roles, and website content you publish.

Lessons and bookings. The lessons you book or teach, the people attending (including the name of a child a parent books for), check-ins, and notes your instructor records about your sessions.

Video and coaching. Video clips you or your school upload, which may show you and other people, including minors filmed during lessons. Instructors' review notes and drawings on those clips, the drills they assign, and whether you mark them done.

Surf Passport. The skills an instructor signs off for you, the schools you have visited, and your level. When you share your passport with a school, that school can see what you choose to share, until you stop sharing.

Billing (schools only). When a school starts a plan, Stripe collects the card and billing details. We never see or store full card numbers. We keep the plan, its status and Stripe's customer and subscription references.

Messages you send us. Support requests and anything you include in them.

Collected automatically. The app and website record product events (for example "clip sent" or "booking made") with the platform (web, iOS or Android) and time, linked to your account when you are signed in. These events never contain your name, email or phone number. We also process your IP address and browser or device type to keep the Service secure, prevent abuse and run rate limits, and we record them with sensitive actions in our audit log.

We do not collect your precise location, contacts or health data, and we do not use advertising identifiers.

Permissions on your phone. The app asks to read your photo library only when you choose a video to send, and to add events to your calendar only when you add a lesson to it. It never reads your calendar.

Reports and blocks. When you report content or block someone we keep who reported it, what was reported, the reason you chose and what we decided, so we can act on it and prevent abuse. We do not tell the person you reported who reported them.

2. How we use information

To provide and run the Service: your account and sign-in, bookings, video coaching, drills, the Surf Passport, school websites and schools' dashboards. To send service emails (sign-in links, invitations, booking and review updates). To bill schools for their HomeBreak plan. To keep the Service secure, prevent fraud and abuse, and debug it. To understand how the Service is used and improve it. To meet legal obligations.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to train third-party AI models.

3. Who sees what

Your school. Owners, admins and instructors at the schools you book with or join see what they need to teach you: your name, bookings, clips you send them, the notes and drills they create for you, and the sign-offs they give. A school sees another school's information about you only when you share your passport with it.

Other students. Clips can be tagged with more than one student from the same lesson; each tagged student can see that clip.

The public. A school's published website is public. It shows the school's own information and the team members who choose to appear on it. Students' information is never shown on a school website.

HomeBreak staff. A small number of staff can access accounts to provide support, investigate reports and keep the Service safe. Every such access is logged. Staff do not watch students' video except to handle a report.

4. Service providers

We share information with providers who process it for us under contract:

• Supabase: database, sign-in and file storage, including video.
• Google Cloud: every clip you upload is checked automatically for sexual content, nudity and violence before anyone but you can watch it; the video is copied there for the length of that check, then deleted.
• Apple and Google: if you choose Sign in with Apple or Sign in with Google, they confirm your identity and share your name and email with us as you allow.
• Vercel: website and server hosting.
• Stripe: schools' plan billing and payments.
• Resend: sending emails.
• Cloudflare (Turnstile): checking that sign-ups and forms come from people, not bots.
• Expo: delivering the mobile app and its updates.
• Google Workspace: our support and business email.

Surf reports shown in the Service come from Coastly, a service also operated by Mangold Holdings, LLC. We send Coastly only a school's surf spot, never your personal information.

We may also disclose information to comply with the law or a valid legal request, to protect the safety of any person, to enforce our terms, or as part of a merger, acquisition or sale of assets, where it would remain subject to this policy.

5. Your choices and rights

You can view and edit your profile in the app. You can delete your account in the app (Account, then Delete account) or on the website. Deletion removes your profile, your photo and the clips you uploaded, and removes or de-identifies your personal information in schools' records, as described in section 6. Lesson video that a school filmed stays with that school; you can ask the school, or us at privacy@homebreak.app, to remove a clip of you.

You can stop sharing your passport with a school at any time.

You can ask for a copy of your information, or ask us to correct or delete it, by writing to privacy@homebreak.app. We will verify the request and respond within the time the law requires.

California residents. You have the right to know what personal information we collect and how we use it, to access, correct and delete it, and to not be discriminated against for using these rights. We do not sell or share personal information as those terms are defined by California law.

EEA, UK and other regions. Where your local law gives you rights to access, correct, delete, restrict, object to or port your information, you can exercise them by writing to privacy@homebreak.app. We rely on our contract with you, our legitimate interests in running and securing the Service, and our legal obligations as the bases for processing. You may complain to your local data protection authority.

6. How long we keep information

We keep account information while your account is active. When you delete your account, we delete your profile, photo and the clips you uploaded, and we remove or de-identify your personal information in schools' records (for example, your name on bookings becomes "Deleted account"). Lesson video a school filmed is the school's record and stays with it. A school keeps its own business records (for example, that a lesson took place and was paid for) without your name or contact details. Audit and security logs are kept for as long as needed for security and legal purposes. Backups are overwritten on our providers' standard schedules. Billing records are kept as long as tax and accounting law requires. Reports are kept for two years.

7. Children

The Service is not directed to children under 13, and no one under 13 may create an account. A parent or guardian may book lessons for a child on the parent's own account; the child's name is then part of the parent's booking. Schools may film minors during lessons and share those clips with the student or the parent who booked; schools are responsible for having the permission of a parent or guardian to film a minor. If you believe a child under 13 has created an account, or want a clip of your child removed, write to privacy@homebreak.app and we will act on it promptly.

8. Security

We use reasonable technical and organizational measures to protect information, including encryption in transit, row-level access controls in the database, logged staff access and two-factor authentication for staff. No system is completely secure.

9. International users

HomeBreak is operated from the United States and our providers may process information in the United States and other countries. Where the law requires, we use appropriate safeguards for international transfers.

10. Changes to this policy

We may update this policy. We will change the "Last updated" date and, for material changes, give notice in the Service or by email before the change takes effect.

11. Contact

Privacy requests: privacy@homebreak.app Support: support@homebreak.app Mangold Holdings, LLC, 67410 N Laguna Dr, Cathedral City, CA 92234, USA