Privacy policy
Last updated: 21 October 2026
Gustly is a kite forecast, map and chat, a project run by one person, Dr. Berend Gort. It shows no ads, sells no data and has no analytics or tracking scripts. This page says exactly what it keeps about you, why, who else sees it, and how you get rid of it.
Who is responsible
The data controller is Dr. Berend Gort, a private person in Spain. Write to privacy@gustly.org for anything on this page. The postal address is on the legal notice.
What Gustly keeps, and why
| What | Why | Legal basis |
|---|---|---|
| Your Google account basics: name, email, profile picture link and Google's id for your account, plus when you joined and last signed in. Gustly asks Google for nothing else and keeps no Google password or access token. | To sign you in and keep your things under your account. | Contract (running the service you signed up for) |
| Your rider profile: sports and level, weight, kites, boards, wetsuits, wind limits, session hours, home spot and drive distance, time zone, the setup story you tell, your own spots, hidden spots, and your answers to "how was your session?" check-ins. | To give calls that fit you, your gear and your home water. | Contract |
| Your chats: your messages, Gustly's answers, and the forecast cards and maps shown with them. | So you can go back to a chat and the AI can follow the conversation. | Contract |
| Usage record: which controls you use (for example opening the map, dropping a pin, which includes its coordinates), how a chat answer went (timings, which forecast tools ran), never what you typed and never audio. | To see what works and what confuses riders, and fix it. | Legitimate interest. It is on unless you switch off "Help improve Gustly" in Settings, Account; off means no more usage records. |
| AI cost record: for each chat answer, the model, tokens used and cost. | To keep the service within budget and stop abuse. Kept even with "Help improve Gustly" off. | Legitimate interest |
| Feedback you send: your text and rating, screenshots you attach (shrunk and stripped of hidden photo data), an AI-written caption and summary, and the page state at the time (screen size, browser, map position rounded to about 1 km, recent errors). | To understand and fix what you report. We may reply in Gustly with one line on what we did; the reply is kept with your feedback and deleted with it. | Consent (you choose to send it) |
| Notes from the Gustly team: the note we send you, and when it first showed and when you closed it. | So you see the note once, and we know it reached you. | Contract (the service you signed up for) |
| Voice messages: the clip is turned into text and the text comes back to you. The audio and the transcript are not stored or logged. | So you can talk instead of type on the beach. | Consent (you press the mic) |
| Shared days: when you share a day, Gustly keeps a copy of that day's forecast at the spot, the spot's name and location, your call and your first name, so the link works for anyone you send it to. Anyone with the link can see that copy and the live forecast for that spot. | So your mates can open the day you sent them. | Consent (you press Share) |
| Alert history: a record of each spot and day Gustly checked for you, and which ones it told you about in the chat: the call (SEND IT or GREEN LIGHT), the best two hours, when you opened it, and your answer ("Great call", or "Not for me" with its reason). It is kept for riders who have a home spot and rules of their own, so Gustly can send alerts without a setting to switch on. | To show you what you were sent and why, and to learn your limits. | Contract (running the service you signed up for) |
| Abuse protection: your IP address is used as a short-lived counter (one minute) for sign-in, map tile and share link rate limits. Your account also has counters for how often you send feedback or share a day, kept for up to a day. Neither is written to the database. The hosting platform keeps standard server logs. | To keep the service up for everyone. | Legitimate interest |
Spot alerts in the chat
When a spot you care about fits your rules, Gustly keeps a record of it and shows it in your chat the next time you open Gustly. Your answers change your learned limits (Settings, Wind, Learned). Gustly sends no notifications to your phone or computer, and no alert leaves Gustly's own servers. To stop alerts, say "stop alerts" to the chat.
How long it is kept
Your account, rider profile, spots, chats and the notes the Gustly team sent you stay until you delete them: one chat or all chats in Gustly, or your whole account (below). The notes go with your account. The rest is cleared automatically every day:
- the usage record after 12 months;
- alert history 90 days after the day the alert is for;
- the AI cost record after 24 months;
- shared days 90 days after the day they are for, or at once when you delete your account;
- feedback you sent, with its screenshots and any reply to it, after 12 months;
- feedback you started but never sent after 30 days;
- sign-ins, on each device, after 30 days.
Voice is never kept at all. Signing out ends that sign-in on Gustly's server, not only in your browser; deleting your account ends all of them.
Who else sees it
No one buys or gets your data for their own use. These services handle parts of it to run Gustly:
- Railway hosts Gustly's servers, database and cache, in the United States.
- OpenRouter passes your chat to an AI model and returns the answer. Gustly sends your messages, the last 20 messages of that chat, and a short summary of your rider profile (gear, weight, wind limits, home label), never your name, email or picture, and a coded id instead of your account number. Every request tells OpenRouter to use only providers that keep no copy and do not train on it. The models Gustly uses today are DeepSeek V4.1 Flash and Xiaomi MiMo, run by providers such as Inference.net, DeepInfra, Morph, Novita and Xiaomi. OpenRouter also turns voice clips into text (Whisper) and writes captions and summaries for feedback.
- Google signs you in. Your browser loads your profile picture from Google.
- Cloudflare Turnstile checks that a sign-in comes from a person, not a bot, without a puzzle. When you reach for "Sign in with Google", your browser loads Cloudflare's check, which reads signals about your browser and sees your IP address; Gustly's server then asks Cloudflare once whether the check passed and sends it your IP address. Cloudflare gets no name, email or account id. It runs only on the login page, never once you are signed in.
- Open-Meteo, OpenStreetMap services (Nominatim, Overpass) and OpenFreeMap get coordinates or place names to fetch forecasts, find places and draw the map. Gustly's servers send them no name, email or account id. Your browser loads map tiles from OpenFreeMap directly, so they see your IP address as any website you visit would.
Railway, OpenRouter, Google, Cloudflare and several model providers are outside the EU, mainly in the United States, so your data leaves the EU. Gustly relies on the safeguards these providers offer for such transfers.
Cookies and storage on your device
Gustly sets only the cookies it needs to work, so it shows no cookie banner: gustly_session
keeps you signed in for up to 30 days, and gustly_oauth_state protects the Google
sign-in for 10 minutes. Your browser's local storage keeps your map settings, an unsent chat draft,
your home ring so the map opens fast, and which tips and prompts you have already seen. None of it
is used for ads or tracking, and you can clear it in your browser at any time.
Your rights
- Access and a copy: ask at privacy@gustly.org for the data Gustly holds about you. There is no export button yet.
- Correction: change your profile in the app or in the chat, or write to privacy@gustly.org.
- Deletion: delete your account in the app or on this page; it removes everything listed above at once.
- Objection and withdrawing consent: switch off "Help improve Gustly", stop using voice or feedback, say "stop alerts" to the chat, or write to privacy@gustly.org.
- Restriction and portability: write to privacy@gustly.org.
You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live. These rights come from the GDPR and Spain's Ley Orgánica 3/2018 (LOPDGDD).
Age
Gustly is for people aged 16 and over. It does not check ages; if you are under 16, please do not sign in. If you learn that a child under 16 has an account, write to privacy@gustly.org and it will be deleted.
Security
Gustly runs over HTTPS, and the session cookie cannot be read by scripts on the page. No system is perfectly safe; if a breach puts your data at risk, Gustly will tell you and the authority as the law requires.
Changes
The date at the top shows the latest version. An important change will be shown in the app.