Privacy Policy

Effective: June 28, 2026 · Last updated: August 8, 2026

BarrelFare ("BarrelFare", "we", "us") is operated by BarrelFare LLC. This policy explains what data the BarrelFare iOS app and our website at barrelfare.com collect, why, and your choices. We built BarrelFare to need as little of your data as possible.

The short version

BarrelFare requires an account (Sign in with Apple, Google, or email + password). We store the email address and, if provided, the name your sign-in supplies. With Sign in with Apple you can use "Hide My Email" so we never see your real address.
We don't sell flights or take payment for them. When you book, you leave BarrelFare for the seller's site. We never see or store traveler or payment details.
If you enter your email in the signup form on this website, we add you to our surf-deals email list. That is the only personal data the website itself collects. The site also gathers anonymous page-view analytics via PostHog; no ad trackers, no advertising cookies.
We do not collect your device location.
We use two carefully configured third-party services: PostHog for usage analytics and masked session replay (everything you type and every image is redacted on your device before anything is sent), and Sentry for crash reports. No advertising SDKs, no cross-app tracking, no IDFA.
Every marketing email we send (website list or in-app digest) has a one-click unsubscribe. The in-app digest is off until you turn it on.
We do not sell or share your personal data.

What we collect

Your account. BarrelFare requires an account so your saved spots, home airport, and alerts sync across sessions and devices. When you sign in with Apple, Google, or email + password, we store the email address (and, if provided, the name) your sign-in method supplies, keyed to a randomly generated account identifier (a UUID). With Sign in with Apple you can use Apple's "Hide My Email" relay so we never see your real address.

Your in-app preferences. When you use the app we store, against your account ID:

the surf spots you add to your watchlist (stored as spot IDs);
your selected home airport(s) (airport codes such as LAX);
your board length, if you turn on the board-bag filter.

Usage events. To understand how the app is used and where to improve it, we log usage events: for example, opening the app, viewing a deal or spot, changing your home airport, applying a filter, saving a spot, or opening a booking hand-off. These events record interaction types and the identifiers involved (such as an airport or spot code); they never contain your name, contact details, location, or any free-text you enter. Events are processed by PostHog (a product-analytics service) keyed to your account UUID, with PostHog's automatic capture and advertising features switched off. To help us find confusing screens and bugs, the app also records masked session replays: a redacted recording of your app session in which everything you type and every image is blacked out on your device before anything is sent. Replays are keyed to the same account UUID and are used only to improve the app. The data is used only in aggregate to operate and improve BarrelFare.

Crash and performance reports. If the app crashes or hangs, a diagnostic report (stack trace, device model, OS version, app version, and your account UUID; no personal details) is sent to Sentry so we can find and fix the bug. Apple may additionally share its own opt-in crash diagnostics with us, controlled by your device settings.

Push notification token (only if you enable notifications). If you opt in to deal alerts, iOS provides a device push token that we store to deliver those notifications. You can turn notifications off at any time in iOS Settings.

Weekly deal digest (only if you turn it on). Accounts with an email address can enable a weekly email of the best surf deals from their home airport. Enabling it stores your email and preference; emails are delivered through Resend. Every digest contains an unsubscribe link, and you can also switch it off in the app's "You" tab.

Website email signup. If you enter your email address in the signup form on barrelfare.com, we store that address in order to email you about BarrelFare: a short welcome note when you sign up, news as we approach launch, and surf deals after that. Alongside your address we record the date you signed up, the address of the page that referred you (if your browser sent one), and your browser's user-agent string. We keep those last two to tell genuine signups apart from automated bot submissions, and to understand where people are finding us. The address is stored in our database and also processed by Kit, the email platform that sends these emails. This form is the only personal data the website itself collects. barrelfare.com also runs PostHog analytics (page views and anonymous usage stats, kept in your browser's local storage rather than tracking cookies); it carries no advertising trackers. Signing up does not create an app account, and this list is kept separately from the in-app digest described above: the two are unrelated, and unsubscribing from one does not affect the other. Every email includes a one-click unsubscribe link that needs no login or account, and you can also write to hello@barrelfare.com to be removed.

We do not collect: your phone number, precise or coarse location, contacts, photos, advertising identifiers, browsing history, or any traveler or payment details for flights (flight purchases happen entirely on the seller's site, not in BarrelFare).

How we use it

To sync your watchlist, home airport, and preferences across app sessions and devices.
To rank and display surf-and-flight "deals" relevant to your chosen home airport.
To understand, in aggregate, how the app is used so we can improve it.
To find and fix crashes and reliability problems.
To deliver push notifications and digest emails you have explicitly enabled.
To send the emails you signed up for on our website, and to distinguish real signups from bot submissions.

We do not use your data for advertising or profiling, and we do not make automated decisions that produce legal effects about you.

Third-party services

BarrelFare relies on a small number of service providers. We share only what each needs:

Supabase: hosts our database and authentication. Your account ID, email, your preferences, and our website email list are stored here.
PostHog (PostHog, Inc., US cloud): processes the usage events, masked session replays, and website page-view analytics described above (app data keyed to your account UUID; website analytics anonymous). Autocapture and advertising features are off; used for product analytics only.
Sentry (Functional Software, Inc.): receives crash and hang reports so we can fix bugs. No personal details beyond the account UUID.
Resend (Resend, Inc.): delivers the app's emails, the weekly deal digest and deal emails to accounts that enabled them. Receives only your email address and the content of the message.
Kit (Kit, formerly ConvertKit): the email platform for our website list; stores the addresses from the barrelfare.com signup form and sends the welcome, news, and deal emails. Receives only your email address and signup date.
Open-Meteo and WorldTides: provide surf, weather, and tide forecast data. We send requests for forecast data; we do not send them any information about you.
SearchApi.io, Travelpayouts / Aviasales, and Duffel: supply the flight-price data behind deals and the cheapest-dates calendar. Our servers send them route and date queries (for example, "LAX to Lisbon in September"), never your name, email, or account details. Tapping through to book opens the seller (such as Google Flights, an airline, or Aviasales), which has its own privacy policy and may set a referral identifier so any booking is attributed to BarrelFare; we receive only aggregate referral/commission reporting.
Unsplash / Pexels: surf-spot photos load from their image CDNs. Like any web image, the request exposes your IP address to the CDN; no account information is sent.
Google: Sign in with Google, governed by Google's privacy policy.
Apple: App Store distribution, Sign in with Apple, push notification delivery (APNs), and optional crash diagnostics, governed by Apple's privacy policy.

Data retention and deletion

We keep your account and preferences until you delete them. You can:

Unsubscribe from the digest: the link in any digest email, or the toggle in the app's "You" tab.
Unsubscribe from the website email list: the one-click link at the foot of any of those emails; no login needed. We keep a record that your address unsubscribed, so that we don't email it again by mistake. If you would rather we erased the row entirely, ask at hello@barrelfare.com and we will. Note that this list is separate from your app account: deleting your account does not remove a website signup, and unsubscribing here does not delete an app account.
Sign out in the app: signs you out on that device; your account and saved data are kept for when you sign back in.
Delete your account and data: tap Delete account in the app's "You" tab. This permanently removes your account and all associated records (watchlist, home airport, push token, digest subscription) from our servers immediately. You can also email hello@barrelfare.com to request deletion.

Children

BarrelFare is not directed to children under 13 (or the equivalent minimum age in your country) and we do not knowingly collect data from them.

Your rights

Depending on where you live (e.g., the EU/UK under GDPR, or California under the CCPA/CPRA), you may have rights to access, correct, delete, or port your data, and to object to certain processing. You can exercise most of these directly in the app, or contact us at hello@barrelfare.com.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by the "Last updated" date above and, where appropriate, noted in the app.

Contact

Questions about this policy or your data: hello@barrelfare.com.
BarrelFare LLC, Florida, United States.