Last updated: April 15, 2026
DIVR ("we", "us", or "our") operates the DIVR platform at divr-connect.com ("Service"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Service.
We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
The data controller responsible for your personal data is:
We use your personal information for the following purposes:
Legal basis (GDPR): we process your data based on (a) the performance of our contract with you (Art 6(1)(b)) for core Service functionality (account, dive logs, social features), (b) your explicit, opt-in consent under Art 6(1)(a) for sharing your observations with external research databases, and (c) our legitimate interest (Art 6(1)(f)) in security, abuse prevention, and aggregate platform analytics. Research-data sharing is never based on legitimate interest — it requires your affirmative opt-in, which you can grant or withdraw at any time from Settings.
We do not sell your personal data. We never have and never will.
We share information only in the following circumstances:
We use a minimal number of cookies:
| Cookie | Purpose | Type |
|---|---|---|
| Supabase auth token | Keeps you logged in | Strictly necessary |
| Vercel Analytics | Anonymous page view and performance metrics | Analytics (no PII) |
We do not use advertising cookies, social media tracking pixels, or any third-party marketing trackers. Vercel Analytics is privacy-focused and does not use cookies to identify individual users across sessions.
DIVR's mission is to contribute to marine conservation through citizen science. With your explicit opt-in, we share anonymized biodiversity observations from your public dives with international research databases including EMODnet Biology, EurOBIS, OBIS, and GBIF.
Opt-in by default: The "Contribute to Marine Science" toggle in your Settings starts off. No research export includes your data until you turn it on. You can turn it off at any time; we log the time, IP, user-agent, and consent text version of every change so we can demonstrate compliance with GDPR Art 7(1).
What is shared (when opted in): species sightings, abundance, environmental measurements, coral health, dive date, site coordinates, and occurrence photos (under CC-BY 4.0).
What is never shared: your name, email, username, profile, notes, dive buddies, or any identifier that links records back to you directly.
How we protect your identity:
anonymous_research_id (UUID) generated once per account and used across all exports for scientific record continuityWithdrawal. When you turn off research sharing, enable Do-Not-Share, or delete your account, an entry is immediately added to our OBIS deletion queue with your anonymous research ID and the DwC occurrence IDs to be removed. Data stewards at OBIS/EMODnet/GBIF are notified to purge these records from active publications. Archives previously downloaded by third parties under CC-BY cannot be recalled.
Published anonymized data is not considered personal data under GDPR Recital 26 and is distributed under a Creative Commons Attribution 4.0 International License (CC-BY 4.0), the standard license used by OBIS and GBIF for open biodiversity data.
Your data is stored on Supabase infrastructure with encryption at rest and in transit. We implement row-level security (RLS) policies on every database table to ensure users can only access their own data and public content.
Passwords are hashed using industry-standard algorithms (bcrypt) and are never stored in plain text. We do not have access to your password.
While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We encourage you to use a strong, unique password for your DIVR account.
We retain your personal data for as long as your account is active. When you delete your account, all personal data is permanently removed, including:
Previously exported anonymized research data cannot be recalled, as it is no longer linked to your identity.
Server logs containing IP addresses are retained for up to 30 days for security and abuse prevention purposes, after which they are automatically deleted.
Under the GDPR, you have the right to:
Under the CCPA as amended by the CPRA, California residents have the right to:
To exercise any of these rights, contact us at joep@divr-connect.com. We will respond within 30 days.
DIVR is intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you are under 16, you may only use DIVR with the consent and supervision of a parent or legal guardian. If we learn that we have collected personal data from a child under 16 without appropriate consent, we will delete that information promptly.
Your data may be processed in countries outside your country of residence, including the United States, where our service providers (Supabase, Vercel) operate. These transfers are protected by appropriate safeguards, including the service providers' compliance with applicable data protection frameworks.
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending you an email. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, contact us at:
joep@divr-connect.com