Privacy PolicyConsumer Health Data Privacy Policy Terms of Use Company information

Privacy Policy

1. Who we are

SpearBreath is offered by Outlaw Liberations LLC, a New Mexico limited liability company, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA (“we”, “us”). Email: support@spearbreath.app.

Our privacy officer – the person in charge of protecting personal information, also under Quebec law – is our Managing Member. You can reach them at support@spearbreath.app (subject “Privacy”).

This policy explains what personal information we collect, why we collect it, who receives it and what rights you have. It applies to the SpearBreath app and its web pages. Section 14 adds information for your country or state, and our Consumer Health Data Privacy Policy explains how we handle health-related data.

2. Summary

You need an account to use SpearBreath. Your training stays on your device unless you choose to back it up. We show no ads, use no tracking or analytics tools, do not sell personal information, do not share it for targeted advertising and do not build profiles about you.

Data only leaves your device when you sign in, back up your training, use the community, have a post translated or buy SpearBreath Plus – and only as far as needed for that.

Our website uses no cookies and no analytics. When you visit it, our hosting provider Netlify keeps technical logs (including your IP address) for a short time to deliver the pages and protect them against attacks.

3. Your account

You create an account with an email address and password, or via Apple, Google or Facebook. We process your email address or the ID of that account, the times of sign-up and sign-ins, and that and when you accepted the Terms of Use and confirmed that you are at least 16. Passwords are stored only as a cryptographic hash.

We use your account to provide the app: to link your subscription, your training backup (if you choose it) and your community content to you, and to send you the emails you need.

You don’t have to use your real name: in the community you appear under a username you choose.

4. Data that stays on your device

The app stores your training plan, sessions, breath-hold and best times, your feedback, settings, own tables and your dive log (depths and times, conditions, gear, spot names, catch, incidents such as a samba, and your notes) on your device. Unless you back up your training, we don’t receive this data. Spots are stored only as names you type in – never as a GPS position.

For the 7-day trial, the app also stores the start time in the device keychain, so that reinstalling the app doesn’t start a new trial.

Reminders and nutrition tips are scheduled as local notifications on your device; no data is sent to a server for this. You can turn notifications off at any time in your device settings.

When you sign out, the app removes this data from your device; it is also deleted when you uninstall the app. Depending on your device settings, it may be part of your iCloud or Google device backup, which you manage with Apple or Google – we have no access to it.

Sharing your best time: the app creates the picture on your device and we don’t receive it. Where you send it is your choice in your device’s share menu (e.g. WhatsApp or Instagram); that service’s privacy policy applies there. If you post it in the community, section 6 applies.

5. Training backup (optional)

If you agree, we store your training in your account: settings, training plan and progress, own tables, sessions with your rating, breath-hold and best times, the time of your first contraction and your dive log with everything listed in section 4. That way you have it on every device and don’t lose it when you change phones. Entries you delete from the log are deleted from the backup too; only an empty marker remains, so that the entry also disappears from your other devices.

Breath-hold times and dive-log details (such as depths or incidents like a blackout) can reveal information about your health. We therefore collect them only with your express consent, and we record when you gave it.

You can withdraw your consent at any time under Settings › Back up training. We then delete the backup from our servers right away; your training stays on your device.

6. Community (optional)

If you create a community profile, we also process your username, profile picture, bio and – with Plus – a link, your posts with text and photos, comments, likes, whom you follow and block, your reports and your direct messages.

Your deepest dive, trophy fish and breath-hold personal best appear on your profile only if you switch this on. You can switch it off at any time when editing your profile; the values are then removed from our servers.

Your profile, posts and comments are visible to all signed-in members. Photos are kept in storage from which they can be retrieved via their web address. Photos are downscaled before upload, which removes embedded metadata such as the location where they were taken.

Direct messages are end-to-end encrypted. We store only the encrypted text plus sender, recipient and time; we cannot read the content.

A badge on your profile shows whether you have SpearBreath Plus. With Plus you can add a link below your bio; when Plus ends, we hide it until you have Plus again. A link in a profile opens in the browser, where that website’s privacy policy applies.

To prevent abuse, we limit how much can be posted, commented, written and uploaded in a short time. For this and for security, our hosting provider keeps technical logs (including IP addresses) for a short time.

Before posts, comments, usernames and bios are saved, an automatic word filter checks them for clear breaches of the community rules (such as hate terms, threats or porn spam); such texts are not published. Direct messages are checked only on your device, before they are encrypted – we never see their content. The filter stores nothing and makes no other decisions about you.

We review reports in order to remove content that is illegal or breaks our rules. A reported item is hidden right away for the person who reported it. When we decide on a report, we email the member concerned and the person who reported it. We keep a moderation log (type, username, reasons, time) so that our decisions can be traced. A suspended account can no longer sign in or publish anything.

The “For you” feed sorts posts by how recent they are, their likes and comments, and whom you follow. It makes no decisions that have legal or similarly significant effects on you.

7. Translating posts

If you tap “Translate post”, we send only the text of that post to DeepL SE, Maarweg 165, 50825 Cologne, Germany, our service provider. DeepL translates the text by machine using artificial intelligence, receives no information about you, deletes the text after translating it and does not use it for training. Before your first translation, the app tells you this and asks whether you want to continue. We store the translation with the post so that it doesn’t have to be requested again; it is deleted together with the post.

For the daily translation allowance, we count the translated characters per account; these counters are deleted after 30 days.

8. SpearBreath Plus

You buy the subscription through Apple’s App Store or Google Play. Apple or Google processes the payment under its own terms; we do not receive your payment details.

To check whether your subscription is active, we use RevenueCat, Inc. (USA) as our service provider. It processes your account ID, purchase receipts, subscription status, app version, device type and country.

9. Emails

We send you only emails related to your account: confirming your email address, resetting your password and decisions on reports. We send them through an email delivery provider acting on our behalf. We don’t send newsletters or marketing emails.

If you email us, we use your message and address to answer you.

10. Who receives personal information

Our service providers, which process personal information only on our instructions and under contract: Supabase Inc. (hosting, database and sign-in; data centers in the region USA (East US – North Virginia)), RevenueCat, Inc. (subscription status; USA), DeepL SE (translation of post texts; Germany) our email provider (account emails and our mailbox; Namecheap, Inc., USA) and Netlify, Inc. (hosting of our website; USA).

Apple, Google and Meta, if you sign in with them, and Apple or Google for purchases – each under its own privacy policy.

Other members: what you publish in the community is visible to signed-in members; a direct message only to its recipient.

Authorities or other parties where the law requires it (for example, a valid court order), or where this is necessary to protect someone’s life or safety. If our business is ever sold or merged, the buyer or successor – this policy then continues to apply to your information.

Anyone with whom we share personal information must protect it at least as well as this policy and the app store rules require.

We do not sell personal information and do not share it for cross-context behavioral (targeted) advertising, and we have not done so in the past 12 months. We do not disclose it to third parties for their own marketing purposes.

11. Where your information is stored

We are based in the USA. Your account, training backup and community data are stored in the USA (USA (East US – North Virginia)). Texts you have translated are processed in Germany (EU). Sign-in and app store providers may process data in other countries.

If you live outside the USA, your personal information is therefore transferred to and stored in countries whose laws may differ from those of your country, and it may be accessible to courts, law enforcement and national security authorities there. We remain responsible for it and use contracts to ensure that our service providers protect it to a standard comparable to the law of your country, including the Australian Privacy Principles and the New Zealand Information Privacy Principles.

12. How long we keep information

Data on your device: until you sign out, delete it or uninstall the app.

Training backup: until you switch it off or delete your account.

Account and community: until you delete your account (Settings › Delete account). We then immediately delete your account, training backup, profile, posts, photos, comments, likes, connections and messages, as well as your data at RevenueCat. Backup copies at our hosting provider are overwritten within 30 days.

Technical logs at our hosting provider: a few days. Translation counters: 30 days. Reports: until we have decided on them. Moderation log entries: twelve months, unless the law requires us to keep them longer. Emails you send us: as long as needed to deal with your request.

13. Your rights and choices

Wherever you live, you can: find out whether and what personal information we hold about you and get a copy of it in a portable format; have it corrected; have it deleted; withdraw a consent at any time; and object to how we use it. We never treat you differently for using these rights.

Many of these you can do right in the app: Settings › Export my data, Settings › Back up training (withdraw consent), the switches in your community profile and Settings › Delete account. For anything else, email us.

To protect your account, we answer requests via the email address of your account, or ask you to confirm the request from it. You may use an authorized agent; we may ask for proof of their authorization. We respond within 30 days (20 working days if you live in New Zealand). Where the law allows, we may extend this period once if necessary; we then tell you why.

If we decline a request, we explain why. You can appeal by replying to our answer with the subject “Appeal”. We decide on your appeal within 45 days and, if we deny it, tell you how to contact your state attorney general or the privacy regulator of your country (see section 14).

Global Privacy Control and “Do Not Track”: we don’t sell or share personal information and don’t track you across apps or websites, so there is nothing to opt out of. We honor such signals anyway.

14. Information for your country or state

United States: In the past 12 months we collected these categories of personal information (as defined in the California Consumer Privacy Act): identifiers (email address, account ID, username, IP address); customer records and commercial information (subscription status, purchase receipts); internet or other electronic network activity (sign-in times, technical logs); photos you upload; and the content you post. We also collected sensitive personal information: your account log-in, health-related training data that you choose to back up or show (see our Consumer Health Data Privacy Policy) and the contents of direct messages, but only in encrypted form we cannot read. We collect this information from you, from your device and from sign-in and app store providers, for the purposes in sections 3 to 9, keep it as stated in section 12 and disclose it only to the recipients in section 10, for business purposes. We use sensitive personal information only to provide the app you asked for. Some state privacy laws may not apply to us because of our size; we still give everyone the rights in section 13. Residents of Washington, Nevada and Connecticut: please also see our Consumer Health Data Privacy Policy.

Canada: We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector. We ask for your express consent for sensitive information such as health-related training data. Our privacy officer is named in section 1. We do not make decisions about you based exclusively on automated processing. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d’accès à l’information (cai.gouv.qc.ca).

Australia: We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988. In the community you can use a pseudonym (your username). If you have a complaint, please contact us first; we respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). Overseas recipients and the countries concerned are listed in sections 10 and 11.

New Zealand: We handle personal information in accordance with the Privacy Act 2020. You can access and correct your information as described in section 13 and complain to the Office of the Privacy Commissioner (privacy.org.nz).

15. Children

SpearBreath is not intended for children. You must be at least 16 years old to use it. We do not knowingly collect personal information from anyone under 16; if we learn that we have, we delete the account and its data. If you believe that a child is using SpearBreath, please tell us.

16. Security

All connections are encrypted (TLS). Our database lets every account see and change only what it is allowed to. Your sign-in is stored encrypted on your device, and direct messages are end-to-end encrypted.

No system is completely secure. If a data breach is likely to cause you serious harm, we notify you and the competent authorities as the law requires.

17. Changes to this policy

We update this policy when the app or the law changes, and we tell you in the app about significant changes. If we want to use your information for a new purpose that requires your consent, we ask you first. The version shown in the app applies.

Translations of this policy are provided for convenience; if they differ, the English version prevails.

Last updated: November 2, 2026.