Privacy
Real Deal Productions · Last updated 22 September 2026
This is a free surf-contest scoring app run by one person. There are no ads, no analytics, no trackers, and nothing here is sold or shared with anyone for marketing. This page was written by reading the database schema, so it describes what the code actually stores — not what a template says.
The short version
- Spectators need no account. Watch a whole contest without telling us anything.
- Accounts need an email address. That is the only contact detail we ask for, from anybody.
- Contest results are public on purpose. A surfer's name, jersey, wave scores, heat placings and season points appear on the public event page — that is what a results service is.
- Email addresses are never public. They are not in the public contest data at any point.
- You can export account data and request deletion. Organization ownership, payment records and completed results have the exceptions explained below.
Who runs this
Real Deal Surf (www.realdealsurf.com) is built and operated by Makai Castle, trading as Real Deal Productions, in the United States. For anything on this page — a question, a correction, a deletion request — email castlemakai@gmail.com. It reaches a person, not a ticket queue.
If you are in a place with data-protection law that names a role, treat Real Deal Productions as the controller for account data (your email, your name, your session) and as a processor acting for the organizer for the contest data a director types in about their surfers.
What is collected, and why
If you only watch contests
Nothing that identifies you. No account, no cookie, no analytics script, no fingerprinting. Your browser asks our server for pages and results; our host keeps ordinary short-lived web-server logs (see Companies that see some of it). Your IP address is held in memory for a few minutes to rate-limit sign-in attempts, and is never written to the database.
On your device we store preferences such as your theme, selected workspace and tutorial state, plus a random judging-device identifier and unsent judging scores when offline. These support the interface and score recovery, not advertising. Clearing browser storage erases them, including any scores not yet synced.
If you start a temporary contest
We create a random workspace identifier and a session cookie so this browser can edit your contest without an email or password. The workspace lasts 24 hours; expired records are removed by an hourly cleanup. Published names, draws and scores are readable through the contest link. Creating or signing into a Director account saves the contest and its existing link. After a transfer, the old temporary account is kept empty until cleanup so it cannot be claimed twice.
While a temporary contest is open, we record which pages it opens and which buttons, links and choices are tapped, with the time — never anything you type. The site owner uses this to see where setup gets hard. We also keep a short summary of what was built (contest names and how many surfers and heats) after the workspace is removed. These flow logs are kept; they hold no name, email or network address, only the temporary contest's own random identifier. For temporary contests started before 27 September 2026, the same timeline was rebuilt from our host's request records, keeping only what was saved and when — never the network address. Signed-in accounts are not recorded this way.
If you choose Google sign-in
Google supplies your name, verified email address and a Google account identifier. We store the identifier to recognize your account on later sign-ins. We do not request access to Gmail messages, contacts, calendars or Drive. The access token is used to verify your identity and is not stored. A temporary security cookie and request record expire after ten minutes; account deletion removes the stored Google identifier.
Your account and organizations
One login can manage organizations, hold contest assignments and compete. We store the links that grant those permissions separately from athlete entries. A parent can manage multiple athlete profiles; the parent is the buyer or contact, not the identity of every child. Core and Pro describe organization workflows, not separate identities.
- Email address — to sign in, to confirm the address is yours, and to reset your password. It is the account.
- Your name and your league's public name — the league name is shown publicly on your events.
- A password hash — the password itself is never stored and cannot be recovered by us, only reset.
- A hashed sign-in code while a confirmation or password reset is outstanding, plus when it expires and how many tries have been used. It is single-use and expires 30 minutes after it is sent.
- Session records — a hash of the sign-in cookie on each device you are signed in on, and when it expires.
If you make a surfer (athlete) account
The same email address, first and last name, and session records. You can sign in with an emailed code or link, Google when available, or a password you have set. Also stored: which contests and divisions you have entered, whether each entry is pending, approved, waitlisted, declined or withdrawn, and a link joining your account to the surfer record inside that organizer's contest, so your own heats show up on your page.
Date of birth and eligibility. Athlete profile and age-limited registration flows may request a date of birth. It is kept outside public contest data. Authorized organizers and assigned directors can see the private age/profile information needed to operate their contests, including date of birth; spectators and judge-only sessions do not receive it. Eligibility decisions and guardian consent are also recorded. You can request a correction through your profile or the organizer. It is not used for advertising.
Registration and memberships
We store the athlete and registering account, selected contest/division or membership program, submitted answers, consent records, applicable terms and separate application/payment statuses. Custom questions can include text or dropdown answers such as a school. Organization-wide and season memberships are separate from contest entries. Organizers should request only information they need; do not put payment credentials or sensitive identity documents in custom answers.
Stripe payments — when enabled
Live payments are not enabled yet. Local sandbox tests use disposable test data and no real money. When payment support is enabled, Stripe hosts onboarding and checkout. Stripe collects card details and an organization's verification and bank information directly; Real Deal Surf does not store card numbers, security codes or bank credentials.
Real Deal stores connected-account identifiers and readiness requirements, orders, buyer and participant identifiers, prices and discounts, policy snapshots, Stripe session/payment/refund identifiers, payment outcomes, webhook-processing records and refund decisions. These records reconcile payment with the correct entry or membership and prevent duplicate fulfillment. The buyer or registering guardian can see their order; authorized organization owners manage their organization's payments. Public viewers cannot see these records.
Stripe receives the information needed for the hosted session, including the purchase description, amount and internal order reference, along with information you enter on Stripe. Its handling of that data is described in Stripe's privacy policy. Membership and entry purchases are one-time; there is no automatic renewal.
Contest data a director types in
Published contests show surfer names, divisions, jerseys, heat lineups, scores, interference calls, placings and season points. Contact details, dates of birth, private registration answers and payment records are kept separately and are not part of the public results. Adding a name or email does not automatically verify ownership of an athlete profile.
What is deliberately not collected
There is no built-in account phone field or SMS service. Stripe may request a phone number or address on its own onboarding or checkout pages. We do not store card or bank credentials. An organization can upload a public logo and configure registration questions, so the information it requests may vary. A contest's location is typed text, not GPS. We do not collect advertising identifiers or install analytics tracking.
The data label
The same disclosure an app store asks for, kept here because it is the honest summary of the section above.
| Data | Collected | Linked to you | Used for |
|---|---|---|---|
| Email address | Yes | Yes | Sign-in, confirming the address, password reset, and telling a surfer their heat is next. Never shown publicly, never used for marketing. |
| Name | Yes | Yes | Identifying a surfer on a heat draw and a results sheet. Public on a published contest. |
| Contest performance (scores, placings, points) | Yes | Yes | Running and publishing the contest. Public on a published contest. |
| Date of birth | Yes | Yes | Private profile and eligibility checks; available to authorized contest staff, not public viewers. |
| Registration answers and consent | When requested | Yes | Organization-defined questions, eligibility, consent and application review. |
| Payment records | When enabled | Yes | Order totals, statuses, provider references and refunds. Card numbers and bank credentials stay with Stripe. |
| Health & fitness | No | — | Not collected. |
| Precise or coarse location | No | — | Not collected. A contest location is typed text, not a device reading. |
| Contacts, photos, messages, browsing history | No | — | Not collected. |
| Identifiers for advertising | No | — | Not collected. There is no advertising and no tracking on this platform. |
| Usage analytics | No | — | Not collected. No analytics product is installed. |
| Diagnostics / crash logs | Yes | No | Ordinary server error logs at the host, to fix faults. Not tied to an account and not retained long. |
| Device identifier | Yes | No | A random id stored in your own browser so two judging phones get separate judge seats. Never tied to a person. |
Cookies
rdp_session holds a random sign-in token, marked HttpOnly, Secure and SameSite=Lax. Account sessions last 90 days and renew with use. Guest sessions are limited to the temporary workspace's 24-hour lifetime; judge passes expire at their contest's deadline. rds_oauth is a ten-minute security cookie used only when you choose Google sign-in. We do not use advertising or analytics cookies.
Companies that see some of it
| Who | What they see | Why |
|---|---|---|
| Railway | Everything, as the host: the server, the database file and ordinary web-server logs. Servers are in the United States. | They run the machine the app runs on. |
| Resend | The email address a message is sent to, and the text of that message — a sign-in code, a password-reset code, an entry decision, or a heat reminder. | They deliver the mail. Nothing else is sent to them. |
| Google, if you choose Google sign-in | Your sign-in request and the identity information you approve sharing with Real Deal Surf. | They verify your Google account for sign-in. |
| Stripe, when payments are enabled | Onboarding and checkout information you submit, purchase details and payment/refund references. | Connected-account verification, payment processing and refunds for the organization. |
| The backup provider | An encrypted-in-transit copy of the whole database, if off-site backups are switched on. | So an organizer's season survives a failure. This uses S3-compatible storage; when it is enabled the provider is named here. |
The headline typeface used to load from Google Fonts, which meant Google saw the IP address of everyone who opened a page. Since 12 August 2026 it is served from our own server so watching contests does not load Google Fonts. Google is involved when you choose Google sign-in.
That is the whole list. Nobody is paid for your data, nobody buys it, and there are no advertising or "data enrichment" partners. Under laws that use the phrase, we do not sell or share personal information, and never have.
How long things are kept
- Temporary contests: 24 hours, followed by hourly cleanup, unless saved to an account. The record of taps and the short summary of what was built (flow logs): kept, with no name, email or network address.
- Your saved account and contest data: until you delete it. There is no automatic expiry — a league's history is the point of the product.
- Payment and membership records: retained for reconciliation, refunds and disputes; the current implementation has no automatic retention purge for these records. Account deletion does not automatically delete Stripe's records. Contact us and the organization for a scoped data request.
- Sign-in codes and links: 30 minutes. Using either consumes the inbox proof for both; expired or replaced proof cannot sign in.
- Sessions: 90 days, or immediately when you sign out, change your password, or reset it — a password change signs out every other device.
- Rate-limit records (including IP addresses): in memory only, minutes at most, gone on restart. Never written to the database.
- Backups: when enabled, dated snapshots retained for 30 days and then dropped. A deletion you make today will still exist in a backup taken before it, for up to 30 days.
Organization staff access
We store organization memberships, Director contest assignments, and invitations (email, expiry, acceptance and revocation). Invitation secrets are hashed and never included in account exports. Organizers manage their organization and staff. Directors receive only assigned contests and the athlete information needed to operate them. Removing access applies to existing signed-in sessions.
We store Core/Pro organization selection, organization names and any chosen public URL, Pro applications, review decisions and timestamps. Drafting a Pro event, site approval and Stripe verification are separate steps. Price versions and policy snapshots keep an existing order from silently changing when the owner edits future prices.
Your choices, and how to actually use them
These are buttons in the app, not a form you have to email us about.
- See what we hold: Account Details → Download my data. It hands you a JSON file with your account row, your sessions' expiry times, your entries, and (for a director) your entire league.
- Correct it: organization settings are managed by the Organizer; shared athlete identity corrections are managed by the Organizer or the athlete through the existing account controls.
- Delete it: Account Details → Delete my account. See below for exactly what goes.
- Stop the emails: the only emails this platform sends are ones you asked for — a code you requested, a decision on an entry you submitted, or a reminder that your heat is next. There is no newsletter and no marketing list to leave. Deleting your account ends all of them.
- Object, restrict, or complain: email castlemakai@gmail.com. If you are in the UK or EU you may also complain to your national data-protection authority.
We do not charge for any of this and we do not ask you to prove your identity beyond being signed in to the account in question.
What deleting your account removes
An organization owner cannot delete their account while responsible for an organization. An invited Director can delete their personal account without deleting the organization they work for. Their memberships, assignments and invitations addressed to them are removed.
A surfer account: normal account deletion removes the login, sessions, profile and ordinary entry links. Completed contest names and results remain. Separate membership, consent and payment records can remain for reconciliation, disputes and the organizer's recordkeeping; Stripe holds its own records too. The current account download does not include every commerce record. Contact us to request access, correction or deletion of those records, and we will explain any retention exception.
Administrative owner removal: the administrator can revoke a non-admin owner's login and organization access and remove their owned organization and contests, while retaining their athlete identity and results held by other organizations. This is not the same as a personal erasure request. Removal is blocked when the organization has payment records that need resolution. Contact us for corrections or erasure questions about retained records.
The site owner's account cannot be deleted from the app, because an ownerless site cannot be administered. That is a deliberate guard in the code, not an oversight.
Children
Surf contests have groms in them, and this is written on purpose rather than pretending otherwise.
We ask parents or guardians to hold the account and register younger surfers on their behalf, including children under 13. An email address is not proof of age. Each child has a separate athlete profile and entries. Profile or eligibility checks may request a date of birth; an organization may ask additional registration questions. Organizers must limit collection to what is necessary and obtain any required guardian consent.
A director can enter a junior surfer's name into a heat draw without that surfer having an account at all, and that name appears on the public results. That is the same information a paper heat sheet pinned to a beach notice board has always shown. If you are the parent or guardian of a surfer whose name appears here and you want it removed, email castlemakai@gmail.com and it will be removed — you do not need an account and you do not have to go through the contest organization.
Security, told straight
Passwords are hashed and never stored in the clear. Sign-in cookies are stored as hashes, so the database does not contain anything that could be replayed as a session. Sign-in codes are hashed, single-use, expiring, attempt-capped and rate-limited. Everything travels over HTTPS. Sign-in attempts are rate-limited, and expired or already-used email proof cannot create a new session.
What we do not claim: this is a small free platform run by one person, not a bank. There is no third-party security certification, no 24-hour operations desk, and no formal uptime guarantee. If something goes wrong that affects your data, you will be told directly and promptly, and told what actually happened.
Where your data lives
On servers in the United States. If you are using this from outside the US, that means your data is transferred to the US and handled under US law.
Changes to this page
The date at the top changes when this page does. Because this document is written from the code, a change here means a change in the app — and material ones are recorded in the public changelog and, where they affect you, said in plain language when you next sign in.