Privacy
Real Deal Productions · Last updated 12 August 2026
This is a free surf-contest scoring app run by one person. There are no ads, no analytics, no trackers, and nothing here is sold or shared with anyone for marketing. This page was written by reading the database schema, so it describes what the code actually stores — not what a template says.
The short version
- Spectators need no account. Watch a whole contest without telling us anything.
- Accounts need an email address. That is the only contact detail we ask for, from anybody.
- Contest results are public on purpose. A surfer's name, jersey, wave scores, heat placings and season points appear on the public event page — that is what a results service is.
- Email addresses are never public. They are not in the public contest data at any point.
- You can delete your account and everything attached to it, yourself, from inside the app, and download a copy first.
Who runs this
Real Deal Surf (www.realdealsurf.com) is built and operated by Makai Castle, trading as Real Deal Productions, in the United States. For anything on this page — a question, a correction, a deletion request — email castlemakai@gmail.com. It reaches a person, not a ticket queue.
If you are in a place with data-protection law that names a role, treat Real Deal Productions as the controller for account data (your email, your name, your session) and as a processor acting for the organizer for the contest data a director types in about their surfers.
What is collected, and why
If you never sign in
Nothing that identifies you. No account, no cookie, no analytics script, no fingerprinting. Your browser asks our server for pages and results; our host keeps ordinary short-lived web-server logs (see Companies that see some of it). Your IP address is held in memory for a few minutes to rate-limit sign-in attempts, and is never written to the database.
Two things are stored on your own device, not on our server: your light/dark choice, whether you have seen the intro film, and a random 16-character device id the judging screen uses so two phones scoring the same heat get separate judge seats. That id is a random number. It is not linked to a person, and clearing your browser storage erases it.
If you make an organizer (director) account
- Email address — to sign in, to confirm the address is yours, and to reset your password. It is the account.
- Your name and your league's public name — the league name is shown publicly on your events.
- A password hash — the password itself is never stored and cannot be recovered by us, only reset.
- A hashed sign-in code while a confirmation or password reset is outstanding, plus when it expires and how many tries have been used. It is single-use and expires 30 minutes after it is sent.
- Session records — a hash of the sign-in cookie on each device you are signed in on, and when it expires.
If you make a surfer (athlete) account
The same email address, first and last name, and session records. Surfer accounts have no password at all — signing in is a code emailed to that address, every time. Also stored: which contests and divisions you have entered, whether each entry is pending, approved, waitlisted, declined or withdrawn, and a link joining your account to the surfer record inside that organizer's contest, so your own heats show up on your page.
Your date of birth, but only if you enter a contest that has age divisions. If a director has set up a division like "13 and under" or "40 and over", the sign-up form asks for your date of birth so the app can work out whether you qualify; a contest with no age divisions never asks. It is used for that and nothing else — never for advertising, never to work out anything else about you. It is not shown to anyone: it is not on any public page, not in the results, not in the share links, and not in the list of entries the director reviews. The director sees which age bracket a division is for and whether an entry qualified, never the date itself. You can see it and correct it yourself on your own page at any time (a mistyped year is easy on a phone), you can see it in "Download my data", and deleting your account deletes it along with the rest of your account row.
Contest data a director types in
Surfer names, division, jersey colour, heat lineups, wave scores, interference calls, placings and season points. A director may also type in a surfer's email address to invite them or to link them to an account. All of the contest data except email addresses is served publicly once the director publishes the contest — that is the product. Email addresses are held separately, outside the contest data, and are never included in anything public.
What is deliberately not collected
No phone numbers (the phone field and every text-message feature were deleted in August 2026, and the unused database column is retained empty). No age — the app stores a date of birth only for age divisions, as described above, because a stored age is wrong within a year of being written; the old unused age column is retained empty. No address, no payment details — the app is free and there is no checkout. No photos or video. No location data: a contest's "location" is a place name a director types, like "Zuma, tower 6". No advertising or analytics identifiers of any kind.
The data label
The same disclosure an app store asks for, kept here because it is the honest summary of the section above.
| Data | Collected | Linked to you | Used for |
|---|---|---|---|
| Email address | Yes | Yes | Sign-in, confirming the address, password reset, and telling a surfer their heat is next. Never shown publicly, never used for marketing. |
| Name | Yes | Yes | Identifying a surfer on a heat draw and a results sheet. Public on a published contest. |
| Contest performance (scores, placings, points) | Yes | Yes | Running and publishing the contest. Public on a published contest. |
| Date of birth | Yes | Yes | Only when you enter a contest that has age divisions, and only to check that you qualify for the division you picked. Never shown publicly and never shown to the director. |
| Contact info other than email | No | — | Not collected. No phone, no address. |
| Financial info | No | — | Not collected. The platform is free and takes no payments. |
| Health & fitness | No | — | Not collected. |
| Precise or coarse location | No | — | Not collected. A contest location is typed text, not a device reading. |
| Contacts, photos, messages, browsing history | No | — | Not collected. |
| Identifiers for advertising | No | — | Not collected. There is no advertising and no tracking on this platform. |
| Usage analytics | No | — | Not collected. No analytics product is installed. |
| Diagnostics / crash logs | Yes | No | Ordinary server error logs at the host, to fix faults. Not tied to an account and not retained long. |
| Device identifier | Yes | No | A random id stored in your own browser so two judging phones get separate judge seats. Never tied to a person. |
Cookies
One cookie, set only when you sign in: rd_session. It holds a random sign-in token, is marked HttpOnly, Secure and SameSite=Lax, and lasts 90 days or until you sign out. There are no advertising, analytics or third-party cookies on this site, which is why you have never seen a cookie banner here — there is nothing to consent to.
Companies that see some of it
| Who | What they see | Why |
|---|---|---|
| Railway | Everything, as the host: the server, the database file and ordinary web-server logs. Servers are in the United States. | They run the machine the app runs on. |
| Resend | The email address a message is sent to, and the text of that message — a sign-in code, a password-reset code, an entry decision, or a heat reminder. | They deliver the mail. Nothing else is sent to them. |
| The backup provider | An encrypted-in-transit copy of the whole database, if off-site backups are switched on. | So an organizer's season survives a failure. This uses S3-compatible storage; when it is enabled the provider is named here. |
The headline typeface used to load from Google Fonts, which meant Google saw the IP address of everyone who opened a page. Since 12 August 2026 it is served from our own server and Google is no longer involved in any part of this site.
That is the whole list. Nobody is paid for your data, nobody buys it, and there are no advertising or "data enrichment" partners. Under laws that use the phrase, we do not sell or share personal information, and never have.
How long things are kept
- Your account and contest data: until you delete it. There is no automatic expiry — a league's history is the point of the product.
- Sign-in codes: 30 minutes, then they stop working. The stored hash is cleared as soon as the code is used.
- Sessions: 90 days, or immediately when you sign out, change your password, or reset it — a password change signs out every other device.
- Rate-limit records (including IP addresses): in memory only, minutes at most, gone on restart. Never written to the database.
- Backups: when enabled, dated snapshots retained for 30 days and then dropped. A deletion you make today will still exist in a backup taken before it, for up to 30 days.
Your choices, and how to actually use them
These are buttons in the app, not a form you have to email us about.
- See what we hold: Account Details → Download my data. It hands you a JSON file with your account row, your sessions' expiry times, your entries, and (for a director) your entire league.
- Correct it: a director edits their name and league name in Account Details; a surfer's name on a contest is edited by that contest's director.
- Delete it: Account Details → Delete my account. See below for exactly what goes.
- Stop the emails: the only emails this platform sends are ones you asked for — a code you requested, a decision on an entry you submitted, or a reminder that your heat is next. There is no newsletter and no marketing list to leave. Deleting your account ends all of them.
- Object, restrict, or complain: email castlemakai@gmail.com. If you are in the UK or EU you may also complain to your national data-protection authority.
We do not charge for any of this and we do not ask you to prove your identity beyond being signed in to the account in question.
What deleting your account removes
A surfer account: your account row (including your date of birth, if you gave one), every session, every contest entry, and the link joining you to the surfer records in each organizer's contests. Your name and results in contests that have already been surfed stay on the public results — a finished contest is a record of what happened, and removing one competitor from it would falsify the sheet for everyone else in the heat. Your email address is gone in every case, and nothing further can be sent to it.
A director account: everything above, plus your whole league — every contest, surfer record, heat, score and season you created, and every public page they were served on. That is irreversible and it takes your events off the internet, so the app makes you type it out before it will do it.
The site owner's account cannot be deleted from the app, because an ownerless site cannot be administered. That is a deliberate guard in the code, not an oversight.
Children
Surf contests have groms in them, and this is written on purpose rather than pretending otherwise.
We do not knowingly let anyone under 13 create their own account: sign-up needs an email address the person can read, and we ask that a parent or guardian make and hold the account for a younger surfer and sign up on their behalf. The one thing we ask beyond a name and an email is a date of birth, and only when the contest being entered has age divisions — see "If you make a surfer (athlete) account" above for exactly what happens to it.
A director can enter a junior surfer's name into a heat draw without that surfer having an account at all, and that name appears on the public results. That is the same information a paper heat sheet pinned to a beach notice board has always shown. If you are the parent or guardian of a surfer whose name appears here and you want it removed, email castlemakai@gmail.com and it will be removed — you do not need an account and you do not have to go through the club.
Security, told straight
Passwords are hashed and never stored in the clear. Sign-in cookies are stored as hashes, so the database does not contain anything that could be replayed as a session. Sign-in codes are hashed, single-use, expiring, attempt-capped and rate-limited. Everything travels over HTTPS. Sign-in and reset endpoints answer identically whether or not an address has an account, so they cannot be used to find out who is registered.
What we do not claim: this is a small free platform run by one person, not a bank. There is no third-party security certification, no 24-hour operations desk, and no formal uptime guarantee. If something goes wrong that affects your data, you will be told directly and promptly, and told what actually happened.
Where your data lives
On servers in the United States. If you are using this from outside the US, that means your data is transferred to the US and handled under US law.
Changes to this page
The date at the top changes when this page does. Because this document is written from the code, a change here means a change in the app — and material ones are recorded in the public changelog and, where they affect you, said in plain language when you next sign in.