Privacy Policy

Last Updated: August 18, 2026
Version: 1.4

Bommie ("we," "us," or "our") is committed to protecting your privacy and ensuring you (“user” or “you”) have control over your personal data.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information (“Personal Data”) when you use the Bommie mobile application (the "App") including the website www.bommie.app (the “Site”) and our related services (collectively, the “Service”). Because information technologies and the internet carry inherent security risks, the complete protection of your Personal Data cannot be guaranteed. You acknowledge and accept that any transmission of information to Bommie is done at your own risk. Please read this Privacy Policy before using our Service or submitting any Personal Data to Bommie and contact us if you have any questions.

1. Information We Collect

To operate and provide necessary functionality for the Service including interactive map-based interface, real-time weather scoring, and community generated content features we may collect the following information that constitutes “Personal Data”.

• Account Data: When you register we collect your display name, email address and password. You may also provide a user avatar and bio to customise your profile. Please note that the display name you select does not need to include your real name or any other information that identifies you.
• Personal Data Received from Third-Parties: When you choose to use your Google or Apple account to sign into our Service, we may receive certain information from Google or Apple. This information can include your email address, external account name, and any other data you allow us to access based on your external account privacy settings, such as profile photos. You can revoke our access to this information by removing our connection to that external service. For details on how Google manages and processes user data, please refer to their Google Privacy Policy. For details on how Apple manages and processes user data, please refer to their Sign in with Apple & Privacy.
• User-Generated Content: User-generated content you create, including site descriptions, photos, videos, posts, reviews and other content or information you generate or make available on the Service as well as associated metadata. Metadata includes information on who, when and what piece of content was collected and how that content has been formatted or edited. Metadata also includes information that users can choose to include in posts and reviews such as keywords, geographical or location information, and other similar data.
• Feedback and Support: Information and images you provide when contacting us for support or reporting content and associated metadata including account ID, display name, date and time.
• Map Services: The Service uses open-source map styling software (MapLibre) and retrieves map tiles from open-source mapping services (OpenFreeMaps and OpenStreetMap). To render base maps, satellite imagery, and navigation markers on your device, these third-party mapping networks automatically receive basic connection metadata from your device, including your IP address, device model, operating system, and geographic region. This technical data is strictly utilized to deliver the requested map tiles to your device and is not used to identify your individual profile, track your browsing behavior, or target advertisements.
• Location Data: To provide our map discovery features you may choose to share your geolocation by turning on location services and granting permission on your mobile device. The App will access the device’s location data only while the application is actively open, visible, and being used on the screen. This data is not stored on our servers or shared with third-parties. You can disallow the collection of geolocation data at any time through your device settings. If you decline to share your location, you may still access all features of the App and manually search a region. Access to premium or paid functionality is not dependent on, nor does it require, you to grant location or tracking permissions.
• Device and Log Data: In order to secure our services, authenticate users, prevent fraud and comply with applicable laws we collect information about your mobile device, including unique device identifiers, operating system, app usage patterns including date and time, IP address and country of origin when you connect with our Service.
• Payment Data & Transaction History: If you choose to purchase a paid tier, our third-party transaction and billing facilitation service stores encrypted transaction receipts, subscription status, and a pseudonymous account ID to manage your access across platforms. This technical transactional metadata does not contain, nor do we share, your raw billing information, bank details, or credit card numbers, which are processed exclusively by Apple or Google.
• Offline Data: To support offline capabilities, certain data (such as map regions and site information) is cached locally on your device for up to 7 days.

2. How We Use Your Information

We must rely on a specific legal basis for collecting and using Personal Data, particularly in jurisdictions like the European Economic Area (EEA) and the United Kingdom, as mandated by applicable law (e.g., Art. 6 GDPR Lawfulness of processing).

The most common legal basis for the collection and use of Personal Data are:

• Contractual Necessity: Processing is required to deliver our Service or fulfill our obligations under a contract with you.
• User Consent: You have given us explicit, specific permission for the collection and processing of your Personal Data for a defined purpose.
• Legitimate Interests: Processing is necessary for our business interests, provided these interests are not overridden by your fundamental rights and interests.
• Legal Compliance: Processing is necessary to meet a legal or regulatory obligation that applies to us.

We use your data for a variety of purposes, including to deliver, improve, and secure our services:

• Service Delivery: To display dive sites on the interactive map and community based features to display your posts, photos, videos, reviews to other users, and audit the edit history of dive site descriptions.
• Personalisation: To share display name, avatar and other profile information with the community.
• Communication and Customer Support: To send you service updates or respond to your queries and support requests.
• Promotional Communications and Newsletters (Opt-In): Where you have provided your explicit consent, we may use your registered email address to send you newsletters, updates, marketing materials, and promotional offers about the Service. We do not engage in spam, and you retain the absolute right to withdraw your consent and unsubscribe from these marketing streams at any time.
• Marketing: Posts and reviews that you choose to share via the Service may be displayed within the App, on our Sites, on third party websites, social media and/or third-party apps, including those of our business partners.
• Security: To enforce our terms, prevent fraud, and manage permissions based on your account status and tier.
• Legal Obligations: We may also collect and use your Personal Data to comply with requests from government authorities and/or enforcement bodies and our obligations under applicable laws including the Australian Consumer Law and the Corporations Act 2001 (Cth).

3. How We Share and Disclose Data

We do not sell your personal data for money or engage in targeted advertising. We disclose information only in the following circumstances:

• Service Providers or Vendors: We use third party suppliers ("Service Providers") to provision services required to support and operate our business and may perform services on our behalf or assist us to provide Services to you. We require our Service Providers to only use your Personal Data in connection with providing services to Bommie. All third-party service providers with whom we share user data will provide the same or equal protection of user data as stated in this Privacy Policy. We do not authorise the use or disclosure of your Personal Data for any other purposes other than in connection to the provision of their services to us. Our Service Providers may need to access your Personal Data in connection with providing us with these services:
  • Email Delivery and Communication Platforms: To send you necessary transactional notices (such as password resets or system updates) and any promotional newsletters you have explicitly opted into, we share basic account identifiers (specifically your email address and display name) with secure third-party email delivery services. These communication facilitators are contractually bound to process your information strictly in accordance with our instructions and are legally prohibited from utilising your data for their own independent marketing or commercial purposes.
  • Core Identity Isolation (No Data Sharing with Utility Partners): While we collect your display name and registered email address to establish your account and synchronise your account activity (such as posts, bookmarks), this information is strictly isolated on our secure backend database servers. We never share, sell, rent, or allow access to your email address or account credentials by our third-party mapping, translation, weather, or marine environmental data vendors.
  • Cloud Infrastructure, Security, and Database Hosting: We partner with industry-leading hosting, database, and security providers to deliver a secure, fast, and stable application. Our backend database systems, user authentication, and secure file storage are hosted on servers that adhere to strict, industry-standard regulations (including GDPR and SOC 2). To secure and optimize the Bommie application and website (www.bommie.app), all network traffic passes through a secure global proxy and network optimization delivery network. This proxy automatically processes basic technical connection metadata (including your IP address, device type, operating system, and request headers) to detect and block malicious actors, mitigate Distributed Denial of Service (DDoS) attacks, enforce rate-limiting, and cache content for faster load times.
  • MapLibre, OpenFreeMaps, & OpenStreetMap: To render base maps, geographic boundaries, and satellite views within the application.
  • In-App Transaction and Subscription Facilitators: To process and synchronise payment receipts, active subscription statuses, and purchase history across multiple devices and mobile platforms.
• Public Information: Certain information you provide may be publicly visible through the Service. Your profile (display name, avatar) and User-Generated Content (posts, reviews, site edits) are visible to other users of the Service as part of the community generated content features.
• Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of our Service to another provider, your Personal Data may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction along with other assets.
• Legal Requirements: We may disclose information if required by law or to protect the safety of our users.

4. Data Storage, Security and Safeguards

We are strongly committed to keeping your Personal Data safe. We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your Personal Data from unauthorised access and processing. These measures include:

• Secure Servers: We store Personal Data on secure servers that adhere to strict, industry-standard regulations, including GDPR, CCPA, HIPAA, and SOC 2.
• Encryption in Transit: HTTPS/TLS protects sensitive information from interception, tampering, and unauthorized access during transit.
• Password Encryption: Passwords are encrypted and stored using password-hashing algorithms.
• Access Controls: Strict Role-Based Access Control (RBAC) limits who has access to data.
• Payment Security: Payments are processed directly by the applicable app store (Apple App Store or Google Play Store). We do not store your credit card details or full payment information on our servers.

5. Data Retention

We retain your personal data on our servers for as long as your account remains active or for as long as reasonably necessary to fulfill the purposes outlined in this Privacy Policy, including satisfying any legal, accounting, tax, or reporting requirements.

Account Deletion: If you delete your account, we will take all reasonable steps to process this request and delete your Personal Data as required by applicable law. User-generated content you created and made available on the Service, such as photos, videos, posts, reviews and associated metadata, will be removed from our servers. However, user-generated site descriptions, reports and feedback will be anonymised and retained as de-identified contributions to the Service.

6. Your Privacy Rights

We grant all users control over their personal data. Depending on where you reside, you may have specific legal rights regarding the information we collect.

6.1. General Rights (All Users)

Regardless of your location, you can exercise the following rights through your account settings or by contacting us:

• Access and Update: You can access and update your profile information, including your avatar and display name, directly within the App.
• Account Deletion: You may request the deletion of your account and associated data directly within the App.
• Opt-Out of Marketing: You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in our communications.

6.2. Australian Users

Under the Privacy Act 1988 (Cth), Australian residents have the following rights:

• Access and Correction: You have the right to request access to the personal information we hold about you and request corrections if it is inaccurate, incomplete, or out of date.
• Anonymity: Where practicable, you have the right to interact with us anonymously or using a pseudonym (e.g., when browsing public dive sites without an account).
• Complaints: If you believe we have mishandled your data, you may lodge a complaint with us. If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

6.3. European (EEA) and UK Users

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), you have rights under the GDPR and UK GDPR, including:

• Right to Access: You may request confirmation of whether we process your personal data and receive a copy of that data.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request that we delete your personal data ("right to be forgotten") if it is no longer necessary for our purposes or if you withdraw your consent.
• Right to Restrict Processing: You may ask us to limit how we use your data in certain circumstances, such as while we verify the accuracy of data you contest.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format to transfer to another service.
• Right to Object: You may object to the processing of your data for direct marketing or where we rely on "legitimate interests" as our legal basis.
• Withdraw Consent: Where we rely on consent to process your data (e.g., for location tracking), you may withdraw it at any time.

You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK) if you believe we have violated your privacy rights.

6.4. United States Users

Residents of California, Virginia, Colorado, Connecticut, and other states with consumer privacy laws have specific rights:

• Right to Know: You may request details about the categories of personal data we collect, the sources, the business purposes for collection, and the third parties with whom we share it.
• Right to Delete: You may request the deletion of your personal data, subject to certain legal exceptions.
• Right to Correct: You may request the correction of inaccurate personal data we hold about you.
• Right to Opt-Out of "Sale" or "Sharing": Under laws like the CCPA, "sharing" data for targeted advertising may be considered a sale. You have the right to opt-out of this sharing for cross-context behavioral advertising. We do not sell your personal data for money or engage in targeted advertising.
• Right to Non-Discrimination: We will not deny you services, charge you different prices, or provide a different quality of service for exercising your privacy rights.
• Right to Appeal: If we decline your privacy request, residents of certain states (e.g., Colorado, Virginia) have the right to appeal our decision.

6.5. How to Exercise Your Rights

To exercise any of these rights, please contact our Privacy Officer (details below).

• Verification: To verify your identity, email authentication is necessary for processing privacy requests. This is done by responding to a verification email sent to the email address linked to your Bommie account. If we cannot verify your identity through this email authentication, we will be unable to complete your request.
• Response Time: We aim to respond to legitimate requests within one month (or 45 days for US requests). If we require more time, we will inform you of the reason and extension period.

7. Children's Privacy

Bommie is not directed to children under the age of 16. No individual under 16 may use the Service or provide any Personal Data to Bommie (e.g. a name or email address). We do not knowingly collect personal data from children. If we become aware that we have collected such data without parental consent, we will take steps to delete it.

8. International Transfers

Bommie is based in Australia but utilises cloud-based services that may store data in various regions. By using the Service, you acknowledge that your information may be transferred to and processed in countries other than your own, which may have different data protection laws.

9. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our technical architecture or business practices (e.g., new subscription tiers or partnerships). We will notify you of material changes through the App or via email.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact the Bommie Privacy Officer:

• Email: support@bommie.app
• Subject: Bommie Privacy Enquiry