Privacy Policy

Last updated: October 27, 2026

Divera ("we", "us", or "our") operates the Divera mobile application for iOS and Android (the "App"), the web dashboard at center.divera.app (the "Dashboard") and the website divera.app. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have. Your use of Divera is also governed by our Terms of Service.

1. Information We Collect

We collect the information you give us: your name, email address, profile picture, certifications and insurance details you add, dive logs, photos and other content you share.

Location

With your permission, we use your device's location to show nearby dive sites and dive centers. Location is only accessed when you use map features and is not tracked in the background.

Imported dives

If you import dives from a dive computer or a file, we store the dive data it contains, such as depth, temperature, time and location.

Analytics and crash reports

If you accept analytics, we also collect app usage events and crash reports together with basic device information (model, operating system and app version). You can turn this off at any time in the App settings.

On the Dashboard, analytics runs only if you click Accept on the consent banner; if you reject it, no analytics is loaded. If you accept, we collect the pages you visit as general page types (never booking, dive or other IDs), the actions you take (for example, signing in or logging a dive) and a pseudonymous user ID (your account ID, never your name or email). We also collect error reports from the Dashboard, with technical details of the error, browser information and your account ID.

Cookies

The Dashboard stores your analytics choice in your browser's local storage. Analytics cookies (_ga, _ga_*) are set only after you accept analytics. We do not use advertising cookies.

2. How We Use Your Information

• To provide the App's features, including AI species identification and your dive log
• To display your dives, sightings and the content you choose to share
• To show you dive sites and dive centers near your location
• To manage bookings you make with dive centers
• To send you service communications (e.g., account verification)
• With your consent, to analyze usage and fix crashes
• To find and fix errors in the Dashboard, based on our legitimate interest in keeping it working (GDPR Art. 6(1)(f))
• If you accept analytics on the Dashboard, to understand how it is used and improve it, based on your consent (GDPR Art. 6(1)(a))
• We never use analytics or error data for advertising
• To send dive temperature records, and the photos of your public dives, to BlueDOT for scientific research, without your name, based on our legitimate interest in supporting scientific research (GDPR Art. 6(1)(f)); you can object by switching it off, as described in section 5

3. Information Sharing

We do not sell your personal data. We share data only in these cases:

• Community features: your public profile and the dives you make public are visible to other Divera users.
• Dive centers: when you book with a dive center, we share your booking details and the profile information needed for that booking with the dive center.
• Service providers: the providers listed in section 4, which process data only on our behalf.
• Citizen science: fish sightings with MINKA only if you opt in, and dive temperature records, plus the photos of public dives, with BlueDOT unless you switch it off, as described in section 5.
• Legal requirements: if required by law or to protect our rights and the safety of our users.

4. Third-Party Services

We use these providers to run Divera:

• Supabase: sign-in, database and file storage. Our data is hosted in Zurich, Switzerland.
• Railway: hosts our API servers.
• Google Gemini: when you ask Divera to identify species in a photo or video, the image is sent to our servers and to Google's Gemini API to return an identification. Live species detection in the camera runs on your device and sends no images. We do not use your photos to train AI models without your explicit consent.
• Firebase Analytics and Crashlytics (Google): usage analytics and crash reports, only if you accept them.
• Firebase Analytics (Google Analytics 4), by Google Ireland Limited and Google LLC: Dashboard usage analytics, only if you accept them. Advertising features and ad signals are off.
• Sentry (Functional Software, Inc.): error monitoring on our servers and on the Dashboard. Sentry receives no analytics.
• Resend: sends account and service emails.
• Stripe: online payments to dive centers that accept them. Card details are entered with Stripe and never reach Divera.
• Apple Maps and Google Maps: display maps; the map provider receives your IP address and the map area you view.
• Sign in with Apple and Google Sign-In: only if you choose to sign in with them.

Some providers may process data outside the European Economic Area. When they do, the transfer is covered by appropriate safeguards, such as the EU Standard Contractual Clauses. Google LLC and Functional Software, Inc. may process data in the United States; these transfers rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

5. Citizen Science and Research Partners

Divera lets you contribute to marine citizen-science projects. We currently work with two partners:

• MINKA (minka-sdg.org, operated by ICM-CSIC, Spain): if you enable sharing on a sighting, we send the species, dive date and time, location (GPS coordinates), depth, count, behaviour, habitat, your notes and up to 5 photos. A sighting is shared only if its dive is public, you enabled sharing on it and it has at least one photo. Observations are published under a Divera account, not your name or email, under an open license (CC BY).
• BlueDOT ("Divers for Ocean Temperature", coordinated by MARUM – Center for Marine Environmental Sciences, University of Bremen, Germany): an open, quality-controlled database of ocean temperature measured by dive computers, used to study ocean warming and marine heatwaves. For every dive that has a location, we send, without your name, username, email or profile: the date and time of the dive; its location (latitude and longitude of the dive site or area); depth and water temperature (the full depth/temperature profile when the dive was imported from a dive computer, otherwise the maximum depth and the water temperature you entered), plus air temperature if you entered it; the dive-computer model, which scientists use to correct sensor error; only when the dive is public ("Everyone"), your dive notes, with @mentions and email addresses removed, and the photos attached to the dive, with location metadata (EXIF) removed; and a random technical identifier per dive, used to avoid duplicates, which does not identify you. BlueDOT uses the photos internally for its research, for example to see water clarity, the seabed and marine life. Photos can show people, including your buddies: only add photos of recognisable people to a public dive if they agree. We never share with BlueDOT your name, username, email, profile, videos, your buddy list, or the notes and photos of dives that are not public (followers-only or private).

MINKA: sharing is optional, off by default and enabled separately for each sighting. Legal basis: your consent (GDPR Art. 6(1)(a)); you can withdraw it by turning sharing off before the data is sent.

BlueDOT: sharing is on by default for new dives. You can switch it off for a single dive with the "Share with BlueDOT" switch in the dive flow, or for all future dives with "Share by default" in Library › Science › BlueDOT. You can also share older dives read from your dive computer; these dives are not added to your logbook, are sent only as scientific temperature records (never photos), and only dives with a location are sent (the GPS position recorded by the computer, or the location you assign to the trip). Legal basis: our legitimate interest in supporting scientific research (GDPR Art. 6(1)(f)), with the safeguards of GDPR Art. 89 (data minimisation; your name and account are never shared). You can object at any time, for every future dive, with the switches above. Records and photos already delivered to BlueDOT become part of a scientific dataset and cannot be withdrawn afterwards; switching sharing off only stops future sharing. BlueDOT is located in the European Union (Germany), so no international data transfer takes place.

Once data has been sent, each partner acts as an independent data controller: it decides how the data is published, used and kept under its own terms and privacy policy, and Divera is not responsible for how the partner uses it. When a partner publishes shared data under an open license (as MINKA does), it may be copied and reused worldwide and cannot be fully recalled; deleting the sighting, the dive or your Divera account does not remove copies already shared. To request removal, contact the partner directly. We may add partners in the future and will list them here; if a partner is outside the European Economic Area, we will use appropriate safeguards for the transfer.

6. Apple Health

On iOS, if you choose to import a dive from Apple Health, Divera reads only that dive's underwater workout, depth samples, water temperature and GPS route. We ask for read access only, never write to Apple Health and never read any other health data. Only the dive you pick is uploaded. Health data is never used for advertising, never sold, and never shared with citizen-science partners as health data. You can revoke access at any time in the Health app.

7. Data Security

We implement industry-standard security measures, including encryption in transit and at rest, to protect your information from unauthorized access, alteration, or destruction. However, no method of electronic transmission or storage is 100% secure.

8. Your Rights

You can access, correct, obtain a copy of, or delete your personal data, object to or restrict certain processing (for example, you can switch off sharing with BlueDOT in the App), and withdraw any consent at any time, including analytics, which you can turn off in the App settings and, on the Dashboard, with the "Analytics settings" link at the bottom of the Dashboard. You can delete your account from the App settings or on our account deletion page. To exercise any other right, contact us at the address below.

If you are in the EU, you can also lodge a complaint with your data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).

9. Data Retention

We keep your data while your account is active. When you delete your account, we delete your personal data within 30 days, except data we are required by law to keep and data already shared with citizen-science partners (see section 5). Analytics and crash data are kept by Firebase for a limited period under its retention settings. Dashboard analytics and error data are kept by Google (Firebase Analytics) and Sentry for a limited period under their retention settings.

10. Children's Privacy

The App is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Third-Party Links

The App may contain links to third-party websites or services (e.g., dive centers). We are not responsible for the privacy practices of these third parties.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top shows the latest revision, and we will tell you about material changes in the App or by email.

13. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Divera
Email: divera.app@gmail.com
Website: https://divera.app