Privacy Policy

1. Who we are

SplashEdit is a product of fshbwl.ai LLC, a California limited liability company. When this policy refers to “we,” “us,” or “our,” it means fshbwl.ai LLC.

Data Protection Contact: [email protected]

2. What data we collect

When you sign in with Google, we receive:

• Your name and email address
• Your Google profile photo URL
• Your Google account identifier (OAuth subject ID)

When you use SplashEdit, we store:

• Account data — username, display name, contact info (encrypted at rest with AES-256-GCM)
• Dive logs — location, site, date, depth, duration, notes, and other dive parameters
• GPS coordinates — latitude and longitude of dive sites, stored only with your explicit consent
• Photos — images you upload, thumbnails, edits, and EXIF metadata
• Usage events — actions performed (pages visited, features used) for improving the product
• Technical data — IP address and browser user-agent string for security and troubleshooting (automatically anonymized after 30 days)

3. How we use your data

We use your data to:

• Provide the SplashEdit service (storing your dives and photos)
• Authenticate your account via Google Sign-In
• Display dive site locations on maps (GPS data, with your consent)
• Generate thumbnails and process photo edits
• Improve the product based on aggregate, anonymized usage patterns
• Detect and prevent abuse, fraud, and security incidents
• Send you service-related communications (e.g., account issues)

3a. AI-powered photo analysis

SplashEdit offers optional AI-powered features for your underwater photos. When you enable AI photo analysis in your privacy settings, we may process your photos using third-party AI models to provide:

• Color correction suggestions — analyzing underwater color cast and exposure to recommend adjustments
• Backscatter detection — identifying suspended particles in your photos for selective removal
• Species identification — recognizing marine life in your photos and adding descriptive tags
• Image quality scoring — assessing sharpness, composition, and usability to help you cull your best shots
• AI Reimagine — generating enhanced variations of your photos using generative AI models

What data is sent: When you use an AI feature, the photo (or a resized version) is sent to our AI provider for analysis. Dive context (depth, water temperature, location) may be included to improve accuracy. Your name, email, and account information are never sent to AI providers.

AI-generated data: Tags, descriptions, quality scores, and other AI-generated metadata are stored in your SplashEdit account. This data is included in data exports and deleted when you delete your account or withdraw AI consent.

Consent and control: AI photo analysis is entirely optional. You can enable or disable it at any time in Settings > Privacy > AI Photo Analysis. Withdrawing consent immediately stops all AI processing and removes all AI-generated tags and descriptions from your photos. Your original photos are never modified by AI processing.

4. Legal bases for processing (GDPR)

We process your data under the following legal bases:

• Contract — account data, dive logs, photos, and preferences are necessary to provide the service you signed up for
• Consent — GPS coordinate storage and AI photo analysis each require your explicit opt-in, which you can withdraw at any time in Settings > Privacy
• Legitimate interest — usage analytics (anonymized after 30 days), security logging, and abuse prevention

5. Third-party services (sub-processors)

We use a limited number of third-party services to operate SplashEdit:

• Google OAuth — authentication only (Google LLC, USA)
• DigitalOcean — cloud infrastructure, database hosting, and object storage (DigitalOcean LLC, USA)
• Cloudflare — CDN, DNS, DDoS protection, and edge caching (Cloudflare Inc., USA)
• Stripe — payment processing for future paid tiers (Stripe Inc., USA)
• Anthropic — AI photo analysis (species identification, quality scoring, color correction suggestions). Photos are processed via Anthropic's Claude API. Anthropic does not retain photo data after processing. (Anthropic PBC, USA)

These providers process data on our behalf under their own privacy policies and our data processing agreements.

6. Where your data lives

All data is stored in the United States. Our servers and object storage are hosted by DigitalOcean in their NYC3 datacenter region. Cloudflare edge caches may temporarily store static assets at global points of presence.

7. Data retention

• Account data, dive logs, photos — retained while your account is active
• Technical data (IP, user-agent) — automatically anonymized after 30 days
• Audit logs — anonymized event records are retained indefinitely for security analysis; PII is stripped
• On account deletion — all personal data, dive logs, photos, and S3 objects are permanently deleted. Anonymized audit records are retained.

8. Your rights under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests
• Withdraw consent — revoke GPS, AI photo analysis, or other opt-in consent at any time without affecting prior processing

9. How to exercise your rights

You can exercise most of your rights directly in the app:

• Delete account — Settings > Danger Zone > Delete Account
• Export data — Settings > Privacy > Download My Data (ZIP archive)
• GPS consent — Settings > Privacy > GPS Coordinates toggle
• AI photo analysis consent — Settings > Privacy > AI Photo Analysis toggle
• Edit profile — Settings page (username, display name, contact info)

For any other requests, email [email protected]. We will respond within 30 days.

10. Cookies

We use a session cookie to keep you signed in. We do not use advertising or tracking cookies. Our analytics service collects anonymous, aggregate usage data without setting cookies.

11. Children

SplashEdit is not directed at children under 16. We require age confirmation during onboarding. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by a notice on the site. Your continued use of SplashEdit after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions about this privacy policy? Email us at [email protected].

14. Automated decision-making

AI photo analysis features (species identification, quality scoring, backscatter detection) use automated processing to generate suggestions and metadata. These features are advisory only — they do not make decisions that produce legal effects or significantly affect you. You can disable AI processing at any time. All AI-generated results can be manually overridden or deleted.