Privacy Policy

Last updated: October 2026

This privacy policy explains how InDive collects, uses, and protects information when you use indive.io. We've written it to be readable, not just legally defensible.

Who We Are

InDive is operated by PT Cinta Bali Cantik (trading as Ocean Earth Travels), registered in Indonesia. For any privacy-related questions, contact us at [email protected].

What We Collect and Why

Analytics (Google Analytics 4)

We use Google Analytics 4 to understand how visitors use the site: which pages are visited, how long people stay, where traffic comes from. We use it to improve InDive.

GA4 collects data including your IP address (anonymised), browser type, device, and pages visited. This data is processed by Google and subject to Google's privacy policy. If you prefer not to be tracked, you can install the Google Analytics opt-out browser add-on.

When you are signed in, we also send GA4 the random number our database gives your account. It is not your email, name or username. It lets us count how many members come back, including from another device. With it we send three facts: that you are a member, the month you joined, and whether you work for InDive, so we can leave our own team out of the figures.

GA4 also records the actions you complete, such as signing up, logging a dive, following a member or requesting a cabin. Each one carries where it happened, how you did it and, where it applies, a number such as the guests on a request. It never carries your notes, messages, email or other members' names. Links in the emails we send carry a short tag naming the email, such as forecast alert or invite, so we can see which emails bring people back.

Contributor Applications

If you apply to become an InDive Area Contributor, you'll be sharing information directly with our team by email (name, dive center name, location, contact details). This information is used solely to set up your contributor profile and communicate with you about the programme. We don't share it with third parties.

Accounts

You can create an InDive account to keep your saved trips and requests across devices, and to log dives. You sign in with a link or a 6-digit code that we email you, or with your Google or Apple account. The link and the code work once and expire after 30 minutes. After 5 wrong codes, we cancel the codes sent to that address. We store your email address, your name if you add one, your username if you pick one, the date you confirmed your email and the ID of your My trips list. Creating an account does not add you to our booking system or to any mailing list. Your account page has a newsletter box, which is off by default. If you tick it, we store that and the time you ticked it, and we will use it only if InDive starts a newsletter. Untick it at any time. Contributors, dive centres that manage a listing and our own team sign in the same way, with an emailed link or code, Google or Apple. InDive has no passwords. Public profiles of our team carry an InDive admin or InDive editor badge.

A dive centre that claims its listing does so from its InDive account, and the claim uses that account's email address. We store the claim with the name, role, phone number, website and message given. A claim from an address on the centre's own website domain, or from the email listed for the centre, is approved automatically. Our team reviews the others.

You can delete your account at any time on your account page. That removes your account, the linked Google or Apple sign-in, your saved trips, your dive logs, your wishlist, your public profile, your wall posts, the shakas you gave, your follows and buddies, and your photos. Requests you sent stay with our booking team as booking records (see How Long We Keep Data).

Signing in with Google

If you choose Sign in with Google, Google sends us your name, your email address, your profile picture and your Google account ID. We ask for nothing else, and we cannot see your Google password, contacts, files or any other Google data.

We use this data only to sign you in and to show your name and picture on your account. Your name stays private. If you created your account with Google, your Google picture is your profile photo until you replace or remove it, and it shows on your public profile if you pick a username. We do not use it for advertising, we do not sell it and we do not share it with anyone. Google learns that you signed in to InDive.

To delete it, delete your account on your account page. That removes your Google account ID, name, email and picture address from our database. You can also remove InDive's access in your Google account at myaccount.google.com/connections.

InDive's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Apple

If you choose Sign in with Apple, Apple sends us your Apple account ID, an email address and, the first time only, your name. If you choose to hide your email, the address is a private relay address that Apple creates to forward mail to you. Apple does not send us a picture.

We use this data only to sign you in. We do not use it for advertising, we do not sell it and we do not share it with anyone. To delete it, delete your account on your account page. You can also stop using Apple sign-in for InDive in your Apple Account settings, under Sign in with Apple.

Usernames, Profiles and Dive Logs

If you pick a username, you get a public profile at indive.io/u/your-username. It shows your username, the month you joined, how many dives you have logged, your public dive logs, and any destinations or dive centres you look after on InDive. It also shows how many followers, people you follow and buddies you have. The names behind those numbers show only to you and your buddies. It never shows your email address, your name, your wishlist, the sites you watch or your private dives.

You can add more to your profile on your account page. Everything here is optional, and everything you add is public on your profile: a profile photo, your certification level and agency, your number of logged dives as a range, and links to your Instagram, Facebook, YouTube, TikTok or website. We store a photo you upload as a 256-pixel image on our media server (media.indive.io). When you replace or remove it, we delete it from our storage and from the network that delivers our images.

When you log a dive, we store the site, date, time, depth, dive time, water temperature, your rating, visibility, current, what you saw, your notes and, if you name it, the dive centre you dived with. On a dive imported from Garmin we also keep its Garmin activity number, which is not shown. The first YouTube or Instagram link in your notes shows as a video or post on the dive, as described for wall posts below. A public dive shows that centre as “with” the centre’s name. Dives are public unless you mark them private. A public dive shows on the dive site's page and on your profile, signed with your username. A private dive is visible only to you.

Any signed-in member can report a public dive. The report alerts our team, and the dive stays up until the team keeps it or hides it. If we hide your dive, we tell you. We store the report with the member who made it and the reason given. You can edit or delete your dives at any time.

Your wishlist (“Want to dive here”) is private and shows only on your My dive sites page.

You can add up to 4 photos to a dive log, a review or a wall post. We store them on our media server (media.indive.io) and delete them with the item or with your account. A photo you upload but never attach to anything is deleted after a day.

Follows, Buddies and Wall Posts

Any member can follow another member, without approval. A buddy request needs the other member to accept, and buddies are linked both ways. We store who follows whom, buddy requests and buddies. If you block a member, any follow or buddy link between you ends, both ways, and we store the block.

Only you can post on your own profile wall. Each post is public or for your buddies only. You set the default in Settings and can change it for each post. A post can hold text, up to 4 photos, a link, a YouTube video or an Instagram post. For a link, we fetch the page to build a preview and keep a copy of its image on media.indive.io. A YouTube video plays from youtube-nocookie.com. Its player loads when the post comes into view, which sends your IP address to YouTube (Google). YouTube says it sets no cookies until you play the video. To show a YouTube Short upright, our server fetches its thumbnail from YouTube once, when you save. That request carries none of your data. An Instagram post, carousel or reel shows in Instagram's own frame, loaded from instagram.com when the post or dive comes into view. Instagram has no cookie-free version, so the frame sends your IP address to Instagram (Meta), and Instagram can set its cookies. We load no Instagram script, only the frame. You can tag members you follow or are buddies with by their @username. They get a notification.

Other members can give a post a shaka. We store who gave it. Posts have no comments. Any member can flag a post. The flag alerts our team, and the post stays up until the team keeps it or hides it. If we hide your post, we tell you. You can delete your posts at any time.

Notifications

When something on your account changes, we show you a notification on InDive: a request booked, a cabin hold ending or ended, a watched site looking good, one of your dives or posts hidden or restored, a decision on a listing claim, a new follower, a buddy request or acceptance, a shaka on your post, or a tag. We store each notification’s title, text, link, when we sent it and when you read it. We delete notifications after 90 days, or with your account.

Social Emails

We email you from [email protected] when someone sends you a buddy request, accepts yours or tags you in a post. New followers and shakas come together in one email a day at most. You can switch off each type in Settings, under Email alerts.

Messages

Members who are buddies can send each other messages on InDive: text, up to 4 photos, and posts shared with the Share button. We store each message with who sent it, when, and when the other member last read the conversation. Only buddies can write to each other. If one of you ends the buddy link or blocks the other, you can still read the conversation but not add to it.

Messages are between the two of you. Our team does not read them. If you report a message, our team sees that one message, with who sent it, to decide whether to hide it. If a message waits 2 hours unread, we email you once to say who wrote, without the message itself. You can switch that email off in Settings, under Email alerts. If you use the InDive app and turn on phone notifications, a new message shows on your phone with who wrote and its first words. To reach your phone it passes through Expo, the service the app uses for notifications, and Apple or Google. Neither our team nor Expo keeps it. You can switch these off in Settings, under Phone notifications. A message you delete is gone for both of you, with its photos. If you delete your account, your conversations are deleted for both members.

Your location (Near me)

When you tap Use my location, or when you have already allowed it, your browser or phone gives us your position so we can list the dive sites and centres closest to you. Your device rounds it to about 1 km before sending it. We use it for that one request and do not store it, log it, or link it to your account. You can stop it at any time in your browser or phone settings for indive.io.

Invites

A member can invite a friend to InDive by email, or share a personal link. For an email invite, we store the friend's email address with the member who sent it and the date, for 90 days, then delete it. We use it only to apply the limits below. The member can add a short note to the email. We send the note but do not store it, and we remove any links from it. Invites come from [email protected]. The reply-to address is the inviting member's own email address, so the friend sees it and a reply goes to that member.

To stop invites being used for spam, a member can send 10 invite emails a day and invite the same address once in 30 days. Any address gets at most 3 invite emails in 30 days, from all members together. Every invite email has a link to stop InDive invites. If you use it, we put your email address on a list so that no member can send you an invite again. The list holds only the address. We keep it with no time limit, because without it we could not keep your choice.

When someone joins through an invite, we record who invited them. The inviting member sees how many friends joined from their invites, as a number only, with no names.

Dive Conditions Alerts

If you watch a dive site, we store which sites you watch and the date of the last alert we sent you. When the forecast for a watched site looks good, we email you at your account's address. We use these emails for alerts only. Stop them with the link in any alert email, which works without signing in, by unwatching the site, or by deleting your account.

Contact Enquiries

If you email us, we keep that correspondence to respond to your enquiry and for our records. We don't add you to any mailing list without your explicit consent.

Liveaboard Requests

When you ask for a cabin on a liveaboard, you give us your name, email, phone number, certification level, number of logged dives and any message you add. If you are signed in, we fill in your name, email, certification and logged dives from your account, and you can change them before you send. Nobody else sees them. Ocean Earth Travels' booking team stores these in its booking system. It uses them to hold your cabin, ask the boat and send you the boat's booking terms. For a hold, the team passes the boat your name, certification and logged dives. Once you confirm the booking, it passes on the rest of your details so the boat can book you. We email you a copy of your request. We also keep the IP address the request came from, to stop abuse of the form.

Buddy Links

If you send a trip to a buddy, we store the link with your first name, any note you add and your IP address. Anyone with the link sees your first name, the note and the trip.

Cookies

InDive uses cookies and browser storage in these places:

My trips: a cookie (indive_vid) holds a random ID, so the trips you save and the requests you send show up when you come back. It holds no name or email and lasts 400 days. A second cookie (indive_mt) only holds the number shown on the My trips icon. You can clear both from the My trips page.
Signing in: if you have an account, a secure cookie (authjs.session-token) keeps you signed in for 30 days. A second cookie (indive_in) only tells the site to show you as signed in, and holds no personal data. Signing out removes both, along with the My trips cookies on that browser.
Your settings: your browser remembers the currency and light or dark mode you picked, and the first name you entered, so you don't type them again. The name only reaches us when you make a buddy link.
Google Analytics 4: sets cookies to track sessions and page interactions (see above).
YouTube: a video in a dive log or wall post loads from youtube-nocookie.com when it comes into view. YouTube says it sets no cookies until you play the video.
Instagram: an Instagram post in a dive log or wall post loads in Instagram's frame when it comes into view. Instagram (Meta) receives your IP address and can set its cookies. It has no cookie-free version.
Maps: our dive site maps use map tiles from Esri. Loading a map sends your IP address to Esri. It does not set cookies.

You can control cookies through your browser settings. Disabling GA4 cookies won't affect your ability to use the site.

How Long We Keep Data

GA4 analytics data is retained for 14 months (Google's default). Contributor and contact information is kept for as long as the contributor relationship is active, or until you ask us to delete it. Liveaboard requests and buddy links are kept for 5 years for our booking records, or until you ask us to delete them. Notifications, and the email addresses of friends invited by email, are kept for 90 days. An address that asked for no more invites stays on that list with no time limit. Accounts, saved trips, watched sites, wishlists, dive logs, wall posts, photos, shakas, follows, buddies, blocks and your newsletter choice are kept until you delete them or your account, or until you ask us to. Reports on dive logs are deleted with the dive they concern. If you delete your account, reports you made stay with the dive but no longer name you.

Your Rights

If you're based in the European Economic Area (EEA) or the UK, you have rights under GDPR including the right to access, correct, or delete personal data we hold about you. To exercise any of these rights, email us at [email protected]. We'll respond within 30 days.

Third Parties

We don't sell, rent, or share your personal information with third parties for marketing purposes. We use these service providers, each only for the job listed: Google (analytics, and sign-in if you choose it), Apple (sign-in if you choose it), Zoho (our booking system, which receives your request), Resend (sends our emails, including sign-in links and alerts), Esri (map tiles), YouTube (videos in dive logs and wall posts), Instagram, part of Meta (posts in dive logs and wall posts) and Cloudflare (delivers the site and protects it from attacks, so it sees every page request). Our database runs on our own server. The liveaboard you ask for receives the details it needs to book you, as described above.

Changes to This Policy

As InDive grows, this policy will be updated to reflect new features (such as contributor dashboards). The date at the top of this page shows when it was last revised. Significant changes will be flagged on the site.

Contact

Questions about this policy or your data: [email protected]