Privacy Policy

OpenSail ("we", "our", "OpenSail") is operated from the United States. This policy explains what personal data we collect when you use opensail.app or the OpenSail iPhone and iPad app ("the iOS app"), why we collect it, how we handle it, and the rights you have over it. If you are a resident of the European Economic Area (EEA), the United Kingdom, California, or another jurisdiction with data-protection laws, additional rights may apply to you; those are called out below.

We collect the minimum data needed to run the service.

• Account data — email address, display name, and a bcrypt-hashed password. We do not store passwords in plaintext.
• Vessel data — hull type, rig type, length, beam, draft, displacement, sail area, and optional stability parameters that you enter to configure routing.
• Route data — origin, destination, waypoints, departure time, and the computed route segments, weather values, and comfort scores associated with each route you compute.
• Voyage data — if you choose to enable voyage tracking, we collect timestamped GPS positions you push via the tracking API or browser. You control whether a voyage is private or shared via a public link.
• Billing data — on the web we use Stripe for payment processing. Stripe stores your card information directly; we only store a customer identifier, subscription status, and invoice metadata. In the iOS app, subscriptions are bought through Apple (see section 1.1). We never see your card number, CVV, or bank details.
• Developer API data — if you create API keys, we store only a prefix and a hashed secret. The full secret is displayed to you once and is unrecoverable by us.
• Server logs — request paths, response status codes, IP addresses, user-agent strings, and error traces for diagnostic and abuse-prevention purposes. These are retained for 30 days and then deleted.
• Cookies and browser storage— your sign-in session (bearer tokens) lives in your browser's local storage, not in a cookie. If you arrive through a partner (affiliate) link we set a first-party os_ref cookie for 60 days so the partner is credited if you sign up. If analytics is allowed (next bullet), Google Analytics sets its own first-party cookies to distinguish visitors; declining deletes them. We never use advertising or cross-site tracking cookies.
• Usage analytics— we use Google Analytics 4 to understand how the product is used: pages viewed, features used (for example that a route was computed, or a forecast model switched), approximate location derived by Google from your IP (country/city level), device and browser type. Where the law requires consent (EEA, UK, Switzerland — determined conservatively from your device's timezone), analytics is fully off until you choose "Allow analytics" in the cookie banner: no script loads and no data of any kind, not even anonymous pings, is sent to Google. Elsewhere it is on by default, and declining in the banner (or later via "Cookie preferences" in the footer) stops all sending and deletes the analytics cookies. We honor the Global Privacy Control browser signal as a decline. We configure analytics with advertising features and Google Signals disabled, we strip tokens and identifiers out of URLs before they are sent, we reduce external referrer addresses to their site of origin, and we never send your email, name, vessel names, or route coordinates to Google. Signed-in usage is linked by an opaque internal account identifier only, and purchase events carry a hashed transaction reference rather than any payment identifier.

We do not collect data about your children; the service is not intended for users under 16. If you believe we have collected data from a minor, contact us and we will delete it.

The iOS app uses the same OpenSail account as the website and collects the same kinds of data described above. It contains no advertising, analytics, or crash-reporting software, and it does not track you across other companies' apps or websites.

If you subscribe in the iOS app, Apple processes the payment under Apple's own terms and privacy policy; we never see your payment details. So that your subscription is credited to the right account, the app attaches your OpenSail account identifier to the purchase, which means Apple also holds that identifier alongside your purchase. Apple then sends us signed records of the purchase and of later renewals, cancellations, and refunds. From those records we store: the subscription product and plan, its status, purchase, renewal and expiry dates, auto-renewal settings, Apple's transaction identifiers, the App Store country, the price and currency Apple reports, any offer or promotion applied, refund or cancellation reasons Apple gives, and the signed records themselves. We use them only to give your account the plan you paid for and to keep billing records.

The iOS app asks for location access "While Using the App" only. It never asks for "Always" access and never reads your location in the background. On the website, your browser asks before sharing your location. We read your position only when you use one of these features, and only while you use it:

• Show my position on the map — when you tap the locate button (and, on the website, each time you open the map once you have allowed location), the map centres on you. Your exact position stays on your device; as with any map, the area you are then viewing is used to fetch weather and map tiles.
• Start a route from where you are (Re-plan, or re-running a saved passage from your GPS position) — your position is sent to us as the start of the new route and is stored with that route, like any other route start.
• Check an anchorage at my position — your position is sent to us so we can score the anchorage. It is stored only if you then save it as an anchor watch (section 1.3).
• Voyage tracking (website only, if you turn it on) — the positions you share are stored with that voyage, as described above.

Our server logs record the web address of each request, and a position you check can appear in that address. Server logs are kept for 30 days (section 5).

Anchor watches. When you watch an anchorage we store its position (to about 10 metres), the wind directions it is open to, the wind and gust limits you set, and the latest result of our check. Each time a new forecast arrives we re-check the next 48 hours. We e-mail you only when the outlook gets worse, at most once every 12 hours for each watch, and we also send a browser notification if you have allowed them.

Route watches.When you watch a route we e-mail you, at most once a day, if the wind or waves along it get notably worse in a newer forecast. The e-mail can include a short summary written by our AI service (section 3). Route watches end on their own after the voyage's time window has passed.

Stopping them.In the iOS app, open Anchor → Anchorage reports and tap Turn off; to stop a route watch, unwatch the route in the route planner (website or app). On the website, anchor watches cannot yet be turned off from the page, so ask us at opensail.app/support and we will turn it off. Turning a watch off stops the e-mails straight away; the watch record, including an anchor watch's position, stays in your account until you delete the account. Alert e-mails are sent through Resend (section 3).

In the iOS app you can save forecast weather for a route or an area before you leave signal behind. Our server prepares the file: we keep a record of the request (the route or area, the forecast model, and the time window) and the prepared file. The file is deleted from our server 7 days after it is ready; the request record stays in your account until you delete the account.

The download itself is stored only on your device, inside the app's private storage, and is excluded from iCloud and computer backups (a small amount of recent working data may be included). Signing out locks it; deleting your account from the app, or deleting the app, removes it. The app also keeps forecast frames you have recently looked at (up to 60 MB, removed after about 7 days of use or when you clear the app's temporary cache) so the map works on a weak connection. Passages you keep in the app's passage library are included in your device backups.

On the website, your browser keeps the most recent forecast for each model, plus recently viewed forecast frames (up to 60 MB, for up to 7 days), in its own storage on your computer so the map keeps working offline. You can clear it by clearing your browser's site data for opensail.app.

• Base map — map tiles come from OpenFreeMap (tiles.openfreemap.org), and the sea-mark overlay from OpenSeaMap (tiles.openseamap.org) when that layer is on. Your device fetches them directly, so, as with any online map, those services see your IP address and which area of the map you are viewing.
• NOAA nautical charts — our server fetches these from the U.S. National Oceanic and Atmospheric Administration on your behalf. NOAA sees only which chart area was requested, not your IP address.
• U.S. weather alerts (developer API) — when our weather-alert service is asked for alerts in an area, our server asks the U.S. National Weather Service for the centre of that area. The Weather Service does not see your IP address.

• Contract — account, vessel, route, voyage, watch, saved-weather, location (when you use a location feature) and billing data are processed because you asked us to provide the service. Without them we cannot route, render, or charge.
• Legitimate interest — server logs and rate-limit counters are processed to keep the service reliable, detect abuse, and protect other users. We do not profile you or sell inferences.
• Legal obligation — tax, payment, and fraud records retained as required by financial regulation.
• Consent— any marketing email, if you opt in, and usage analytics where consent is legally required (EEA, UK, Switzerland). You can withdraw either at any time — marketing from the account page, analytics via "Cookie preferences" in the footer.
• Legitimate interest (analytics, outside consent-required jurisdictions) — understanding which features are used so we can improve the product. You can object by declining analytics in the cookie banner.

We share the minimum data needed with the companies and services below. Stripe, Sentry, Resend, Anthropic, Google and DigitalOcean act as our processors under contract. Apple, the browser push services, and the map tile services are independent: Apple processes App Store payments under its own terms; the map services are contacted by your device directly, and the push services deliver our encrypted alert notifications to your browser, each under its own policies.

• Stripe, Inc.(United States) — payment processing and subscription billing. Governed by Stripe's privacy policy.
• Sentry (United States) — application error reporting. We send anonymized stack traces and limited request metadata; we do not send route geometry or vessel names.
• Resend(United States) — transactional e-mail, such as account verification, password reset, welcome and partner-programme messages, and anchor and route watch alerts. We send your email address and display name, and for alerts the alert's content (the anchorage position or route summary, the forecast numbers, and any AI summary).
• Anthropic(United States) — our AI briefings (the route explanation, the comparison of route options, the departure-window briefing, and the summary in route-watch e-mails) send a summary to Anthropic's Claude API. For a route, that is: positions along the route (most of them rounded to about 10 km), its timing, the forecast wind and waves along it, the routing mode, and, if the route uses one of your saved boats, its hull type. For a departure briefing it is the candidate departure times and the forecast numbers for each, with no positions. We do NOT send your email, password, or name. Route briefings are generated when you compute and compare routes while signed in, departure briefings when you ask for one, and route-watch summaries for routes you watch.
• Apple Inc. (United States) — App Store in-app purchases in the iOS app, as described in section 1.1. Apple processes these payments under its own privacy policy.
• Browser push services— if you allow browser notifications, alert notifications are delivered through the push service run by your browser's maker (for example Google for Chrome or Mozilla for Firefox).
• OpenFreeMap and OpenSeaMap — map tiles, as described in section 1.5. They receive your IP address and the map area you view, not any account data.
• Google LLC (United States) — usage analytics via Google Analytics 4, subject to the consent and configuration limits described in section 1. Google acts as our processor for this data under the Google Ads Data Processing Terms; we have disabled Google Signals, ad personalization, and data sharing for advertising purposes.
• DigitalOcean (United States) — infrastructure hosting. Your data resides on servers operated by DigitalOcean under their security and privacy commitments.

We do not sell your personal data. We do not share it with advertising networks or data brokers.

Our servers are located in the United States. If you access OpenSail from the EEA or the UK, your personal data will be transferred to and processed in the United States. Transfers rely on Standard Contractual Clauses (SCCs) with each U.S. sub-processor and, where available, supplementary technical measures (encryption in transit and at rest).

• Account, vessel, route, and voyage data, anchor and route watches, and saved-weather request records: for the life of the account, then deleted within 30 days of account deletion.
• Saved-weather files on our server: deleted 7 days after they are ready. Saved weather on your device: until you delete it, delete your account from the app, or delete the app.
• Billing records: 7 years, as required by financial regulation. Card-payment records are kept by Stripe. Apple in-app purchase records are kept by us; when you delete your account they are unlinked from it (they keep only Apple's identifiers and your former account number).
• Server logs: 30 days.
• Usage analytics: Google Analytics user-level data is retained for 14 months, then deleted automatically.
• Voyage position snapshots shared via public link: retained while the voyage is public; deleted when you make it private.
• Backups: incremental backups are retained for up to 14 days; monthly full backups up to 12 months.

You have the following rights regardless of jurisdiction:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data from your account page.
• Erasure — delete your account and all associated data (below).
• Portability — receive your data in a machine-readable JSON format.
• Restriction — ask us to pause processing while a complaint is resolved.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, for processing that relies on consent.

You can exercise access and portability rights yourself by calling GET /v1/account/data-export while authenticated, or by using the Download My Data button on the account page. You can exercise erasure by using the Delete My Account button on the account page or by calling DELETE /v1/account. The export does not yet include anchor and route watches or saved-weather records; ask us at privacy@opensail.app for a copy.

If you are in the EEA or UK, you also have the right to lodge a complaint with your national data-protection supervisory authority. We would rather resolve concerns directly — please contact us first.

• All client traffic is served over HTTPS with TLS 1.2 or higher.
• Passwords are hashed with bcrypt and a per-user salt; the plaintext never touches our database.
• API tokens are short-lived (30-minute access tokens, 30-day refresh).
• Developer API keys are stored as hashes; the raw secret is shown once and is unrecoverable.
• We perform automated nightly database backups to a separate region, encrypted at rest.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you without undue delay and in any event within 72 hours of becoming aware, as required by GDPR.

We will update this policy from time to time. The effective date above will reflect the most recent change. Material changes will be announced by email to account holders at least 14 days before they take effect.

Privacy questions or requests: privacy@opensail.app. For security issues, please see our security contact.