Privacy

boating.systems · last updated 2026-09-30

The short version. You can use the apps without an account. What you record is private when it is created, and other people see it only if you share it. We keep your data to run the apps for you. We do not sell it, and there is no advertising. You can download all of it or ask us to delete it.

Below is the detail: what we collect, why, who else handles it, how long we keep it, and what you can do about it. Some apps work differently enough to get their own section at the end.

Who we are and what this covers

boating.systems is run by Progressable LLC, 69 E. Pearl Street, New Haven, Connecticut, USA ("we"). We are responsible for the personal data described here, except for the club records a club keeps in Marina, which we hold on that club's behalf.

This policy covers the websites at boating.systems and its subdomains, and these apps: Chart, Log, Vessel, Guide, Anchor Watch, Marina, Line Honors, Race, Paddle and Boat Recorder. The terms of use sit alongside it. Section 5 of the terms says what we may learn from recorded outings, and what we may never do with them.

What we collect

If you never sign in

Most of each app runs on your device. Signed-out recordings stay on your device and are never uploaded. Some actions still need a server, and for those the app creates an anonymous session: a random account with no name or email. Starring or suggesting a place in Guide, sending feedback, boarding a boat by its code, or joining a race as crew will do this. Settings you change in that session are stored against it.

Your account

You can sign in with Google or Apple. We receive the account identifier, your email address and the name your provider shares. With Apple, the email may be a private relay address. We keep a person record with that name, plus a link from your sign-in to it. Your profile is private unless you change that. Signing in after an anonymous session carries its data into your account; separate accounts are never merged just because their email addresses match.

What you record

Tracks. Signed in, a finished outing's positions, times, speeds and headings are uploaded to your private account. The trip record holds a summary. The track itself is stored in a private file store that no app reads directly; only our own servers do.
Notes, photos and voice clips you add to a trip. Photos are stored as two resized copies, never the original file. The picture metadata is not kept, but the time and location it contained are. A voice clip is at most 90 seconds, stored as recorded. Any caption comes from your own phone's speech recognition.
Imported history. GPX, Navionics, OpenCPN and similar files you bring into Log, and the original files if you ask Log to keep them.
Boats. Name, type, draft and air draft. In Vessel, also engine hours, maintenance, documents, inventory and issues you choose to record, and who has access to the boat.
Sea service. The days and hours Log counts from your trips toward a licence.
People on your trips. Who was aboard, and names you attach to your own photos. Log also keeps a private address book of email addresses you enter for people you have tagged or sailed with; nothing is ever sent to those addresses.
Place contributions. Stars, visits, ratings, suggested places, reports and passage plans in Guide.

Location while you use an app

Chart, Paddle, Race, Anchor Watch and Boat Recorder use your device's location to show where you are and to record. Signed in to Chart, your current position is also saved to your account about every 30 seconds while location is on (see Chart). Other apps use location only on the device unless their section below says otherwise.

Feedback and problem reports

Feedback you send from inside an app includes what you write and what the app knew at that moment. Depending on the app, that means the page, browser and device type, screen size, recent error messages, your settings and boat, and in Chart your position rounded to about 100 m and battery use. Only staff can read it.
Automatic problem reports from Chart's Android app contain an error category, the app build, the Android version, the device brand, a timestamp and whether the phone was online. They contain no tracks, coordinates, account identifiers or messages.
AI assistants you pair with Log may send tips about Log's import instructions. Anything that looks like an email address or a token is removed before storage.

Website analytics

The boating.systems website, Guide, Log and Vessel use Google Analytics to count visits. It records the page address, where you came from, and coarse device and location information, using Google's cookies. It receives nothing you record in the apps. Google Signals, the setting that feeds advertising, is off, and we tell Google that no advertising storage or advertising use is allowed, for everyone. Chart, Anchor Watch, Marina, Paddle, Race, Line Honors and Boat Recorder carry no analytics.

If you are in the European Economic Area, the UK or Switzerland, Google Analytics sets no cookies until you agree. If your browser's time zone is in Europe, a small notice at the bottom of the page asks you to Accept or Decline; either answer is remembered in this browser. Elsewhere, analytics is on by default and no notice is shown. You can change your choice for this browser at any time:

How we use it

To run the apps: show your trips, boats and settings back to you, sync them across your devices and apps, and carry out the sharing you choose.
To fix and improve the apps, using feedback, problem reports and analytics.
To learn from recorded outings in the ways named in section 5 of the terms. Where that work doesn't need to know whose track it is, the data is aggregated and stripped of identifiers. Signed-out recordings and Anchor Watch alarm data are never part of it. No product built from other people's tracks is published yet. Before one is, you will get an account setting to opt out; until then you can opt out by email.
To keep the service safe: rate limits, abuse checks and switches that can turn off a feature quickly.

What we don't do. We don't sell personal data. We don't show ads, use advertising identifiers, or share your data with anyone for their own marketing. We don't send marketing email; in fact no app sends email at all today. Invitations are links that you send yourself.

What other people can see

Trips are private when created. Nothing becomes visible to anyone else until you deliberately share it.
Share links show a trip or journey as a summary or a replay, either exact or as the route only. Anyone holding the link can open it, and you can revoke it at any time. Links expire after 30 days. We store only a scrambled form of the link's key. While a link is active, its preview card (title, date, distance, boat, and one photo you already marked shared) can be fetched without the key, so it shows when you paste the link into a message.
Named people. You can grant a particular person standing access to your trips, and remove it at any time.
Crew on shared pages. People marked aboard appear on your shared pages by first name unless they choose otherwise. A crew member can hide themselves, or show their full name.
Your boat. People you give access to a boat can see what that access covers, including its live position if a boat recorder or a crew member's Chart reports it. The boat's public card and gallery appear only if the boat's managers publish them.
Profiles are private unless you make yours public.
Race results. A published Line Honors race shows its entries and finishes to anyone, including boat names and skipper names.
"Sailed together." When two people's logs show the same outing, the trips are linked only if both of them agree.

Services that handle data for us

Google Firebase and Google Cloud: sign-in, databases, file storage, servers, hosting and push notifications. See Firebase's privacy information.
Google and Apple: when you choose to sign in with them.
Google Analytics: on the pages named above.
Google Photos shared albums: if you attach a shared album link to a trip or journey, our server reads that public album page to show a few of its pictures. The link is stored; the pictures are not copied. Viewers' browsers load them from Google.

Public data sources your device contacts directly

These requests reveal your IP address and the area involved to the service answering. They don't include who you are.

US National Weather Service (weather.gov): wind forecasts use your position; weather alerts use a position rounded to about 5 km.
NOAA: tide and current predictions, requested by station, not by position. Also NOAA chart images and radar for the area on screen.
Esri: aerial imagery for the area on screen. Also CARTO and MapLibre demonstration map tiles in Race and Line Honors, and Connecticut state aerial and parcel layers in Marina.
Google Maps: only if you tap a driving-directions link in Paddle.

Where it's stored and how long we keep it

Where. We store your data with Google Cloud in the United States: our databases and track storage are in South Carolina (us-east1), and our server code runs in Iowa (us-central1). Wherever you use the apps from, your data is sent to and processed in the United States, where data-protection law may differ from the law where you live. If we start storing data in another country, we will say so here first.

On your device: until you delete it, clear the app's storage or uninstall. Android may include Chart's local data in your own device backup.
Your account and what you record: until you delete it or ask us to delete your account.
Log exports: deleted from our servers two days after they are made.
Automatic problem reports: 14 days, plus up to a day for deletion to run. Feedback you write and tips from AI assistants have no automatic expiry; ask us to delete them.
AI assistant pairing codes expire after 24 hours. A pairing you never use again lapses after a year, and you can revoke it at any time.
Our service provider's logs, such as IP addresses in access logs, follow Google Cloud's own retention. Our application records don't store IP addresses.

Your choices

Download everything. In Log, Export my log makes one archive of every trip you own: tracks as GPX and as stored data, your notes, photo copies and voice clips, journeys, your sea-service ledger, and any original files you asked Log to keep. You can make up to three a day. Any single trip also downloads as GPX.
Delete a trip in Log. This deletes the trip, its notes, photos and voice clips, and the route data you recorded for it, unless another of your trips still uses that route. A route that belongs to someone else, such as a race's or your boat recorder's, is not deleted with your trip, and neither are original files you imported (ask us to delete those).
Delete your account with Delete my account in Chart's information panel, on the account deletion page, or by email. Each request is carried out by hand, and we aim to finish within 30 days and confirm by email. We delete your private data and remove your name from anything that must remain, such as a club's record that you were once a member. Records we are legally required to keep are held only for that period.
Stop sharing: revoke any link or person grant, hide yourself on others' trips, and make your profile private again.
Problem reports: turn off Send basic problem reports in Chart's settings.
Analytics: use the switch under Website analytics, or block Google Analytics in your browser; nothing breaks either way.
Learning from your outings: opt out by email (see section 5 of the terms).
Correct or ask about your data: email us.

Your rights

Wherever you live, you can ask us to show you the personal data we hold about you, correct it, give you a copy you can take elsewhere, delete it, or stop using it for a particular purpose, such as learning from your outings or analytics. Email us at the address below, ideally from the email on your account. We may ask you to confirm it is you before we act, and we answer within 30 days. We will never treat you differently for asking. If you are not satisfied with our answer, you can also complain to the data-protection authority where you live.

Children

boating.systems is for people aged 13 and over. We do not knowingly collect personal data from children under 13, and if we learn that we have, we delete it.

Organisers — a Paddle outing leader, a race committee, a skipper listing crew — may enter the names of the people taking part. Before entering the name of anyone under 18, an organiser must have permission from that person's parent or guardian. A parent or guardian can ask us to remove a child's name or other details at any time by emailing the address below.

Changes

If this policy changes materially, we will update the date at the top. For anything that changes what leaves your device, we will also say so in the apps' release notes. A new use of data you have already given us applies only going forward.

Contact

Questions, corrections, opt-outs and deletion requests: info@boating.systems.

Post: Progressable LLC, 69 E. Pearl Street, New Haven, CT, USA.

App by app

Only what differs from the sections above.

Chart

Location, including with the screen off. Chart uses location to show your boat, speed and course, and to colour the water against your draft. While you are recording an outing, it keeps recording with the screen off or the app in the background. On Android this runs as a visible "Recording your outing" notification. On iPhone, Chart asks for "Always" location permission when you start recording. When nothing is recording, Chart does not track you in the background.
Your track stays on the phone until you sign in. Signed in, finished outings upload to your private account and appear in Log.
Live position, signed in only. While location is on, Chart saves your current position, speed, course, active route and chosen boat to your account about every 30 seconds. It does this whether or not you are recording, so your other devices and Guide can show where you are. Only you can read it. If you have picked a boat, the same position is visible to people with access to that boat.
Optional tester area. From the account sheet, you can share an area of roughly 55 km around you, so we can see where testers are. Remove it from the same sheet.
Offline charts download from our own servers. They are stored on the phone and send nothing back apart from the download requests themselves. Automatic downloads near your boat are off unless you turn them on.
Photos and voice notes, in the web version: the camera and microphone are used only when you choose to. In Chrome, live captions go through Google's speech service. The Android and iPhone apps don't request camera or microphone permission.
Connections you set up: a Signal K server on your boat's network, which Chart only reads, and a paired Wear OS watch.
No analytics and no advertising or crash-reporting SDKs. Only the basic problem reports described above.

Chart's own summary, for the app stores, is at chart.boating.systems/privacy.

Log

Log is where your trips, journeys, photos, voice clips, imports, sea service and sharing live, all described above. You can pair an AI assistant to file history into your Log on your behalf. The assistant gets a pairing code that you issue. It can do only what the pairing allows, and you can revoke it at any time. The assistant's own provider handles anything you show it under that provider's policy, not this one.

Vessel

Vessel keeps one boat's records: upkeep, engine hours, documents, inventory, issues and people. Access is per person and per boat, and whoever manages the boat sets who can see or change what. A boat's public card and its stories appear only when the boat's managers publish them. A trip on a boat's page must already be shared by its owner.

Marina (clubs)

Club records belong to the club. When a club imports its roster, we hold each row on the club's behalf. That includes name, email, phone, boat, berth, membership tier and staff notes. A roster import doesn't create an account for anyone, doesn't put anything in your personal apps, and never makes us contact you.
Who sees it. Authorised club staff see the club's record. Signed in as that member, you see it too, except staff notes. Your trips, tracks and boat documents in other apps are never visible to the club unless you share them yourself.
The members-only directory. If the club turns it on and reviews your listing, other active members can see your name, boat and berth. Ask the club office to correct or remove it.
Direct contact. A club can let active members open a listed member's club phone and email, one listing at a time. This is hidden unless the club opens it. You can hide your details, and the club can block contact for everyone. If you have never signed in, the club's setting applies to your listing.
Requests you send to the club office, such as a slip request or a request to reach another member, go to club staff with your name and contact details. They are kept until the club deletes them; the club can delete a case at any time, and only a record that it existed remains. To have your details removed from a request, ask the club, or email us.
Exporting and deleting a club's data is the club's decision. A member who leaves the platform leaves the club's own record with the club.

Anchor Watch

Separate database. Anchor watches are kept apart from everything else, and only your own account can read them. They hold the anchor position, alarm radius, your latest position and a short recent trail, and your devices' push-notification tokens.
Alarms are push notifications to your own devices. There is no SMS and no email.
After you stop a watch, a summary is copied into your boat's history, where people with access to that boat can read it. The summary is the anchor point, the last 60 positions, how far the boat swung, your outcome note and the tide. Alarm checks never read this copy, and neither it nor the watch is used for the learning described in the terms.
How long. A watch, with its live positions, is deleted 30 days after you stop it. A watch that goes quiet without being stopped (a lost or dead phone) is deleted 30 days after it last reported; when you next sign in to Anchor you can end it or keep it for another 30 days. The summary in your boat's history stays until the owner deletes it.

Boat Recorder

Boat Recorder is a phone left aboard to log the boat, not a person. It records location in the background, including after a restart, and sends the boat's position about every 30 seconds. From the accelerometer it works out whether the engine is running and how far the boat heels. Its outings are visible to people with access to the boat. On the boat's own Wi-Fi, it also serves its live position, speed, course, heel and engine state to other devices on that network, without a password, so instruments and Chart can read it. Full detail is at recorder.boating.systems/privacy.

Guide, Race, Line Honors and Paddle

Guide: your stars, visits, ratings and plans are private to you. Suggested places and reports go to a moderator, who decides what is published. Signed in, Guide can show your own live position from Chart.
Race: your position is used on the phone during the race.
Line Honors: the race committee enters boats and skippers. Once a race is published, its entries and results are public (see above).
Paddle: "Use my location" is used on the device only. Recordings upload to Log only when you are signed in. A public outing shows its leader's name.