Privacy Policy.
1. Introduction
This Privacy Policy explains how Nautis ("we", "us", "our"), operated by EightTen Labs (Sole Trader), collects, uses, stores, and protects your personal data when you use the Nautis mobile application ("the App").
Nautis is a digital maritime logbook application available on iOS and Android. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller: EightTen Labs, United Kingdom
Contact: [email protected]
Last Updated: 16 October 2026
2. Data We Collect
2.1 Account Information
When you create an account, we collect:
- Email address: required for account creation and communication
- Full name: displayed on your profile
- Username: optional, used for social search and discovery
- Profile photo: optional, uploaded by you
- Authentication provider data: if you sign in via Google or Apple, we receive your name and email from those providers. We do not receive or store your Google or Apple password.
2.2 Location Data
Location data is central to how Nautis works. We collect precise GPS data to track your sailing trips and plot your route on a map.
When you start a trip with GPS tracking enabled, we collect:
- Latitude and longitude: precise position (typically accurate to ~5 metres)
- Altitude: elevation above sea level (when available)
- GPS accuracy: the precision of the position reading
- Speed and heading: speed over ground and direction of travel
- Timestamps: when each GPS reading was taken
GPS data is collected continuously while a trip is active, including when the app is running in the background. You can disable GPS tracking for any trip. Location data is only collected during active trips. We do not track your location at other times.
2.3 Log Entry Data
When you create log entries (manually or via Auto Logging), we collect the data you provide:
- Navigation data: course steered, speed, course over ground, speed over ground, log reading, distance covered
- Weather and conditions: barometric pressure, sea state, wind speed and direction, visibility, weather conditions
- Engine and propulsion: engine status, RPM, battery voltage
- Sail plan: which sails are set
- Notes: free-text notes you add to entries
- Position: latitude and longitude at the time of the entry
2.4 Photos
You may attach photos to log entries. When you do, we store:
- The photo file itself (uploaded to our cloud storage)
- File metadata: file name, file size, MIME type
We access your device camera or photo library only when you explicitly choose to take or select a photo. We do not access your camera or photos without your action.
2.5 Vessel Information
You may register vessels in the app. This data includes:
- Vessel name, type, and flag state
- Dimensions: length, beam, draft, gross tonnage
- Registration number and MMSI number
- Engine details and sail inventory
- Vessel photos
2.6 Trip Data
For each trip, we store:
- Trip name and description
- Departure and destination locations (name and coordinates)
- Planned and actual start/end dates
- Trip status, distance, and duration
- Timezone settings
2.7 Device and Technical Data
- Device tokens: for sending push notifications via Firebase Cloud Messaging (FCM)
- Crash reports: via Firebase Crashlytics. Includes device model, OS version, app version, and crash stack traces. Crashlytics is disabled in debug/development builds.
- Breadcrumb logs: anonymised usage events (e.g. "user opened map", "sync started") to help diagnose issues. These do not contain personal data.
2.8 Social, Visibility, and Friend Data
Every trip has a setting for who can see it: Everyone (any Nautis user), Friends (people you have accepted as friends) or Only me. The setting covers the trip's data described in sections 2.2 (Location Data), 2.3 (Log Entry Data), 2.4 (Photos) and 2.6 (Trip Data). New trips use your default, which starts as Friends, and trips recorded before the setting existed are set to Everyone. Your username, name and profile photo are visible to other Nautis users whatever the setting. On Watch links work whatever the setting (§2.9). Terms of Service §9 explains where each setting shows your trips.
You can delete any log entry, trip or photo at any time, and you can delete your account at any time (see §6 and §7).
We also collect:
- Friends: the user IDs of people you send or accept friend requests with, and the status of each request. We use them to show your trips to the people you choose and to fill your feed.
- Trip settings: each trip's setting and your default.
2.9 On Watch Share Links
Nautis includes a feature called On Watch, which generates a public, token-based web link for an active trip. Anyone with the link can view the trip as it unfolds, including position, course, speed, and any log entries you make during the trip. The link is not bound to a specific recipient. Anyone you share it with, and anyone they forward it to, can open it.
On Watch links remain accessible during the trip and indefinitely afterwards. On Watch link revocation is on the product roadmap; in the meantime, contact [email protected] to disable a link.
2.10 Reports and Moderation
If you report content, we store your account ID, what you reported, the reason and any note you add. We also store the result of the automatic check on your photos and text, which version of our Terms you accepted and when, and a record of any moderation decision.
2.11 Launch Email List
If you leave your email address on sailnautis.com to hear when Nautis is out, we keep the address, when you left it and which page you left it on. We use it to send you one email when Nautis is released, and for nothing else. The list is kept in a private file on the server that hosts this website, in London, and is not shared with anyone. To come off the list, email [email protected].
3. How We Use Your Data
| Purpose | Data Used | Legal Basis (UK GDPR) |
|---|---|---|
| Providing the core logbook service | Account info, location, log entries, trips, vessels, photos | Contract performance (Art. 6(1)(b)) |
| GPS tracking during trips | Precise location data | Consent (Art. 6(1)(a)). You enable tracking per trip |
| Showing your trips to other users, as each trip's setting allows | Log entries, trip data, location data, photos, trip settings | Contract performance (Art. 6(1)(b)). Sharing trips is a core feature of Nautis, explained at signup (Terms §3.4) |
| Friend connections | Friend list (user IDs) | Consent (Art. 6(1)(a)). You choose to add friends |
| On Watch share links | Active trip data, location data, log entries | Contract performance (Art. 6(1)(b)). You activate the share by generating a link |
| Push notifications | Device tokens | Consent (Art. 6(1)(a)). You grant notification permission |
| Crash reporting and diagnostics | Device info, crash data, breadcrumbs | Legitimate interest (Art. 6(1)(f)). Improving app stability |
| Account security and authentication | Email, auth provider data | Contract performance (Art. 6(1)(b)) |
| Keeping Nautis safe: checking content before other users see it, handling reports and complaints, and meeting our duties under the Online Safety Act 2023, including reporting child sexual exploitation and abuse content to the National Crime Agency | Photos, display name, username, trip and vessel names, log notes, and the reports you make | Legal obligation (Art. 6(1)(c)) for our Online Safety Act duties; legitimate interest (Art. 6(1)(f)) in keeping Nautis free of abusive and illegal content |
| Telling you when Nautis is out, if you asked us to | Email address, when and where on the website you left it | Consent (Art. 6(1)(a)). You leave your email for this one email |
| Responding to support requests | Email, account data | Contract performance (Art. 6(1)(b)) |
4. Third-Party Services
We use the following third-party services to operate Nautis:
| Service | Provider | Data Shared | Purpose | Privacy Policy |
|---|---|---|---|---|
| Supabase | Supabase Inc. | All synced user data (account, trips, logs, photos, vessels, friends) | Cloud database, authentication, file storage | supabase.com/privacy |
| Firebase Crashlytics | Google LLC | Crash reports, device info, breadcrumb logs | Crash reporting and diagnostics | firebase.google.com/support/privacy |
| Firebase Cloud Messaging | Google LLC | Device tokens | Push notifications | firebase.google.com/support/privacy |
| Mapbox | Mapbox Inc. | Map tile requests (contain approximate location) | Map rendering | mapbox.com/legal/privacy |
| Google Sign-In | Google LLC | Authentication tokens | Optional sign-in method | policies.google.com/privacy |
| Apple Sign-In | Apple Inc. | Authentication tokens | Optional sign-in method | apple.com/legal/privacy |
| Google Fonts | Google LLC | Font download requests (IP address) | Typography | policies.google.com/privacy |
| PostHog | PostHog, Inc. | Website visits only: pages viewed, the page you came from, time on page and scroll depth, links and buttons clicked, browser and device type. No cookies, no IP address kept | Counting visits to sailnautis.com to improve the website | posthog.com/privacy |
| OpenAI Moderation | OpenAI, L.L.C. | Photos you upload, and text other users can see (display name, username, trip and vessel names, log notes) | Automatic check for objectionable content before it is shown to other users | openai.com/policies/privacy-policy |
OpenAI does not use the content we send for this check to train its models, and does not keep it for abuse monitoring.
We do not sell your data. We do not use advertising SDKs. We do not share your data with any parties other than those listed above, except where required by law.
5. Data Storage and Security
5.1 Where Your Data is Stored
- On your device: All data is stored locally in a SQLite database. The app is designed offline-first. Your data exists on your device even without an internet connection. The database is not encrypted at rest by Nautis; it is protected by your device's standard application sandboxing and any device-level encryption you have enabled (such as iOS file protection or Android full-disk encryption).
- In the cloud: When you are online, data syncs to Supabase (hosted on AWS). Photos are stored in Supabase Storage.
- On Watch share links: Active trip data accessed via On Watch links is served in real-time from the same Supabase backend. No additional copies are created. The link grants public read access to your existing trip data.
5.2 Security Measures
- All data transmitted between your device and our servers uses TLS encryption (HTTPS)
- Authentication is handled by Supabase Auth with industry-standard security
- Row Level Security (RLS) policies enforce server-side write restrictions. You cannot create, modify, or delete other users' content. Reads of publicly-visible content (logs, trips, GPS tracks) are permitted in line with the visibility model described in §2.8.
- Passwords are hashed and never stored in plain text
- Third-party sign-in (Google, Apple) uses OAuth 2.0 / OpenID Connect standards
5.3 Data Sync
Nautis uses an offline-first architecture with a sync queue. Data created or modified while offline is queued locally and synced to our servers when connectivity is restored. This means your data may exist in an unsynced state on your device until a network connection is available.
6. Your Rights (UK GDPR)
Under the UK GDPR, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of your personal data | Email [email protected] |
| Rectification | Correct inaccurate data | Edit in-app or email us |
| Erasure | Request deletion of your data | Delete your account in-app, or email us |
| Portability | Receive your data in a structured format | Email [email protected] |
| Restriction | Limit how we process your data | Email [email protected] |
| Objection | Object to processing based on legitimate interest | Email [email protected] |
| Withdraw consent | Withdraw consent for location tracking, notifications, etc. | Disable in device settings or in-app |
We will respond to all requests within 30 days. To exercise any of these rights, contact us at [email protected].
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.
7. Data Retention
- Account data: Retained for as long as your account is active. Deleted upon account deletion.
- Trip and log data: Retained for as long as your account is active. This is your logbook. We keep it until you tell us not to.
- Photos: Retained until you delete them or delete your account.
- Crash reports: Retained for 90 days by Firebase Crashlytics.
- Device tokens: Deleted when you log out or delete your account.
- Reports and moderation records: Kept for 12 months after the report is closed, then deleted, unless the law requires us to keep them longer.
- Terms acceptance: Kept while your account is active.
- Launch email list: Deleted once the launch email has been sent, or sooner if you ask.
When you delete your account, we delete all associated personal data from our servers within 30 days. Local data on your device is removed when you uninstall the app.
8. Children
You must be 13 or older to use Nautis (Terms §3.1). Some sailing students under 18 use Nautis, so the same protections apply to every user:
- Photos are checked before anyone else sees them, and text is checked as soon as it reaches us (Terms §5.5). You can report anything and block anyone.
- We don't show ads, sell your data or use it to build a profile of you.
- An On Watch link shows your trip to anyone who has the link, including people it's forwarded to. Only send it to people you trust.
We don't check ages when you sign up. If you're a parent or guardian and think a child under 13 has an account, email [email protected] and we'll delete the account and its data.
9. International Data Transfers
Your data may be transferred to and processed in countries outside the United Kingdom, including the United States (where Supabase, Firebase, Mapbox, Google, and OpenAI are based). PostHog keeps website analytics in the European Union. These transfers are protected by:
- Standard Contractual Clauses (SCCs) adopted by the ICO
- Adequacy decisions where applicable
- The data protection frameworks of our service providers
10. Cookies and Tracking
The Nautis mobile app does not currently use cookies. Firebase Crashlytics collects diagnostic data only and is disabled in development builds.
The sailnautis.com website counts visits with PostHog. It sets no cookies and stores nothing on your device. For each visit it records the pages viewed, the page you came from, how long you stay and how far you scroll, the links and buttons you click, and your browser and device type. To tell one visitor from another within a day, PostHog's servers combine your IP address and browser details with a code that changes every day and keep only the result. Your IP address is not stored. The data is held in the European Union. We use it only to see how people use the website and to improve it, and we never combine it with your Nautis account or any other data.
You can turn website analytics off on this browser: . Your browser then remembers that choice. If your browser sends a Global Privacy Control or Do Not Track signal, the website does not load analytics at all.
We may incorporate analytics tools (such as Google Analytics or Google Analytics for Firebase) in the future to understand usage patterns and improve the App. If we do, we will update this Privacy Policy to reflect:
- What data the analytics tool collects
- How that data is used
- How you can opt out
We do not, and do not plan to, use advertising trackers or behavioural tracking tools intended for targeted advertising.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or by email. The "Last Updated" date at the top of this policy indicates when it was last revised.
12. Contact Us
If you have questions about this Privacy Policy or how we handle your data:
Email: [email protected]
Support: [email protected]
Website: sailnautis.com