Privacy policy

In short

• We store only what the logbook needs: your account, your voyages and legs with track, harbours and weather, crew, photos and notes.
• Only your account sees your logbook. There is no live position, no public map and no feed.
• No tracking, no ads, only cookies the site needs to work.
• We store heart rate or other health values only with your explicit consent. We do not ask for it at the moment, so we store none.
• You can export your logbook as CSV and delete your account with all data at any time.

Controller

Philipp Winkler, sole proprietor
Burghof 1
24939 Flensburg
Germany
Email: [email protected]

We are not required to appoint a data protection officer (§ 38 BDSG: fewer than 20 people are regularly engaged in automated processing of personal data).

Hosting and server logs

Knotlog runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany, under a data processing agreement (Art. 28 GDPR).

In front of the server sits Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; in the EU Cloudflare Germany GmbH) as DNS service, content delivery network and protection against attacks. All requests therefore pass through Cloudflare, which processes your IP address and the technical connection data on our behalf (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR (secure and fast operation). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR.

For every request the server processes connection data: IP address, time, requested address, browser and operating system. We need it to deliver the site and to detect attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 days.

Your account

For an account we store your email address, your password, only as an encrypted hash, and if you like a display name for the mileage proof. We need this to sign you in and, for example, to send you a password reset link (Art. 6(1)(b) GDPR).

Data from your watch

When you pair a watch with your account, we store an access token for that device plus its model, platform and app version. After each leg the watch sends it to us: start, end and duration, the recorded GPS track, stops on the way and the watch's weather observations such as wind and pressure. From that we work out nautical miles, night hours and harbours; harbour names come from our own list, without an external service (Art. 6(1)(b) GDPR). There is no live position: the track arrives after the leg.

Health data: some watches send heart rate or calories. That is health data (Art. 9 GDPR). We drop it on arrival unless you have given explicit consent (Art. 9(2)(a) GDPR). Knotlog does not ask for this consent at the moment, so we store no health data. If that changes, we ask you first, and you can withdraw consent at any time.

You see and remove paired watches under "Watches".

Voyages, crew and photos

What you enter, such as voyages, legs, boat, sailing area, skipper, your role on board and notes, is stored for your logbook (Art. 6(1)(b) GDPR). Nobody but you sees it.

Crew: if you add fellow sailors, we store their name and role on board. That is data about other people; add them only if they agree. A name appears in the PDF proof only if you mark that the person agreed; otherwise it says "Crew" with a number. Legal basis is our legitimate interest in keeping a complete logbook for you (Art. 6(1)(f) GDPR).

Photos are re-encoded on upload and all metadata is removed, including the GPS position, the capture date and the camera serial number. Only the cleaned image is stored.

Harbour list: the suggestions while you type a harbour come from your own legs and from a harbour list that ships with the app. Typing sends no request to third parties. The harbour list is partly based on OpenStreetMap data, © OpenStreetMap contributors, licensed under the Open Database License (ODbL).

Export and proof

You download your logbook as CSV, and with Premium the tracks as GPX. We create the mileage proof as a PDF from your voyages when you ask for it; we only keep count of how many proofs you made, not their content. What you do with an export or a PDF, such as sending it to a charter company, is up to you.

Email (Resend)

Account emails such as password resets are sent through Resend (Resend, Inc., USA). Resend receives your email address and the content of the message and processes both on our behalf (Art. 28 GDPR). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR. Legal basis: Art. 6(1)(b) GDPR.

Premium and payments (App Store, Google Play, RevenueCat, Stripe)

You buy Premium in the browser through Stripe; in the app the purchase goes through the store (once the apps are out). In detail: in the app you buy through Apple's App Store or Google Play. Apple or Google handle the purchase under their own responsibility; we never see your payment details. We match purchases to your account through RevenueCat (RevenueCat, Inc., USA), which receives a pseudonymous account ID and the store receipts. In the browser we send you to the Stripe checkout (Stripe Payments Europe, Ltd., Ireland). Stripe processes your payment details itself, and you manage your subscription there in the customer portal. We pass Stripe your email address and an identifier of your account; we only learn what you bought and whether the payment went through. RevenueCat and Stripe work on our behalf to that extent (Art. 28 GDPR). The transfer to the USA relies on the EU-US Data Privacy Framework (adequacy decision of the EU Commission) or, where the provider is not certified for it, on standard contractual clauses under Art. 46 GDPR.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for invoices and records we must keep.

Merch shop (Printful, shipping carriers)

If you order from the merch shop, we process your order: the items ordered, your name, your delivery address, your e-mail address for the order confirmation and the payment status (Art. 6(1)(b) GDPR). Payment goes through Stripe (Stripe Payments Europe, Ltd., Ireland, see the section on payments); we never see your payment details.

The items are produced and shipped by Printful (Printful Latvia AS, Riga, Latvia, EU). To fulfil the order we pass your name, your delivery address and the items ordered on to Printful (Art. 6(1)(b) GDPR). Printful hands the parcels to shipping carriers and passes them your name and delivery address for delivery; we ourselves send nothing to carriers. We keep invoice and order data for as long as statutory retention duties require (Art. 6(1)(c) GDPR).

Cookies

Knotlog sets only cookies the site needs to work: one for your sign-in, one for "remember me" if you tick it, one against forged forms and one for your language. These need no consent (§ 25(2) no. 2 TDDDG), which is why there is no cookie banner. We use no analytics, advertising or tracking services. Fonts are served by us, not by Google Fonts or another CDN.

Retention, export and deletion

We keep your data as long as you have an account. You can export your logbook as CSV at any time (Art. 20 GDPR). Under Account you delete your account; all voyages with legs, tracks, crew and photos and your paired watches are deleted at once. You delete a single voyage on its page. Backups drop the data after 30 days. Records we must keep for tax reasons are kept until the statutory period ends.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time for the future. This also applies to crew members named in a logbook. Write to [email protected].

Right to complain

You can complain to a data protection authority, for example in your country or the one responsible for us: the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

Changes

When what Knotlog processes changes, for example once purchases open, we update this page and the date below.