Sirena Seafarer · Effective 29 September 2026 (version 4.0) · Last updated 29 October 2026 (version 4.0.7)
This policy explains, in plain language and in detail, what data the Sirena Seafarer iOS app ("Sirena", "the app") and the website sirenaclub.io collect, why, where it is stored, for how long, and what rights you have. We built Sirena around a simple rule: your position belongs to you. Other users see your boat only if you turn sharing on, and we never sell your position or keep a history of it. Some features do need to send your position, or the area you are in, to our server to work, and one of them (AIS ship traffic) is on from the first launch. Each one is listed in section 2 and explained in sections 6, 8a and 9d, with how to turn it off.
Sirena is operated by Anton Dimitrov, sole developer, Varna, Bulgaria. Contact for anything in this policy: [email protected].
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address | To create your account and sign you in with a one-time code. | Contract | Until you delete the account |
| Founding members (waiting list) email, if you join, in the app (Profile, Founding members) or with "Notify me" on this site, plus where you joined, the country of the request and the dates | To email you when new charts and features are ready, so founding members get them first. Joining is not consent to marketing: news and offers need the separate switch in section 4c. The address is stored encrypted. | Consent | Until you ask us to remove it, or until you delete a Sirena account that uses the same address |
| Mobile number, hashed, plus the last four digits | So a captain can find you by phone number, the way a messaging app does. We never store the full number in the clear, and we do not read your address book. | Contract | Until you delete it from your profile or delete the account |
| Google sign-in identifier (not offered in the current version) | To create or open your account without an email code, if that button returns. | Contract | Until you delete the account |
| Profile you type in: name, boat name, home port, call sign, MMSI | So the captains in your fleet can recognise you. All of it is optional except a display name. | Contract | Until you change or delete it |
| Live position, speed and course | To draw your boat on other sailors' charts. Sent only while you have sharing switched on. | Consent (the sharing switch) | 1 hour, then it expires automatically |
| Position sent with AIS and weather requests (and the visible chart area for weather) | To answer that request with the ships or the forecast around you. See section 6. | Contract (the feature you use) | Not stored. The answer for an area may be cached briefly, with nothing about who asked |
| A mobile number you type to invite a captain | To find the account that saved that number: our server compares a hash of it with the hashes we hold and sends the invite if one matches. | Contract | Not stored. Only a count of your phone invites that day is kept, for 2 days, to stop abuse |
| AIS messages from your boat's receiver, only if you pair it with Sirena Network | To build a shared picture of ship traffic. See section 9d. | Consent (entering the pairing code) | In a locked archive: cannot be deleted on request or when you delete your account |
| Fleet membership and invitations | To connect captains who accepted each other. | Contract | Until either side leaves the fleet |
| Subscription status and the Apple transaction identifier | To confirm with Apple that Sirena Premium is active, and to stop one purchase unlocking many accounts. | Contract | Until you delete the account |
| Session token | To keep you signed in without a password. | Contract | 30 days of use, then it expires |
| One-time sign-in code | To verify that the email address is yours. | Contract | 5 minutes, or until used |
| Diagnostics (crash, freeze, battery and performance reports), only if you turn it on | To fix crashes and battery drain. See section 4b. | Consent | 90 days |
| Product analytics (anonymous feature-usage events with a random ID), only if you turn it on | To improve the features sailors use. See section 4b. | Consent | 3 months per event; totals without the ID up to 14 months |
| Marketing email choice, only if you turn it on | To send news, new charts and offers you asked for. See section 4c. | Consent | While consent stands; proof of an unsubscribe is kept without the address |
| Waiting-list request for news by email, before you confirm it | To check that the address is yours before any news is sent: we e-mail one confirmation link, and nothing is recorded as consent until it is used. | Legitimate interest (not sending news to an address whose owner did not ask) | 7 days, or until the link is used, then deleted automatically |
| IP address, in a short-lived counter | To stop one machine hammering our sign-in, invite, map, diagnostics and analytics endpoints, and to stop someone sending sign-in codes to an address that is not theirs. The counter holds a number, not a history, and it is never used to build a profile of you or to work out where you are. | Legitimate interest (keeping the service up and preventing abuse) | Up to 2 minutes for the per-minute counters, 1 hour for the per-email one, then deleted automatically |
The sharing switch has three settings, and each one changes what leaves your device:
A shared position expires by itself after one hour. Turning sharing off stops any further publishing immediately; the last point fades within the hour.
This site sets no cookies and shows no consent banner, because it has nothing
to ask consent for. Two items are kept in your browser's local storage, both strictly necessary
for something you asked for: sirena_invite_ref, which holds a fleet invite code when
you arrive on an invite link so the code survives to the moment you use it, and
sirena_waitlist, which remembers that you already left your email so the form does
not ask twice. Neither is sent anywhere, neither identifies you, and clearing your browser data
removes both.
Visits are counted with Cloudflare Web Analytics, which is cookieless and sets no identifier of any kind. It records the page, the referring site, the country and the browser family, and it does not build a profile or follow you to other sites. We use it only to see whether anyone is reading this.
The email address you give the "Notify me" form joins the same founding-members list as the one in the app: we use it to tell you when new charts and features land, store it encrypted, and keep it until you ask us to remove it (section 3). It is never sold, shared or added to any other list. The tick box under the form is the separate request for news and offers described in section 4c: nothing of that kind is sent until you use the confirmation link we email you.
Sirena works fully without either of these. On first launch the app asks you, with Accept all and Reject all buttons of equal size and a Choose option for each one separately. Both are off until you turn them on, and you can change your mind at any time in the app under Profile, Privacy choices. Nothing from either of them is collected before you answer.
| Diagnostics | Product analytics | |
|---|---|---|
| What | Apple MetricKit reports that iOS prepares about Sirena: a crash or freeze report the next time the app opens, and battery and CPU use, launch time, memory and disk writes at most once a day. Crash reports contain technical call stacks. Each report also carries the app version, iOS version, device class and the region format. When a crash or freeze report arrives, a short technical summary of it (version, device class, error type, code locations) may be e-mailed to our own support inbox through Resend (section 7), at most one summary an hour, so we can fix it quickly. The summary contains nothing from the list below. | Counts of which features are used, for example opening the weather, choosing a chart layer, arming the anchor watch, starting a track, opening the paywall or a purchase succeeding or failing. Each event carries the app version and build, iOS version, "iPhone" or "iPad", the region setting of your phone (for example US), your plan (free, trial or Premium), a random ID created only for this purpose and, stored with each event, the country (for example DE) that our hosting provider, Cloudflare, derives from the IP address of the connection. The IP address itself is not stored. |
| Never included | Your position or any coordinates, your account, email, name, boat name, MMSI, phone number, IP address, advertising ID (IDFA) or vendor ID (IDFV). Your IP address is not stored with either; free-text fields in crash reports are removed before they are sent. | |
| Why | To find and fix crashes and battery drain, which matter more at sea than anywhere. | To learn which features help sailors and which need work, so we improve the right things. |
| Legal basis | Your consent (GDPR and UK GDPR Art. 6(1)(a); ePrivacy Art. 5(3)). You can withdraw it at any time; withdrawal does not affect what was lawful before it. | |
| Where | Our own storage on Cloudflare R2. | Our own Cloudflare Workers Analytics Engine. |
| Kept for | 90 days, then deleted automatically. The e-mailed summaries are deleted from our support inbox on the same 90-day schedule; Resend keeps its delivery log of them for no longer than its own retention period, and never for its own purposes. | Individual events: deleted automatically after 3 months. We may keep totals that cannot be linked to any installation (for example "weather opened 1,200 times in May") for up to 14 months. |
| Withdraw | Turn the switch off in Profile, Privacy choices. Collection stops at once, and the events still waiting on your phone and the random ID are deleted immediately. Data already sent cannot be linked back to you afterwards and expires on the schedule above. | |
No sale, no sharing, no tracking. This data is not sold, not shared with anyone, not used for advertising, and not combined with data from other companies. We do not track you across other companies' apps or websites, which is why Sirena never shows Apple's "Allow tracking" prompt and never reads the advertising identifier.
We send news, new-chart announcements and offers only if you ask for them, with a separate switch that is always off to begin with: "Email me news, new charts and offers from Sirena Seafarer". It appears where you enter an email address (sign-in and the waiting list) and in Profile, Privacy choices. Signing in, creating an account or joining the waiting list never switches it on, and none of them needs it.
Some map layers are drawn by us and some come from other services. Where another company receives anything, it is named here.
| Layer or feature | Who receives what |
|---|---|
| Sirena chart, Light Chart, Play chart, OSM Day and Night, TSS charts, NOAA US charts, Satellite Sirena, seamarks | Nobody but us. These are our own map files on our own Cloudflare storage. Your device asks us for map tiles and no third party is involved. |
| Satellite Mapbox (part of Sirena Premium) | Mapbox. This is the one chart your device fetches directly from another company. Mapbox receives your IP address and the coordinates of the map tiles you are looking at, like any website you visit. It is drawn by the Mapbox Maps SDK. We switch the SDK's telemetry setting off, so it does not send location events, but while the layer is open Mapbox may still receive from the SDK: a billing event that Mapbox uses to count the monthly users of this app, and a map-load event that contains the identifier for vendor (IDFV) that iOS gives this app on your device, the device model, the iOS version, the screen scale, your text size setting, the screen orientation and whether you are on Wi-Fi. It contains no position, name or account. The SDK starts only while that layer is open, so the app does not contact Mapbox at all unless you select it. Mapbox handles these events under its own privacy policy at mapbox.com/legal/privacy. |
| Wind and sea forecast | MET Norway (the Norwegian Meteorological Institute), through our own server. While the Weather layer is on, your device sends your position, or the centre and edges of the chart area on screen, to our server. The captain game's weather check (section 2) sends your exact position, even with the Weather layer off. Our server uses what it receives only to answer and does not store it. Before we ask MET we round a position to a grid of roughly 11 km, and a chart area to a grid of roughly 28 km, so what reaches them is an area of sea, not a boat. Your IP address is not passed on. To stop the layer's requests, tap Weather in Layers so it is off. Wave data from this source covers Northern and Western Europe; elsewhere the wind forecast still arrives and wave fields stay empty. |
| AIS ship traffic | aisstream.io and AISHub, through our own server. This layer is on by default. From the first launch your device sends its position, rounded to about 1 km, with the radius it wants traffic for, to our server every 60 seconds while the chart is on screen, and again whenever you have moved more than 5 km, which can also happen while the app is in the background if iOS is still giving it your position; before there is a GPS fix it sends the centre of the chart. Our server uses the position only to answer and does not store it, and asks the sources for regions on a grid of roughly 5.5 km. We hold one connection to aisstream for all users and poll AISHub from the same server, both for regions, never for you. They receive nothing that identifies a user. If you are signed in, the request carries your session token so our server can check it; we do not store the position with it or link the two. Without an account, the app first asks our server for an anonymous guest key: a random number with an expiry date (3 days), signed so that it works only from the network block it was issued to (for example the first half of an IPv4 address). The network block is not written into the key, the key contains nothing else about you, the app uses it only for the ship traffic, and we keep no record of it. To stop all of this, tap AIS Traffic in Layers so it is off. |
| More from Sirena (Profile) | Apple. At most once a day the app asks Apple's public App Store lookup (itunes.apple.com) whether our other apps are listed in your App Store country, so it only shows the ones you can download. Apple receives your IP address, the App Store identifiers of our apps and your App Store country code. Nothing about you or your account is sent. |
| Service notices, connection check, game challenges | Nobody but us. The app fetches short service notices and the current game challenges from our server, and checks the quality of the connection against it. These requests carry no position and no account. |
Our servers run on Cloudflare (Workers, Durable Objects, KV, R2; EU/US network) under Cloudflare's data processing terms, which include the EU Standard Contractual Clauses for transfers outside the EEA.
Other processors, engaged only for the function named:
Cloudflare, Inc. may process data in the United States under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
We do not use any other processor. In particular there is no third-party analytics provider, no advertising network and no crash-reporting service that receives your data: the optional diagnostics and product analytics described in section 4b are stored on our own Cloudflare account. The only part that leaves it is the short crash summary e-mailed to our own support inbox through Resend, as described in section 4b.
Payment is handled entirely by Apple. We never see your card, your billing address or your Apple Account. What we receive from Apple is whether the entitlement is active and an identifier for the transaction, which we store so that one purchase cannot unlock an unlimited number of accounts.
Family Sharing applies to the annual subscription. If you share it, Apple tells us that each family member's own account is entitled to Premium. Each person still has their own separate Sirena account, their own position settings and their own fleet: sharing a subscription does not share any data between family members. The monthly plan and the founding seat cover a single account and are not shared.
The fleet and position sharing are available on every plan. Sharing is off until you choose Fleet only or Everyone, whether or not you have Premium.
You can draw a race course on the chart and share it as a link; a course sent as a link is contained in the link itself. When you publish a race to your fleet, we store its name, start time, course and the name and boat of each captain who joins. Only captains in your fleet can see it. It is deleted automatically 7 days after the start. Timing and scoring stay on your device; we do not store race results.
When the app is open and has a position, it downloads the chart files for the waters around you (about 40 km) from our Cloudflare storage automatically, and again when you have moved about 30 km. There is no switch for it; it stops once you own the whole-world chart. The request carries no account and no position, but the names of the files asked for reveal the area, roughly 110 km across, and our storage provider sees your IP address, like any download. We keep no log of these requests beyond Cloudflare's standard short-lived traffic logs. The whole-world offline chart, if you buy it, comes from Apple's servers (Background Assets), not ours.
The watch app shows what the iPhone app already has (speed, course, heading, position, the anchor watch and the regatta start time). The two talk to each other directly through Apple's WatchConnectivity; nothing is sent to us.
While sharing is Fleet only or Everyone, the app sends us your season totals: days on the water, nights at anchor and, if you choose, your captain level. No positions, distances or speeds. Only captains in your fleet see them. Turning sharing Off deletes them from our server. Whatever your sharing setting, while you have a streak the game also checks the weather at your position as described in section 2, and uses only the wind speed from the answer. Legal basis: contract. Game Center is optional: if you tap Connect Game Center, your achievements are sent to Apple under Apple's own privacy policy, and we do not receive your Game Center identity.
If you join through an invite, we record who invited you and when. The person who invited you sees how many friends joined and how many started a paid plan, but not who they are. For each paid friend they earn one free month, delivered by Apple as a promotional offer. We keep a record of which purchases already earned a month, so none is counted twice. Legal basis: contract.
If you turn on "Share sea days with Sirena Logbook" in Profile (it is off until you do), Sirena Seafarer writes one small daily summary to a folder on your iPhone that only our apps can read: hours under way, at anchor and moored, the distance, the time spent ashore (which earns no sea time), and the day's first and last position rounded to about 1 km. Sirena Logbook reads it on the same iPhone to suggest the day split of a contract. It never leaves the phone and we never receive it. Turn the switch off and no new days are written.
Where the apps are offered. The Sirena apps are built for the whole world, and which of them, and which features, are offered in your country is decided per App Store country (see the terms, "Worldwide by design"). Where an app is not offered, it receives nothing from you: the apps share data with each other only when you link them, as this policy describes.
Sirena.Club is our separate members' app, run by the same operator. A Sirena Premium purchase you made yourself (annual, monthly or the founding seat) also opens a seat in the club where Sirena.Club is available (it is not offered in the European Union), and a club membership you bought yourself includes Sirena Premium. The two apps connect in two ways:
A purchase shared with you through Family Sharing does not open the club and does not come back as Premium. Legal basis: contract. What the club keeps is described in the Sirena.Club Privacy Policy.
In Profile, Chart, AIS receivers, you can connect Sirena Seafarer to an AIS receiver on your boat's Wi-Fi. To find one, the app looks on your local network (Bonjour and a few common AIS ports); iPhone asks your permission for this first. What the receiver hears is shown on your chart and stays on your iPhone.
Nothing is shared until you enter a pairing code, and sharing starts at that moment. Entering a code from Sirena Network pairs this iPhone and switches Share with Sirena Network on immediately, without a further step. From then on, while Sirena Seafarer is open, it sends the AIS messages your receiver hears from other vessels (the public VDM sentences ships broadcast), each with the time your iPhone received it, to our server at ingest.sirena.network about every 10 seconds, signed with a key kept in your iPhone's Keychain and labelled with the random identifier of your station. Your own boat's messages (VDO) are never sent, and nothing else from the app goes with them: no account, position fix, track, fleet or phone number.
Legal basis: consent, given by entering the pairing code. The messages themselves are public radio broadcasts from other vessels. Because the archive cannot be erased, please pair only if you accept that what your station sent stays in it.
You can exercise the first two without contacting us at all, from Settings inside the app:
For a complete copy of everything we hold about you, or for anything you cannot do in the app, write to [email protected] and we will reply within one month. We make no decisions about you by automated means that have legal or similar effects. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority in your own country.
This section applies to residents of California (CCPA as amended by the CPRA) and of the other US states with comparable laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Florida, where applicable).
Sirena is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.
If this policy changes materially, the effective date above changes and the app links here permanently, so the current version is always one tap away. Previous versions are available on request.