Privacy Policy

Sirena Seafarer · Effective 3 September 2026 · Replaces the version of 13 August 2026

This policy explains, in plain language and in detail, what data the Sirena Seafarer iOS app ("Sirena", "the app") and the website sirenaclub.io collect, why, where it is stored, for how long, and what rights you have. We built Sirena around a simple rule: your position belongs to you. Nothing about your location leaves your device unless you explicitly turn sharing on.

1. Who is responsible (data controller)

Sirena is operated by Anton Dimitrov, sole developer, Varna, Bulgaria. Contact for anything in this policy: [email protected].

2. The short version

No advertising, no ad trackers, no analytics SDKs, no data brokers. We do not sell or rent personal data. Ever.
Position sharing is off by default. While it is off, your position is not sent to our servers at all.
With sharing set to Everyone, other sailors see your boat anonymously: position, speed and course only. No name, no boat name, no identifier that would let a stranger follow you.
Your name is visible only to people you accepted into your fleet.
Your track history never leaves your device. There is no server copy and no backup of it.
You can export or permanently delete everything, in the app, without asking us.

3. What we collect, why, and for how long

Data	Why	Legal basis	Kept for
Email address	To create your account and sign you in with a one-time code.	Contract	Until you delete the account
Waitlist email, if you asked to be told	To email you once when the app is on the App Store.	Consent	Until you ask us to remove it
Mobile number, hashed, plus the last four digits	So a captain can find you by phone number, the way a messaging app does. We never store the full number in the clear, and we do not read your address book.	Contract	Until you delete it from your profile or delete the account
Google sign-in identifier (not offered in the current version)	To create or open your account without an email code, if that button returns.	Contract	Until you delete the account
Profile you type in: name, boat name, home port, call sign, MMSI	So the captains in your fleet can recognise you. All of it is optional except a display name.	Contract	Until you change or delete it
Live position, speed and course	To draw your boat on other sailors' charts. Sent only while you have sharing switched on.	Consent (the sharing switch)	1 hour, then it expires automatically
Fleet membership and invitations	To connect captains who accepted each other.	Contract	Until either side leaves the fleet
Subscription status and the Apple transaction identifier	To confirm with Apple that Sirena Premium is active, and to stop one purchase unlocking many accounts.	Contract	Until you delete the account
Session token	To keep you signed in without a password.	Contract	30 days of use, then it expires
One-time sign-in code	To verify that the email address is yours.	Contract	5 minutes, or until used
IP address, in a short-lived counter	To stop one machine hammering our sign-in, invite and map endpoints, and to stop someone sending sign-in codes to an address that is not theirs. The counter holds a number, not a history, and it is never used to build a profile of you or to work out where you are.	Legitimate interest (keeping the service up and preventing abuse)	Up to 2 minutes for the per-minute counters, 1 hour for the per-email one, then deleted automatically

4. How position sharing works, precisely

The sharing switch has three settings, and each one changes what leaves your device:

Off. Nothing about your position is sent. Not reduced, not anonymised: not sent. In this mode you also do not see other boats, because the feature is reciprocal.
Fleet only. Your position and name go only to captains you have mutually accepted.
Everyone. Your position, speed and course are visible to other Sirena users, stripped of your identity before they leave our server: no name, no boat name, and no stable identifier, so a stranger cannot follow one boat from one moment to the next. Captains in your own fleet still see your name, because they are your fleet.

A shared position expires by itself after one hour. Turning sharing off stops any further publishing immediately; the last point fades within the hour.

4a. The website: storage and analytics

This site sets no cookies and shows no consent banner, because it has nothing to ask consent for. Two items are kept in your browser's local storage, both strictly necessary for something you asked for: sirena_invite_ref, which holds a fleet invite code when you arrive on an invite link so the code survives to the moment you use it, and sirena_waitlist, which remembers that you already left your email so the form does not ask twice. Neither is sent anywhere, neither identifies you, and clearing your browser data removes both.

Visits are counted with Cloudflare Web Analytics, which is cookieless and sets no identifier of any kind. It records the page, the referring site, the country and the browser family, and it does not build a profile or follow you to other sites. We use it only to see whether anyone is reading this.

The email address you give the launch form is used once, to tell you the app is on the App Store, and then deleted. It is never sold, shared or added to any other list.

5. What we deliberately do NOT collect

Your track history. It is recorded on your device and stays there. We have no copy. Exporting it to GPX is something your phone does locally.
Your saved routes and waypoints. Also device-only.
Advertising identifiers, contacts, photos, calendar, health data, browsing behaviour.
Any analytics SDK. We do not measure what you tap.

6. Charts, weather and ship traffic: what reaches whom

Some map layers are drawn by us and some come from other services. Where another company receives anything, it is named here.

Layer or feature	Who receives what
Sirena chart, Light Chart, Play chart, OSM Day and Night, TSS charts, NOAA US charts, Satellite Sirena, seamarks	Nobody but us. These are our own map files on our own Cloudflare storage. Your device asks us for map tiles and no third party is involved.
Satellite Mapbox (part of Sirena Premium)	Mapbox. This is the one chart your device fetches directly from another company. Mapbox receives your IP address and the coordinates of the map tiles you are looking at, like any website you visit. It is used only while that layer is open, which is why the app does not contact Mapbox at all unless you select it.
Wind and sea forecast	Open-Meteo, through our own server. Your device asks us, not them. Before we ask Open-Meteo we round the position to a grid of roughly 11 km, so what reaches them is an area of sea, not a boat. Your IP address is not passed on.
AIS ship traffic	aisstream.io, through our own server. Your device asks us for the traffic around a point rounded to a grid of roughly 5.5 km. We hold one connection to aisstream for all users and ask them for regions, never for you. They receive nothing that identifies a user.

7. Where data is stored and who processes it

Our servers run on Cloudflare (Workers, Durable Objects, KV, R2; EU/US network) under Cloudflare's data processing terms, which include the EU Standard Contractual Clauses for transfers outside the EEA.

Other processors, engaged only for the function named:

Apple: App Store distribution, in-app purchases, and Sign in with Apple. When you sign in with Apple, Apple may give you a private relay email address; we never see your real one.
Resend (Resend, Inc., EU region): delivers the six-character sign-in code to your inbox. We pass your email address and the code, nothing else. Resend does not use it for anything but that delivery, and we never use it for marketing.
Google: Sign in with Google. This button is not offered in the current version of the app. It is listed here so the record stays complete: if it returns, Google would see that you are signing in, and we would receive an identifier and, if you share it, an email. We would never read the rest of your Google account.
Mapbox: satellite imagery, as described above, and only while that layer is open.
Open-Meteo: weather forecast, as described above, area-level only.
aisstream.io: AIS ship traffic, as described above, region-level only.

We do not use any other processor. In particular there is no analytics provider, no advertising network and no crash-reporting service that receives your data.

8. Sirena Premium and Family Sharing

Payment is handled entirely by Apple. We never see your card, your billing address or your Apple Account. What we receive from Apple is whether the entitlement is active and an identifier for the transaction, which we store so that one purchase cannot unlock an unlimited number of accounts.

Family Sharing applies to the annual subscription. If you share it, Apple tells us that each family member's own account is entitled to Premium. Each person still has their own separate Sirena account, their own position settings and their own fleet: sharing a subscription does not share any data between family members. The monthly plan and the founding seat cover a single account and are not shared.

A change worth stating plainly: the fleet is now a paid feature, and the app no longer transmits your position at all without an active entitlement. Previously a signed-in user with sharing switched on would broadcast whether or not they paid. Now, without Premium, nothing about your position leaves the device for the fleet under any setting. Sharing remains off by default and opt-in for everyone else.

9. Race courses

You can draw a race course on the chart and share it as a link. The course itself, the marks and the start time are contained in that link, which you choose who to send to.

We do not currently store race results. Timing and scoring run on your own device. If that changes, this policy will be updated before any result is recorded, and the effective date at the top will change.

10. Your rights (GDPR and equivalents)

You can exercise the first two without contacting us at all, from Settings inside the app:

Access and portability: export your profile, and export your track as a standard GPX file.
Erasure: delete your account. This removes your profile, your email, your session, your fleet lists, your entries in other captains' fleets, and your live boat from the chart. It is immediate and we keep no shadow copy.
Rectification: change your profile at any time.
Objection and restriction: turn sharing off, which stops the processing entirely.
Withdraw consent: the sharing switch is the consent, and turning it off withdraws it.

For anything you cannot do in the app, write to [email protected]. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority in your own country.

11. Security

There are no passwords in Sirena. You sign in with a one-time email code or with Apple, so there is no password to leak or reuse.
A sign-in code is six characters, valid for five minutes, and is destroyed after five wrong attempts.
Sessions expire after 30 days of use. You can sign every other device out at any time.
All traffic is encrypted in transit (HTTPS/TLS).
If a breach ever put your data at risk, we will notify the Bulgarian Commission for Personal Data Protection within 72 hours as the GDPR requires, and we will tell you directly, in the app and by email, whenever the risk to you is high. We will say what happened and what we are doing about it, not hide it in a changelog.
Sign-in codes travel by email, and email is not something we control end to end. A code can be delayed or filtered by your provider. If one does not arrive, you can request another; nothing is lost.

12. Children

Sirena is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.

13. Changes

If this policy changes materially, the effective date above changes and the app links here permanently, so the current version is always one tap away. Previous versions are available on request.

← Back to Sirena · Terms of Use