Sailpal Privacy Policy

Last updated: November 14, 2026

This Privacy Policy describes the categories of personal data processed in connection with Sailpal, the purposes and legal bases of that processing, the recipients of personal data, and the rights available to individuals.

1. Scope and Data Controller

1.1 Scope

This Privacy Policy applies to Sailpal for iPhone, iPad and Apple Watch (the “Application”), associated beta testing and support, and the Sailpal website hosted with Vercel (collectively, the “Services”). “Personal data” means information relating to an identified or identifiable individual. References to “we”, “us” and “our” refer to the operator identified below.

1.2 Data Controller and Contact Details

The controller responsible for the processing described in this Privacy Policy is:

Alexander Nehls
Greifswalder Str 196
10405 Berlin
Germany

Email: support@sailpal.io

Privacy inquiries and requests to exercise data protection rights may be directed to this address.

2. Categories of Personal Data and Processing Activities

2.1 Sailing, Location and Sensor Data

The Application processes and stores settings, boat and course information, waypoints and sailing sessions on your devices. Recordings may include precise coordinates, timestamps, speed, heading, motion and orientation measurements, and derived performance metrics. This processing supports course setup, timing, recording and replay. A Sailpal account is not required.

The Application does not upload sailing recordings. Recordings leave the Application only when you explicitly export or share them. External processing associated with weather, maps and TestFlight is described below.

2.2 Location, Motion and Health Permissions

Location permission is necessary for the Application’s core sailing functions, including position display, waypoint capture and sailing-track recording. Without location permission, these functions cannot operate. Removing background location access can interrupt recording and result in gaps in the sailing track while the Application is in the background. Motion sensors support heading, heel, pitch and recording diagnostics.

With Health permission, the Watch companion can run and save sailing workouts using HealthKit.

You may refuse or change permissions in your device settings and manage saved workouts through Apple's Health controls. Features requiring a permission may be limited when it is refused. Deleting an app session does not delete its separate Health workout.

2.3 Weather and Map Requests

The Application transmits latitude and longitude directly to Tomorrow.io to obtain wind speed, direction and gusts. Tomorrow.io also receives connection information, including your public IP address. The Application caches weather results locally to reduce repeat requests. These requests do not contain your full sailing history.

Map display requests tiles, fonts and symbols from Stadia Maps. An included fallback may request tiles directly from the OpenStreetMap Foundation. These providers receive your IP address and request details that identify the map area being viewed, which may include your sailing location.

2.4 Support Correspondence and Shared Files

When you contact support, we process your email address, any name you provide, your message and attachments to respond and investigate issues. Support email is hosted by IONOS and accessed by us. Recordings shared for support are kept in the mailbox and locally for investigation.

The website contact form collects your email address, message and any name you choose to provide. Vercel processes the submission and Resend forwards it to our support inbox. The contact form does not accept file uploads.

Exports and diagnostic files can include sensitive coordinates, timestamps, device or connection information and technical events. You should review files before sharing them. Local diagnostic logging does not itself send those logs to us.

2.5 TestFlight Data and Beta Administration

For TestFlight distribution, Apple automatically collects crash and usage information and makes it available to the developer. Feedback you submit may include screenshots, comments and contact details. Email invitations also involve processing your invitation address; contact visibility differs for public-link invitations. We use this information to administer the beta, investigate failures and improve the app. See Apple's TestFlight privacy notice.

Website early-access requests require your name, email address, boat or class and intended device platform. Smartwatch ownership and information about yourself and your intended use are optional. We use these details to review requests, understand intended use and device compatibility, and administer participation. Requests are reviewed manually; invitations are sent through Apple TestFlight. Android requests are recorded separately as interest in future availability and do not receive invitations to the current iOS beta.

Vercel processes form submissions, and we store the request details, signup time and, for iOS requests, review status in private Google Sheets. Resend sends confirmation emails and notifies our support inbox. Android interest is used to provide the availability notification you requested. These requests do not subscribe you to a general newsletter. You may contact us to correct your details or withdraw your request.

2.6 Website Access Data

Vercel hosts the Sailpal website. Website requests involve technical connection and access information, such as the requested page, access time, browser, operating system, referring page and IP address. Processing supports website delivery, security and stability.

We use short-lived IP-address hashes to limit repeated form submissions and protect against abuse. We do not use website analytics or advertising trackers, and open and click tracking are disabled for emails sent through Resend.

3. Purposes and Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”) applies, processing is carried out for the following purposes and on the following legal bases:

• Providing the app's requested sailing, recording, map and weather functions, and handling support necessary for that service: Article 6(1)(b), performance of the service agreement or steps you request before entering it.
• Optional permission-based processing where consent is required: Article 6(1)(a). Where Health information qualifies as health data, its optional processing relies on explicit consent under Article 9(2)(a).
• Operating and securing the website, handling early-access requests and requested availability notifications, responding to inquiries, administering beta testing, investigating technical faults and improving reliability: Article 6(1)(f). Our legitimate interests are a secure, functioning service, responding to requests and effective support and testing.
• Processing required to comply with applicable legal obligations: Article 6(1)(c).

Device permission controls govern technical access; they do not replace any additional consent required by data protection law. You are not legally required to provide support files or optional permissions. Without necessary information, we may be unable to investigate an issue or provide the corresponding feature. The required website form fields are necessary to handle your inquiry or early-access request; optional profile information may be omitted.

4. Recipients and Service Providers

Personal data is received by the providers identified in this Privacy Policy where required for the relevant function: Tomorrow.io for weather requests; Stadia Maps and, where the fallback is used, the OpenStreetMap Foundation for map requests; Vercel for website hosting and form processing; Google for request storage in Google Sheets; Resend for website email delivery; IONOS for email hosting; and Apple for TestFlight and Apple-managed services. Support information and signup records are accessed by us and the providers involved in their handling.

Data may also be disclosed to authorities or other recipients where required by a binding legal obligation. Providers selected by you may process exported files or device backups.

Providers process request information to deliver and operate their services. Their policies describe their additional processing and retention:

• Tomorrow.io product privacy policy and website/digital services policy.
• Stadia Maps privacy policy and data processing addendum.
• OpenStreetMap Foundation privacy policy.
• Vercel privacy notice and data processing addendum.
• Resend privacy policy and data processing addendum.
• Google privacy policy and data transfer frameworks.

Stadia's published processing terms describe API/access-log retention of approximately 7–14 days, with exceptions and separate security and backup retention. Tomorrow.io describes retention according to service purposes, legal obligations and disputes rather than a fixed API-log deletion period.

5. International Data Transfers

Weather, map, Apple and website hosting, form, email and Google Sheets services can involve processing outside the EU/EEA, including in the United States. OpenStreetMap uses a global tile-delivery network. Stadia's published processing terms incorporate EU Standard Contractual Clauses for applicable transfers to countries without an adequacy decision. Tomorrow.io's policies describe international processing and contractual safeguards. Vercel's and Resend's published processing terms describe Standard Contractual Clauses for applicable transfers. Google's transfer information describes adequacy decisions, the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, depending on the transfer. Contact us for information about safeguards applicable to your data or to request a copy where available. Provider privacy information is linked above.

6. Data Retention and Deletion

6.1 Data Stored on Your Devices

Saved app data remains on your devices until deleted or the app's data is removed. Exports, backups and saved Health workouts are separate copies and must be managed separately.

Local recording diagnostics are held in caches. Recording-start cleanup attempts to remove recording logs older than seven days and limit the remaining set to 20 files; the operating system may also remove caches. This is not a guarantee that every diagnostic artifact is deleted after seven days.

6.2 Support and Beta Data

We retain recordings and diagnostic files you share only as long as needed to investigate the reported issue and verify a fix. Support correspondence is retained only as long as needed to handle your request or meet applicable legal obligations. Necessary beta contact information is kept while needed to administer your participation. Early-access request details are kept while needed to review the request and administer participation. Android interest details are kept while needed to provide the requested availability notification. You may withdraw your request or request deletion using the contact above.

6.3 Separate Copies and Provider Retention

Deletion of shared recordings covers mailbox attachments and local working copies. Removing app data does not itself remove data already processed by external providers, exported copies or backups. Provider retention follows the applicable service arrangements and legal requirements.

7. Your Data Protection Rights

7.1 Requests and Withdrawal of Consent

Subject to the applicable legal conditions, you have the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete personal data.
• Erasure of personal data.
• Restriction of processing.
• Data portability.

You may object to processing based on legitimate interests, on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Contact support@sailpal.io to exercise your rights.

7.2 Complaints

You may complain to a competent data protection authority, particularly in the EU country of your habitual residence, workplace or the alleged infringement. In Berlin, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. Applicable rights under other jurisdictions are not limited by this policy.

8. Data Security

The Application's configured weather and map requests use HTTPS. Access to support information is limited to us and service providers involved in its handling. No storage or transmission method can guarantee absolute security.

9. Children and Beta Eligibility

The current beta is intended for adults aged 18 and over. It is not directed to minors. Please contact support@sailpal.io if you believe a minor has provided personal data through the beta or support channels.

10. Third-Party Websites

The Services contain links to websites operated by third parties. Personal data processed when visiting those websites is subject to the respective operators’ privacy notices.

11. Changes to This Privacy Policy

Revisions to this Privacy Policy will be published at https://sailpal.app/privacy and identified by an updated “Last updated” date. Where required, material changes will be brought to your attention separately and additional consent obtained before introducing processing that requires it.