Privacy policy

22 August 2026

This page says what data Sternwise collects, what for, how long it lives and what you can do about it. The data controller is SternWise LLC. The retention periods are not invented for the document: they sit in the database as a table, a daily job applies them, and they can be changed without shipping a release.

What we collect

— Your email address — so you can sign in and hear about your own records.

— A pseudonym, and a public display name if you want one. Your real name is not required.

— A Google account identifier, if you sign in with Google. Your Google password never reaches us.

— What you record: inspection journals, findings, things you tell about a boat, reports about companies, photographs and video.

— A fingerprint of the address a request came from. The address itself is not stored: an irreversible fingerprint is derived from it. Two requests can be compared; the address cannot be recovered.

— An audit log: who did what in the system. It is there for settling disputes and for security.

— Technical records: sessions, rate counters, one-shot operation keys, email delivery marks.

What for

To run the service: sign-in, showing your records, notifications.

To defend against abuse: sign-in guessing, spam, the same thing sent twice.

To handle complaints and appeals and to show that a decision was made by the rules.

To answer lawful requests where we are required to.

How long we keep it

Retention is applied automatically, once a day. A legal hold outranks the period: while a matter is under review the data is kept even if the period has run out.

— sign-in links and OAuth states — 1 day;

— one-shot operation keys and rate counters — 2 days;

— uploaded files not attached to any record — 7 days;

— unconfirmed addresses from the waiting list — 30 days;

— sessions and network address records — 90 days;

— report drafts — 90 days; inspection journal drafts — 180 days;

— email delivery log — 180 days;

— unclaimed guest accounts and booking evidence — 365 days;

— funnel events — 400 days;

— audit log — 5 years.

Published records about boats are kept as long as the boat exists in the catalogue: they belong to her, not to you.

Who else sees it

We do not sell data and do not pass it on for advertising.

Processing is carried out by our providers, each in its own part:

— Render — hosting for the application and the database, Frankfurt region;

— Cloudflare — protection and traffic delivery in front of the application;

— Private Email (Namecheap) — sending email;

— Google — sign-in with Google, if you use it.

Publicly visible is only what you published: records about a boat and your pseudonym. An email address is never shown publicly.

Your rights

— Get a copy of your data: there is an export under “My data”.

— Correct what is wrong: pseudonym and public name are edited in your account.

— Delete your account. Deletion anonymises you: your name and address disappear from the records, while the records about boats remain, because they belong to the boat.

— Object to processing, and complain to the data protection authority in your country.

Send a request from the “Questions and feedback” page. We answer within the time the law allows.

Cookies

We use them only to make the service work: to hold your sign-in session and to remember the language you chose. We have no advertising or tracking cookies.

Children

The service is not meant for children under 16, and we do not knowingly collect their data.

Changes

The date of the last change is at the top of this page. Significant changes are announced to people who have an account.