Privacy Policy

Data we collect

• Account data (optional): email, password hash (email/password accounts), optional name, Google and Sign in with Apple identifiers when you use those buttons, subscription status, timestamps. Sign in with Apple or Google in BoatCast creates your BoatCast account. Apple Hide My Email addresses are stored as that account email; later Apple sign-ins match your Apple ID so you never type the relay address. Each account has one email. Signing out and registering a new email creates a different account (we do not merge two existing users).
• Billing: payments are processed by Stripe on the web (the email you enter at checkout becomes your BoatCast account). Mobile Pro uses Apple App Store / Google Play Billing via RevenueCat and does not require a BoatCast account. Until you sign in, the store purchase is tied to an anonymous RevenueCat customer on this device. After you sign in we store subscription status and provider on your BoatCast account; card details stay with Stripe or the app stores.
• Favorites: place name, coordinates, and related labels you save (Pro). On iOS/Android these can stay on the device until you sign in; then they sync to your BoatCast account (up to 25).
• Boat size (Pro): optional preference (small / medium / large / none) used only to tailor wind, wave, and chop rating thresholds. Stored on this device for unsigned store Pro, and on your account when you are signed in.
• Location Weather Monitoring (Pro): needs a BoatCast sign-in so we can email or send a push. When you enable monitoring we store the watched coordinates (live GPS updates on mobile or a fixed selected pin on web/mobile), your chosen end time, and short-lived forecast/alert snapshots used only to detect changes. We may store an Expo push token on your account so we can notify you on a mobile device, and we may email your account address for web (and as a backup channel). Monitoring sessions expire automatically at the end time you chose.
• Location usage: searches and map selections you make to fetch weather. Precise GPS, when you grant When In Use, centers the map and requests a forecast for that moment. Background / Always location is used only for Pro Monitor My Location so alerts can follow you while BoatCast is not on screen. It is not used for ads, not sold, and not kept as a personal GPS trail. You can monitor a fixed map pin instead (no Always permission). Weather responses are cached by approximate zone (~10 mi), not as a personal timeline.
• Selected-spot analytics: when a forecast loads for a pin (current location, map, search, favorite, monitor, or a shared link) we store an anonymous count for that approximate weather zone (~10 miles), the place label, how the pin was chosen, website vs iOS/Android, whether the session was free or Pro, and whether the mobile free-tier ads were in play. Repeat taps in the same zone within about 45 minutes are collapsed using a random on-device visitor token (not your account). Coordinates are snapped to the zone grid. These records are used for product reports (by location and by free/ads vs paid), not to target ads.
• Email: transactional messages (signup, password reset, Pro welcome/cancel, account deletion) and Location Weather Monitoring alerts via Resend when configured.
• Local device storage: session cookie (boatcast_session), mobile auth token, short-lived client weather-zone cache, on-device favorites and boat-size for unsigned store Pro, the last BoatCast email used on this device (kept after sign-out so we can warn before a different email creates a second account), and a random visitor token used only to collapse repeat pin taps in selected-spot analytics.
• Third parties: Open-Meteo (forecast), OpenStreetMap Nominatim (geocoding), RainViewer (radar), National Weather Service (alerts), optional satellite SST providers, Stripe (web payments), Apple / Google (Sign in with Apple, Google Sign-In, and mobile subscriptions via RevenueCat), Resend (email).
• Advertising (mobile free tier): the iOS and Android apps may show Google AdMob ads. The website does not show ads. We request non-personalized ads (no App Tracking Transparency / IDFA-based tracking across apps). Google may still receive limited device and usage data under its policies to fill mobile ad inventory. Pro removes mobile ads. Background location is not used for advertising.

Retention

• Account and favorites: until you delete the account (then retained up to 90 days for recovery/billing, then purged) or request deletion by email. On-device favorites for unsigned store Pro stay on that phone until you sign in, clear app data, or uninstall.
• Location Weather Monitoring sessions, push tokens, and related alert delivery: until the session ends, you stop monitoring, or the account is deleted.
• Password-reset tokens: short-lived until used or expired.
• Anonymous selected-spot counts: kept up to about 13 months for product reports of which weather zones are used (by day/week/month and by ads vs paid); not a personal timeline. Repeat taps in the same zone within ~45 minutes are not stored again.
• Server weather/geocode caches: minutes to hours (see How it works); not used as a personal profile.

Your choices

• Delete your account in the app (Account → Delete account), use boatcastapp.com/delete-account, or email boatcastapp@gmail.com. Deleting your account schedules removal after a 90-day grace period (sign in again to restore). Stripe Pro is set to cancel at period end when deletion starts. App Store / Play subscriptions are not canceled by BoatCast — manage renewal in store settings. The BoatCast profile and favorites are purged after the grace period.
• Privacy or data requests (including applicable state privacy rights): email boatcastapp@gmail.com with the address on your account.
• You may disable location permission; search and map still work. You can turn off Always / background location and still monitor a fixed pin (signed-in Pro).

International processing

Infrastructure may run in the United States (for example Vercel, Supabase, Upstash, Stripe, Resend). If you access BoatCast from elsewhere, your information may be processed in the U.S.