Privacy Policy GDPR Compliant

SailGPS (the "App", the "Site", or the "Service") is committed to protecting your privacy. This policy describes how we collect, use, and protect your personal data when you use our service.

1. Data Controller

2. Data We Collect

2.1 Data provided by the user

• Account: username, email, password (encrypted), name, country, birth date (optional), bio (optional)
• GPS Tracks: GPX files containing coordinates, speed, altitude, timestamps
• Statistics: sailing performance, speed, distances, VMG, maneuvers
• Avatar: profile picture (optional)

2.2 Automatically collected data

• Technical data: IP address, browser type, operating system, device model
• Usage data: pages visited, time spent, interactions with the service
• Cookies: authentication token, language preferences
• Geolocation data: derived from your GPS tracks

3. Legal Basis for Processing

We process your personal data based on the following:

• Consent: for sending newsletters, non-essential cookies
• Contract performance: to provide GPS tracking and ranking services
• Legitimate interest: to improve the service, prevent abuse
• Legal obligations: to comply with applicable laws

4. How We Use Your Data

• ✅ Provide and maintain the GPS tracking service
• ✅ Calculate speed statistics and rankings
• ✅ Send monthly newsletters (if enabled)
• ✅ Authenticate you and manage your account
• ✅ Improve user experience and optimize the service
• ✅ Prevent fraudulent or abusive activities
• ✅ Respond to your support requests

5. Data Sharing

We do not sell your personal data. We share data only in the following cases:

• Public Rankings: your username and performances are publicly visible in rankings (if the track is public)
• Service Providers: hosting, email services, analytics (Google Analytics 4)
• Google AdSense: to display personalized advertisements
• Legal obligations: if required by law or competent authority

6. Your Rights (GDPR)

As a data subject, you have the following rights:

• 🔹 Access: know what data we hold about you
• 🔹 Rectification: correct inaccurate data
• 🔹 Erasure: request deletion of your data ("right to be forgotten")
• 🔹 Restriction: limit processing in certain cases
• 🔹 Portability: receive your data in a structured format
• 🔹 Objection: object to processing for legitimate reasons

To exercise your rights, contact us at [email protected].

7. Data Retention

• Account data: as long as the account is active, unless deletion is requested
• GPS tracks: until the user deletes them
• Newsletter: until unsubscription
• Technical logs: up to 12 months

8. Data Security

We implement appropriate technical and organizational security measures:

• 🔒 Password encryption (bcrypt)
• 🔒 HTTPS connections (TLS 1.2/1.3)
• 🔒 JWT tokens for authentication
• 🔒 Regular database backups
• 🔒 Limited data access to authorized personnel only

9. Cookies and Similar Technologies

We use the following cookies:

Name	Purpose	Duration	Type
jwt_token	User authentication	365 days	Essential
sailgps_lang	Language preference	365 days	Preference
_ga, _ga_*	Google Analytics	2 years	Analytics

You can manage cookies through your browser settings. Disabling essential cookies may impair service functionality.

10. Google AdSense and Personalized Ads

This site uses Google AdSense to display advertisements. Google uses cookies to personalize ads based on your previous visits. You can disable personalization by visiting google.com/adssettings.

11. International Transfers

Your data is hosted on servers in Italy (EU). Some third-party services (Google) may transfer data to the US, in compliance with standard contractual clauses (SCC).

12. Android App

The SailGPS Android App (WebView) does not collect additional data beyond what is described. Required permissions: file access and location (only to upload GPX tracks).

13. Changes to this Privacy Policy

Any changes will be published on this page with an updated date. Significant changes will be communicated via email.

14. Complaints

You have the right to file a complaint with the supervisory authority if you believe the processing of your data violates GDPR.