Privacy

What stays aboard,
and what we keep.

Siparu has two halves. The plugin runs on your boat and records everything she measures onto her own storage. The hosted service lets you watch her from ashore. Almost nothing about your boat is kept ashore, and this page says, in plain words, exactly what is.

Last updated 19 September 2026

Who is responsible for this

Siparu is run by Siparu Ltd, registered in England and Wales under company number 17429552, at 128 City Road, London EC1V 2NX. The company is the controller of the personal data described on this page. Until 1 September 2026 the service was run by its founder personally; the company took it over on that date and answers for it now. Write to privacy@siparu.app about anything here, and a person answers.

What stays on the boat

Her position, speed, heading, wind, depth, her voyages and her logbook are recorded and held on board, in the Signal K server on your own network. They are not copied ashore to be stored. When you watch her live, her readings travel from her own server, through a relay that keeps none of them, to your browser, and to nobody else. The moment she goes offline there is nothing ashore to show, because nothing was kept. That is the point of the product, not a limitation of it.

Since version 0.2.0 they also travel sealed. The boat encrypts every report to the screens you have authorised, so what crosses the relay is a block it cannot open, and a boat that has authorised no screen sends nothing at all rather than sending it in the clear. Before that version the relay stored nothing either, but a report crossed it readable, which made this a promise about what we do rather than about what we can. A boat still running an older version sends her reports that way until she is updated.

What we keep ashore

An account is the only thing that lives on our side, and it holds the least a service needs to know who you are and which boat is yours:

• Your email address, and a password we never store in the clear: it reaches our authentication provider over TLS and is hashed there, so we hold the hash, not the word.
• Each boat you have paired: her name, that she is yours, the time she last called in, and the identity her own server reports for herself. That identity is her MMSI where she has one, the number she already broadcasts on AIS, and otherwise a random one her own server made up. We record it so that a boat can be told apart in a fleet and named when you write to us for help. It is her own claim, which we cannot verify, so it decides nothing: a boat coming back is recognised by proving she holds the token we gave her, never by this. It says who she is, and never where she is. The last called in item is a timestamp on our clock, not a position. It is how a screen can show when she was last online, without holding where she was. We also hold the public half of her own keys, which is what lets her seal her reports to the screens you have authorised.
• While you connect a boat, a short-lived pairing record: a hashed code that expires within the hour and is used once.
• Your membership, if you take one: which plan you are on, whether it is running, when it renews, the reference numbers Paddle gives your customer record and your subscription, and a log of the notices Paddle sends about it. Never a card number, and never an amount (see Payments below).
• That you agreed to the terms: which version of them, on which occasion (opening the account, or taking a membership), and when. A sentence shown above a button is the agreement; this row is how we can show afterwards what was agreed, rather than only that something was displayed.
• Your dashboard layout: which gauges you have chosen to hide. Your device seals this with a key derived from your password before it is sent, so what we store is a sealed block rather than your layout in the clear. We keep it only so your choices follow you between devices.
• Each screen you have authorised to open her reports: a device identifier that means nothing on its own, the public half of that device's key, and a note of which screen approved which. The private half never leaves the device it was made on. These are what let your boat seal her reports to your screens without letting us open them.
• Your sign-in sessions. When you sign in, our authentication provider records the session together with the address it came from and the browser string it announced. That is how a session stays valid and how one that is not yours could be told apart. We do not prune these on a schedule today, so a session record outlives the sitting it belongs to; deleting your account removes them with everything else.

One thing we keep is not about you at all: a daily tally of how many times a boat asked for a pairing code. It is how we learn whether the free half aboard leads anyone to want the shore, and it is a number rather than a record. A date and a total, with nothing in it that says which boat asked, from where, or at what hour. One boat asking twice and two boats asking once are the same entry, deliberately, because telling them apart would mean keeping something that identifies them.

What we deliberately never keep

Some things are absent by design, and their absence is the promise:

• Where your boat is. No position, no track, no last known fix sits ashore. Ever. From version 0.2.0 it cannot be read in passing either, because what crosses the relay is sealed to your own screens. On earlier versions it crossed readable, and a boat that has not been updated still sends it that way.
• What she carries. Your gauge choices would reveal which systems she runs, so your device seals them before they reach us, and we store a sealed block rather than the list in the clear.
• Your card. Payment is handled by Paddle, the merchant of record for the membership, and never by us.
• A phone number. Nothing here asks for one.
• A count of who installed it. The plugin on your boat sends us nothing at all until you begin pairing her, so an installation that never reaches for the shore is one we cannot see and do not try to. We would rather not know than measure you.

Payments

The Remote plan (watching a boat from ashore) is a membership, taken here on this site rather than inside an app. The merchant of record is Paddle, which handles the payment, the receipt and the tax under its own terms. The software on the boat is free, and stays free whether or not you ever take a membership.

To open the checkout we hand Paddle the email address of your account, so that the sale is tied to you and the receipt reaches you, together with an account reference of ours that means nothing outside our own system. What Paddle asks you for at the checkout, your card and the country or address it needs for tax, goes to Paddle and never to us. What comes back to us is that you have a membership and until when. With it come Paddle's reference numbers for your customer record and your subscription, and a log of the notices Paddle sends about it: what happened and when, with no amounts and no card. All of it is recorded against your account so that signing in on a laptop finds what you took on a phone.

The contact form

If you write to us through the form, we keep what a reply needs and no more: your message, the email address to answer it, and, if you offer them, a name and a subject. The message is stored, and that store is what we read and answer from. We do not keep your IP address with the message; it is seen only at the edge, to slow a flood of messages, where a keyed hash of it counts for an hour and then expires. The address itself is not written down. Signing in is the one place an address is written down, and it is named above. The lawful basis is your consent, and you may withdraw it at the address below.

Cookies, tracking and third parties

This site sets no tracking cookies, runs no analytics, and carries no advertising or social pixels. Nothing follows you off this page.

When you are signed in, the app keeps you signed in with a token in your browser's own local storage. This site reads that one token, and nothing else, to decide whether to show you a way in or a way to your dashboard. It is not a tracking cookie and it never leaves your browser.

The typefaces and the page's animation code are served from this domain, so no font or type CDN is told that you are reading this. Two scripts come from somebody else, and each has one job. The checkout page loads Paddle's, because the checkout is Paddle's own. Everywhere else the only one is Cloudflare Turnstile, the check that a form is being filled in by a person rather than a machine: it guards the contact form, signing up, signing in and a password reset. The app runs the same check in a hidden page of ours, which is given neither your email nor your password. Cloudflare is one of the three companies that handle data on our behalf, as processors, under contract and on our instructions only:

• Supabase holds your account, your boats and your messages. The database is in the European Union (Frankfurt).
• Cloudflare serves this site, runs the relay that carries your boat's reports, and provides the check that a form is being filled in by a person rather than a machine. It is a global network, so a request of yours is answered by whichever of its locations is nearest.
• Resend delivers the mail an account needs: a sign-up code, an invitation, a notice that a password changed.

Paddle, named under Payments, is not on that list: it does not act on our instructions but sells the membership in its own name, and answers for the payment under its own privacy terms.

One further request is made, by your browser or by the app, and only for a chart. In a browser that is the chart you open: from ashore, or on board unless her charts are stored on the boat. In the app it is also the one drawn behind her position on the opening screen, which the app keeps ready while you read another page. The coastline underneath your boat is drawn from OpenFreeMap, so that service is asked for the squares of map you are looking at, and a square says roughly which stretch of coast held your attention. It is run from inside the European Union, sets no cookie, and does not log addresses by default. Your boat's own position and track are not sent there: your own device draws them on top, from readings it has already unsealed. The map's lettering comes from us. A chart is the only thing that asks, and where no chart is drawn nothing is asked.

Cloudflare and Resend are established in the United States, so serving you can involve a transfer outside the European Economic Area. Both are engaged under the European Commission's standard contractual clauses, and what Cloudflare carries for your boat is sealed to your own devices before it reaches them (see above). Paddle is established in the United Kingdom, which the Commission has found adequate, so what reaches it needs no further safeguard. Serving any web page leaves the usual request line (an address, a browser string); we use it to keep the service up and to rate-limit the form, not to build a picture of you.

Where it lives, and for how long

Your account, your boats and any message you send are held by Supabase, in the European Union; the live relay and this site run on Cloudflare. Both are encrypted at rest. How long each thing stays:

• Your account, and the boats and preferences attached to it, for as long as you have an account. Close it and all of it goes at once, from your own Account page.
• A message you send through the form, until the exchange is finished and in any case no longer than a year after it arrived.
• A pairing record, under an hour: it expires on its own and is used once.
• A membership, for as long as it runs and then as long as the law requires the record of a sale to be kept.

Your boat's own history is not on this list because it is not ashore at all. It is on her, and it is yours: nothing here expires it, and nothing here can produce it. What she keeps, and for how long, is set aboard: her summaries for good, her raw record within a storage limit of her own.

Your rights

Under the GDPR you can ask what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Deleting is in your own hands: your Account page closes the account and takes every boat with it, and any boat can be removed from its own page, with nobody to ask. For a copy of what we hold, or a correction, write to privacy@siparu.app and we will do it, and confirm when it is done. There is little to hold, by design.

You can also object to what we do with your data, ask us to restrict it, and ask for what you gave us in a portable form. Providing it is not a legal requirement and there is no automated decision-making here: nothing about your account is decided by a machine reading your data.

The lawful basis for your account data is the contract to run the service you signed up for; for a message sent through the contact form it is your consent, which you may withdraw at the same address.

If you think we have handled your data badly, tell us first and we will put it right. You are also entitled to complain to a supervisory authority: in the United Kingdom that is the Information Commissioner's Office, and in the European Union it is the authority for the country you live or work in.

Our representative in the EU

We are a UK company with no office in the European Union, so we have appointed someone there to stand for us. That representative, both under the GDPR and under the Digital Services Act, is Data Protection Representative Limited, trading as DataRep, registered in Ireland under number 616588, at DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland.

If you are in the EU or the EEA you can take any data protection question to them rather than to us. Write to datarequest@datarep.com with Siparu Ltd in the subject line, or use their form at datarep.com/data-request. They keep a contact address in every EU country and in Norway and Iceland, so you can also write a letter; address it to DataRep and not to us, or it may not reach them.

For anything under the Digital Services Act the same company acts as our legal representative and can be reached at digitalrequest@datarep.com or on +353 1 919 8899. We have notified the Digital Services Coordinator in Ireland of that appointment.

Changes

If this policy changes in a way that affects what we do with your data, the date above changes and, where the change is material, we tell you before it takes effect.