Privacy policy

1. Who is responsible

SailPolars is operated by Paraply Ventures AS, a company registered in Norway. Paraply Ventures AS is the data controller responsible for the personal data processed to provide SailPolars.

Contact us at hello@sailpolars.com for questions about the service, complaints, privacy requests and child-safety concerns.

This policy covers our website, game and account, training, racing and community features. An independent club or event organizer may also be responsible for information they collect for their own event. Their separate privacy information applies to that processing.

2. Information we collect

• Account and sign-in. Account identifier, handle, display name, email, linked sign-in provider identifiers, settings, locale and time zone. When you create an account we record the time you confirmed you are 13 or older. Where password or authenticator sign-in is enabled, we store password hashes, protected authenticator data, recovery-code hashes, session records and security events. With optional Google sign-in we receive identity and email information from Google; we do not receive your Google password.
• Event-entry details. If provided or required by an event: legal name, country, World Sailing Sailor ID, birth date, guardian name and email, terms version and acceptance time, registration, check-in and team membership.
• Sailing activity. Saved training attempts and progress, boat and livery choices, room names and codes, race inputs, finish places, scores, penalties, verification evidence, ratings, achievements and replay records. Guest online play also sends a racing name and inputs to the room. A signed-in training attempt is saved when you choose to save it.
• Community and support. Friend requests, friendships, blocks, club and conversation memberships, messages, forum posts, uploaded images, reactions, reports, moderation actions and information you send in a support request.
• Technical information. Connecting IP address, request and connection information, browser information available to our hosting services, random browser/device identifiers, request timing and status, and operational logs. Account, event or race identifiers may be associated with a request to diagnose problems and investigate abuse.

We obtain information from you, your browser, sign-in providers you choose, other sailors who interact with you, event organizers and officials, and race verification. We do not require your precise physical location or access to your address book. A selected sailing venue is a game setting, not your device location.

3. Why we use information

Where the GDPR applies, we use the following legal bases:

• Providing the service (contract). Creating and securing your account, delivering requested messages and community features, saving training, running races and processing event entries and related notices. Information needed for these features is necessary to provide them; without it the affected feature may be unavailable.
• Legitimate interests. Preventing cheating and abuse, reviewing reports, diagnosing failures, preserving trustworthy sporting results and replay evidence, and administering the service. We balance these interests against your privacy and reasonable expectations. You may object to processing based on these interests.
• Consent. Optional Umami page analytics runs only after you accept analytics. You can reject it without losing access and withdraw consent in Cookie settings. If another feature needs consent, we ask separately. Accepting terms is not marketing consent. You can stop optional event-notice emails in Sailor details; notices remain on the cup notice board. Necessary sign-in and security emails are separate.
• Legal obligations. Responding to valid legal requirements and protecting records where retention is legally required.

Scoring, penalties, replay verification and ratings use automated game logic. They concern virtual sporting performance. Event officials can review disputed sporting outcomes through the event process. We do not use these scores to make decisions about employment, credit or similar matters.

4. What other people can see

Your display name and handle, discoverable profile information, public rankings, public forum contributions, room participation, and published event results may be visible to other users or visitors. Race replays and spectator views can show recorded names, boats, movements and race outcomes. They can remain associated with the display name recorded at race time.

Turning off discoverability in Profile stops new friend requests and removes you from public rankings. It does not erase existing conversations, public posts, published event results or recorded race names.

Messages are available to the conversation’s members; club discussions depend on membership and forum visibility. They are not end-to-end encrypted. Authorized club administrators or platform moderators may review reported content within their permissions. Authorized service operators may access information when needed for support, security or legal requirements.

Private event details, including legal name, birth date and guardian details, are not displayed in public results. Authorized organizers and event officials can access entry details for their event. Do not put sensitive or private information in a public display name, post, room title or sail graphic.

When you are a member of a club, that club’s coaches, admins and owner can see your saved training progress: best drill scores, completed lessons and the date of your last saved practice. Other members cannot. Leaving the club ends that access. Practice a coach assigns, with its title and link, is visible to every member of the club.

5. Service providers and international processing

These providers process information on our behalf to run the hosted service: Cloudflare for website and game delivery, online rooms, security and replay storage; Fly.io for application hosting; PlanetScale for the PostgreSQL database that holds account and product records; and, where enabled, Lettermint for account emails. Our application servers and database run in the Frankfurt region in the EU; Cloudflare serves visitors from its worldwide network. Optional page analytics uses our Umami service at umami.parap.ly. Google provides the optional sign-in method you select under its own terms and privacy policy. Providers receive information needed for their function, such as connection metadata, stored records, or an email address and message for delivery.

We do not sell personal information or use the service to target advertising. Information may also be disclosed where required by law, to protect users and the service, or to a successor operator subject to applicable privacy requirements.

Infrastructure providers operate internationally, so information may be processed outside your country, including outside the EEA. Applicable data-protection law requires an appropriate transfer mechanism, such as an adequacy decision or standard contractual clauses, where necessary. Email hello@sailpolars.com for the processing locations and safeguards applicable to your information; we do not promise that all data stays in one country.

6. Cookies, browser storage and analytics

• Sign-in cookies. Session and short-lived authentication cookies keep you signed in and protect sign-in, account linking and recovery. Production authentication cookies may use the __Host- prefix. A session can last up to 30 days; temporary authentication cookies last minutes.
• Device cookie. The sailor_device cookie is a random browser identifier used to record account devices and support event integrity. It can last up to 400 days. The account database stores its hash, not a hardware fingerprint.
• Preferences and notices. The sb-theme cookie remembers appearance; sp_flash carries a temporary action notice. Browser storage remembers game settings, racing names, livery and local practice records. Forum drafts are stored on your device and discarded by the draft feature after seven days. Session storage holds online-room reconnect tokens for that browser session.
• Privacy choice. The sp-privacy-v1 browser-storage entry records your accept or reject choice, its time and the notice version. The site asks again after 180 days or when this notice version changes. This storage is used to apply your privacy choice. If storage is blocked, the choice applies to the current page only.
• Optional Umami analytics. Only after you accept, the browser loads the script from umami.parap.ly and sends a page visit to that service. We send the public website hostname, page path and title. We exclude URL queries, fragments and referrers, and do not send account identifiers, racing names, room codes, form contents or custom click events. Private account pages and embedded players do not load the tracker. Your browser’s Do Not Track or Global Privacy Control signal keeps analytics off. Umami does not use tracking cookies. Its server receives your IP address and browser connection metadata to process the request; cookie-free does not mean no data is processed.

Our Umami service is hosted in Europe. Analytics records are retained for 365 days. Connection logs are separate infrastructure records and follow the hosting configuration described under Retention. Email hello@sailpolars.com to ask about a specific record or make a privacy request.

Use Cookie settings in the website footer or game Settings to change your choice. Reject analytics withdraws consent and blocks further analytics on this page and other open tabs. Withdrawal does not undo processing already completed. Necessary sign-in, security and requested settings work independently of this choice.

You can clear cookies and site storage in your browser. Doing so may sign you out, remove unsaved drafts and local settings, or prevent reconnecting to a race. Disabling necessary storage can prevent affected features from working. Closing an account does not automatically clear copies stored on your devices.

7. How long information is kept

Account details and activity are generally kept while your account is active or until you remove them. Closing your account deletes credentials, private details, account devices, social links and saved training; it removes the bodies of your messages and forum posts and stored forum images, and replaces your active profile with a closed-account record. Transfer clubs you own before closing.

Published event results, race-time names, locked sporting records, replay evidence and audit records are retained to preserve sporting history, review outcomes and protect competition integrity. There is currently no automatic expiry for those records. Account closure does not mean every historic record is erased. You can request review of retained personal information, including where a display name identifies you.

Temporary authentication proofs and rate-limit records are removed after expiry. The authentication maintenance process removes security events after 90 days, mail delivery receipts after 30 days, expired support cases after a further 90 days, and cleared authentication-mail records after seven days. These are maintenance thresholds, not a promise of instant deletion at the exact expiry time.

Casual rooms, including their stored recent replay, are scheduled for cleanup after two hours of inactivity. Local game preferences and records remain in your browser until cleared. Database backups expire on a fixed schedule: twice-daily and daily backups after at most 14 days, weekly backups after three months, so deleted data leaves the backups within three months. Operational logs and other infrastructure records depend on the hosting configuration; no fixed expiry for them is currently promised. Data may remain longer where necessary for a specific dispute or legal obligation. Ask us about a particular record or retention period.

8. Your choices and privacy rights

Use Profile to edit your name, display preferences and discoverability, or close your account. Use Sailor details to update private entry information, manage event-notice emails and download your account data. Self-service exports are available to signed-in users; you can also request access directly.

Depending on applicable law, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent for optional processing. Withdrawal does not affect earlier lawful processing. Some sporting or legal records may be retained after a request; we will explain the reason and consider whether identifying information can be removed or reduced.

Email your request to hello@sailpolars.com with enough information to locate the relevant account or record. Do not send passwords or recovery codes. We may need proportionate identity verification. Paraply Ventures AS is established in Norway, in the European Economic Area, so the GDPR applies to our processing. We normally respond within one month; if a lawful extension is needed, we will explain it within that month. You can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the data-protection authority in the country where you live or work or where the alleged infringement took place. You do not have to contact us first.

9. Younger sailors

You must be 13 or older to create an account. 13 is the age at which you can consent to online services yourself in Norway, where SailPolars is operated, under the GDPR (Article 8) and the Norwegian Personal Data Act. When you create an account, by email and password or with Google, you confirm that you are 13 or older, and we record when you did so. We do not ask for proof of age at sign-up.

Sailors under 13 can use everything that needs no account, including the training drills, races against the computer fleet and online rooms as a guest, where only a racing name and race inputs are sent to the room. To take part in events, a younger sailor goes through a club coach’s or a parent’s or guardian’s account. If we learn that an account belongs to someone under 13, we will close it and delete its private details as described under Retention.

Parents and guardians should help younger sailors choose appropriate display names, understand public racing records and avoid sharing private information. Under-18 event-entry details require guardian information. That form records the supplied details; it does not itself verify parental authorization. Where parental authorization is legally required, it must be obtained before the affected feature is used. Email hello@sailpolars.com to raise a child-safety concern or request review or removal of a child’s information.

10. Security and policy changes

We use measures including protected sign-in credentials, restricted access to private records, session controls and security headers. No internet service can guarantee complete security. Keep your mailbox and sign-in methods secure, and tell us promptly about suspected unauthorized access.

We will update this policy when features or data practices change and show the new date here. We will provide additional notice of material changes and request consent before new processing where required. You can also read the Terms of use for service and community rules.