Privacy Policy

1. Introduction

Anchor ("Anchor," "we," "us," or "our") is a community progressive web app for recreational boaters, anglers, paddlers, and water sports enthusiasts. This Privacy Policy explains what information we collect when you use the Anchor app and website (the "Service"), why we collect it, how we store it, and the choices you have.

We designed Anchor to collect as little personal information as possible. We do not ask for your real name, home address, date of birth, government ID, or payment card details, and we do not process payments through the Service. The only situation in which we collect a phone number is the Float Plan feature — specifically, the phone number of the emergency contact you choose to receive an SMS alert if you do not check back in by your stated return time. We use that number only to send the alert and never for marketing.

2. Information You Provide

The following information is collected only when you choose to provide it:

• Account credentials: an email address and password. Your password is never stored in plain text — it is hashed by our authentication provider.
• Public profile: a username (required), and optionally a display name, short bio, home marina, and avatar image.
• Watercraft details: information about the boats, kayaks, paddle boards, or other watercraft you add — such as nickname, type, year, make, model, engine type, length, fuel capacity, hull color, and engine hours. This information is visible to other users.
• Registration reminders (private): if you choose to use the registration-reminder feature, we store your vessel registration number, last-renewed date, and renewal period so we can remind you before it expires. Registration data is only accessible to you and is never shown to other users.
• Maintenance and upgrade logs (private): service records, upgrade items, dates, costs, and notes you enter. These logs are only accessible to you.
• Trip logs (private): entries you record about each outing — date, engine hours, route notes, photos, and free-text notes. Trip logs roll into your personal fleet timeline and are only accessible to you.
• Float Plans: when you file a Float Plan, we store your stated departure and return times, the waterway you selected, a snapshot of the marine conditions at the time of filing, and the name and phone number of the emergency contact you choose. We use this information only to (a) show you your active plans and (b) automatically send the emergency contact an SMS alert if your return time passes without you marking yourself safe. Float Plan records are private to your account.
• Personal pins and waypoints:location coordinates you explicitly drop on the map for your own use (a fishing spot, a secret cove, a launch you favor) or attach to a public waterway (a hazard, fuel dock, or no-wake zone). Pins you mark private are visible only to you and to the specific friends you choose to share each one with. Anchor never accesses your device's location history — these coordinates exist only when you deliberately place them.
• User-generated content: posts, comments (including photos and videos you attach to comments), likes, tags, saved waterways, group memberships, polls, poll votes, marketplace listings, offers, ratings, and messages exchanged with a buyer or seller about a listing.
• Reports you submit: when you report a post, listing, comment, or user, we store the report so our moderation team can review it. Reports include the target item, the reason you selected, and any optional text you provided.
• Notification preferences: the toggles you set for which activities trigger in-app or push notifications.
• Push subscription tokens: if you enable push notifications, the browser-issued endpoint and cryptographic keys required to deliver a notification to your specific device, plus the user-agent string of the browser that registered it.

3. Information Collected Automatically

• Session data: an authentication cookie set by our auth provider so you stay signed in. This is required for the Service to function.
• Approximate location for maps: when you use the waterway finder, your browser may request your approximate location so the map can center on you. We do not store your precise location — location is used only in the moment and on your device unless you explicitly save a waterway to your profile.
• Basic technical data: IP address, browser type, device type, operating system, and pages visited. Our hosting provider logs this automatically for security, abuse prevention, and to measure aggregate performance. We do not build advertising profiles with this data.
• Abuse-prevention signals:during signup and certain other actions we ask your browser to complete a privacy-respecting bot challenge (hCaptcha), which briefly observes interaction signals to confirm you're human. We also count requests per IP and per account to enforce rate limits and stop automated abuse.
• Error and performance telemetry: when something breaks, we collect a minimal stack trace and context (URL, browser) so we can fix it. We also collect anonymized Web Vitals to measure loading performance.
• Product analytics: we record which features are used and how the app performs, keyed to your account. Analytics is used to improve the product, not to sell or share information about you. You can disable analytics in Account Settings.

4. Information We Do NOT Collect

Anchor intentionally does not collect or store:

• Your real name, home address, or date of birth.
• Your phone number (except for the emergency-contact phone number you choose for Float Plans, described in Section 2).
• Government-issued ID numbers (SSN, driver's license, passport).
• Bank account, routing, or credit/debit card numbers.
• Background location or location history from your device. The waterway map uses your browser's one-time geolocation prompt to center on you, and any pins on the map are coordinates you explicitly choose to drop — Anchor never tracks where you go.
• Health, biometric, or other special-category data.
• Contact lists, SMS history, or phone logs from your device.

If a feature ever requires us to collect something outside this list, we will update this policy and ask for your consent in-app before enabling it for you.

5. How We Use Information

We use the information described above to:

• Create and secure your account and sign you in.
• Show your public profile, posts, boats, and listings to other users.
• Keep your private records (maintenance, upgrades, registrations) accessible to you.
• Deliver the features you ask for, such as map search, saved waterways, marketplace offers, group membership, polls, trip logs, and Float Plans.
• Send in-app and push notifications based on your notification preferences.
• Send a one-time SMS to your designated emergency contact if you file a Float Plan and your stated return time passes without you marking yourself safe. The SMS contains your name, departure/return times, and waterway — nothing else.
• Send transactional emails (account verification, password reset, important security notices).
• Remind you about expiring boat registrations.
• Detect, prevent, and respond to spam, abuse, fraud, and security incidents.
• Diagnose errors and measure performance.
• Comply with legal obligations and enforce our Terms of Service.

6. Where Your Data Is Stored

Anchor stores data with a small, deliberately chosen set of processors. Each one acts on our instructions under a data-processing agreement:

• Supabase — hosts our database (profiles, boats, posts, comments, listings, offers, ratings, notifications, push subscriptions, registration reminders, trip logs, Float Plans, personal pins, reports) and handles authentication. Supabase Storage holds user-uploaded images and videos (avatars, post photos, comment media, listing photos, trip photos). Row-Level Security rules restrict access so that private records are only visible to you.
• Vercel — hosts and serves the web app and records standard request logs and Web Vitals.
• Mapbox — renders maps and processes waterway search queries. When you open the map, your IP and search terms reach Mapbox under its own privacy policy.
• Twilio— delivers the SMS alert to your emergency contact if a Float Plan goes overdue. We pass Twilio the contact's phone number and the alert text. Twilio processes the message under its own privacy policy.
• Resend — delivers transactional email (account verification, password reset, security notices). Your email address and the message body reach Resend, which acts as our email-sending processor.
• Upstash — provides a Redis-backed store we use for rate-limit counters keyed on IP and account. Counters are short-lived and contain no message content.
• hCaptcha — verifies that signup and certain abuse-prone forms are completed by humans, not bots. hCaptcha analyzes interaction signals on the page under its own privacy policy and is configured in privacy-preserving mode.
• PostHog — receives product analytics events if analytics is enabled for your account.
• Sentry — receives error reports and performance traces so we can fix bugs.
• Web Push services— your browser's built-in push service (e.g., operated by Apple, Google, or Mozilla) delivers push notifications using an opaque endpoint we store on your behalf.
• Public marine data sources — Anchor reads (but does not write) live weather from the U.S. National Weather Service, tide predictions and water levels from NOAA, and streamflow gauges from USGS. These are read-only fetches from public government APIs. Your personal data is not shared with these sources.

Data may be processed in the United States or other countries where these processors operate. We do not sell personal information, and we do not share it with advertisers.

7. Data Security

We use transport-layer encryption (HTTPS/TLS) for traffic between your device and the Service. Passwords are hashed, not stored in plain text. Access to the production database is restricted, and our database enforces per-row permissions so users can only read and write data they are allowed to touch. No system is ever perfectly secure; if you believe your account has been compromised, please contact us immediately.

8. Data Retention

We keep your account data for as long as your account is active. When you delete your account, we delete your profile, boats, private logs, registrations, push subscriptions, and notification preferences. Posts, comments, and listings you created may be removed or anonymized depending on whether other users have interacted with them. Backups are retained for a short period for disaster-recovery purposes and expire on rolling schedules.

9. Your Choices and Rights

You can:

• Edit or delete your profile, boats, posts, comments, and listings at any time from within the app.
• Turn push and in-app notifications on or off per category in Account Settings.
• Disable optional analytics and error tracking in Account Settings.
• Request a copy of the personal data we hold about you.
• Request correction of inaccurate data.
• Delete your account, which removes the data described in Section 8.

Depending on where you live (for example, the EU/UK under GDPR or California under CCPA), you may have additional rights including the right to object to or restrict certain processing, the right to data portability, and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at the address below.

10. Children

Anchor is intended for users aged 13 and older. Marketplace features (listings, offers, ratings) and the Float Plan feature (filing a plan and designating an emergency contact) require users to be at least 18. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we will delete the account and associated data.

11. Changes to This Policy

We will update this policy whenever our data practices change. When we make a material change, we will update the "Last Updated" date at the top of this page and notify you in-app or by email before the change takes effect.

12. Contact Us

For privacy questions, data-access or deletion requests, or to report a suspected breach, email us at privacy@anchor-boating.com.