OpenOcean Privacy Policy

Effective date: 20 October 2026

OpenOcean is operated by OPENOCEAN HUB PTE. LTD., a company registered in Singapore ("OpenOcean", "we", "us"). This policy explains what we collect when you use the OpenOcean app and the services behind it, why, who else it reaches, how long we keep it, and the choices you have. We have tried to write it the way we would explain it on a dock, not in a courtroom. If anything is unclear, write to us at support@openoceanhub.com.

This policy lives at openoceanhub.com/privacy. When we change it we update the effective date above; for changes that matter we also email your account address.

The short version

• OpenOcean is a boating app, so location is at the heart of it: your boat's position (shared with other users by default, at a visibility level you control), your own position while you crew on a boat (visible to that crew only, on by default), background location for Anchor Watch, voyage tracking and the boat's tracking device, and the map areas you look at. Section 2 describes each one exactly.
• We store the content you create: posts, photos, videos, voice notes, reviews and private messages. Messages are private to their participants, but they are not end-to-end encrypted, and the photos and voice notes attached to them are delivered from a content delivery network at an unguessable address that is not protected by your login.
• If you add safety contacts, you give us names, email addresses and phone numbers of people who may not use OpenOcean. We use them only to send your safety alerts.
• We use service providers (hosting, maps, media storage, email, translation, crash reporting) to run the app. Section 10 lists each one and what it receives.
• We do not sell your personal data, we do not share it for anyone else's advertising, and the app contains no advertising or analytics trackers.
• You can delete your account yourself, in the app.
• OpenOcean is not for children.

1. Your account

What we collect. Your email address and password (stored only as a secure hash by our authentication provider), a username, and whatever you choose to add to your profile: display name, avatar, banner, bio, home port, home country and city, whether you live aboard, skills, website and social links. If you create a crew profile, also the headline, availability dates, opportunity types, skills, sea miles, a stated location, and the ratings you receive. Your unit, map and notification preferences are stored with your account. Sign-in is by email and password only; we do not use Apple, Google or other social sign-in.

Why. To create and secure your account, show your profile to other users the way you set it up, and run the crew-finding features you use. Your email address is required to hold an account; everything else on your profile is optional.

Who sees it. Profiles are visible to other signed-in users. Crew-profile fields that identify you are shown to other users only in the redacted form the crew directory uses.

2. Location — read this section

Location data is what makes OpenOcean work, and it is also the most sensitive thing we hold. For many boaters a vessel's position is a home address. We treat four kinds of location differently.

2a. Your boat's position

Once you have an active boat and have granted location permission, your phone sends your boat's position to us — while the app is open, and, if you turn on voyage tracking or Anchor Watch, or your phone is the boat's tracking device (below), in the background too, including when the app is closed. Your operating system asks separately for background-location permission before that can happen. Positions our on-device classifier judges to be on land are not uploaded by automatic sharing at all (rivers and canals can read as land; placing your boat manually is always your own act).

The boat's tracking device. A boat can have one tracking device, chosen on the boat's Devices page: a crew member's phone, or a spare device left aboard. It reports the boat's position in the background, including when the app is closed. The boat's captain or any of its crew — never a guest — can make any crew member's phone the tracking device, including yours, without asking you first. Nothing starts on your phone until OpenOcean is open on it, and only if you have allowed background location. Your Devices page shows that your phone is the tracking device, and you or your crew can stop it there at any time.

The automatic backup. While a boat has a tracking device, every crew phone aboard — never a guest's, and never while you have paused your location for that boat — keeps a low-power location session running in the background, so that it can take over if the tracking device goes silent. On Android this shows an ongoing notification. Your phone checks in with us with its position, accuracy and battery level; positions our classifier judges to be on land are never sent. We use a check-in only to decide which phone is aboard and best placed to report the boat, keep only your phone's latest one, and delete it after 7 days; no other user ever sees it. If the tracking device has been silent for 10 minutes, the best phone aboard — closest to the boat, then on charge, then battery, then GPS — reports the boat's position in its place, including when the app is closed, until the tracking device returns. While it does, its position is the boat's position, with the boat's visibility settings. The boat's crew are told each time a phone takes over or hands back, and the Devices page shows which phone is covering.

Sharing is on by default, and the default visibility is public. That means: create a boat, grant location, and other users can see it on the map until you change the setting. You can change it at any time in Settings → Who Can See My Location ("Share My Live Location") and on the boat's visibility sheet.

What we store: the current position, heading and speed; a frozen snapshot of the last position when you lower the visibility; track history — the line of past positions; which device is currently publishing; and, for a transponder device, its battery level. Saved journeys and routes are kept until you delete them.

Who can see your boat depends on the visibility tier you choose:

• Public — every user sees the live position, and other users can view the boat's track for the last 48 hours.
• Whereabouts — others see only an approximate area: your coordinates are snapped to a 0.1° grid, about 11 km wide at the equator and narrower toward the poles — never a pin or a track.
• Subscribers / Hidden / Pirate mode — others see only the last position before you went quiet, marked "Last seen …", or nothing if there is no such snapshot. They cannot tell whether you are hidden, out of signal, or simply not sailing. That ambiguity is deliberate.
• Your active crew always see the live position and full track. You can also grant specific people precise access individually and revoke it at any time; grants do not pierce Hidden or Pirate mode.

Turning "Share My Live Location" off stops new positions from being written. The last position stays and reads as "Last seen …" rather than disappearing.

2b. Your own position while crewing

Separately from the boat, while you are an active crew member on a boat, that boat's captain and crew can see where you are on the crew map, so a crew can find each other. This works differently from the boat, and the differences matter:

• It is on by default for the crews you are on. The boat's Crew screen shows you a one-time notice explaining this and records that you saw it — but your crew may be able to see your position before you have opened that screen.
• Only that boat's captain and crew can see it. Guest-pass holders cannot. Someone demoted from crew to guest stops seeing it immediately. It is never public.
• You can pause it (3 hours, 24 hours, or until you switch it back on) or turn it off, for one boat or your whole account, at any moment, and your pin disappears. Pausing is private: nobody is notified and nobody can see that you paused. Nobody, including a captain, can override your choice or read your setting.
• We keep no history of it. Only your single latest position exists; it is replaced each time your phone reports, and a position older than 30 minutes stops being visible to anyone. (The last row itself is not erased when it goes stale; it is simply unreadable, and it is overwritten the next time you report or removed when you delete your account.)

The app also derives a coarse presence label — aboard / nearby / ashore — from your distance to the boat. It is computed on your phone and shares no coordinates, only the label, with your crew.

2c. Positions attached to things you do

Some features record a position as part of the act: a post can carry the place it was made and the weather conditions at the time (visible to whoever can see the post); a check-in records where you checked in (visible only to you); an SOS records where you were (see section 3); Anchor Watch records the anchor position and your latest fix while a watch is armed; weather watch areas store the centre and radius you chose; saved places and planned routes are yours.

2d. Where you look at the map

Loading map, chart, weather and vessel-traffic tiles necessarily tells the servers that deliver them which area of the map you are viewing. Base-map tiles and map search come from Mapbox directly from your device; nearby-place search sends the map centre and a radius to Google Places directly from your device; weather, AIS and place layers come from our own tile servers. See section 10.

3. Safety contacts and safety features

Buddy contacts. In the buddy system you can add external contacts — a name plus an email address and/or phone number of someone you choose. These people may not be OpenOcean users and have not agreed to anything with us; you are giving us their details, so make sure they are willing to receive safety messages about you. We store them and use them only to deliver your safety alerts: when you trigger an SOS, or a scheduled check-in is missed, we send each external contact a message containing your name, the type of emergency, any message you typed, your boat's name, the time, and your position with a map link (the link opens Google Maps). Today these alerts go by email. The app also contains a text-message (SMS) path; it is not switched on at the time of writing, and if we switch it on we will update this policy.

Emergency contacts. The Emergency Contacts list in the Safety Hub (name, relationship, phone, email) is stored so you can reach those people quickly from the app. It is not currently used to send automated alerts.

If someone has listed you as a contact and you want your details removed, email support@openoceanhub.com and we will remove them within 30 days. We do not use contacts' details for anything else, and we never market to them.

SOS. When you trigger an SOS, we store the alert (type, message, position, boat, time). While it is active it is visible to every signed-in OpenOcean user and broadcast live to other signed-in users, so that people close to you can respond. Afterwards only you can see it.

Anchor Watch and Lookout devices. While a watch is armed we store the anchor position, radius, your latest fix and accuracy, GPS status, breach count, and the battery level of the device running the watch. If a watch escalates, we email the boat's crew at their account addresses and, where push delivery is available, send push notifications.

Check-ins. We store your check-in schedules and each check-in with its position.

A plain-words caution that belongs here as much as in our Terms: these features depend on your phone, its GPS and battery, network coverage, background execution, and third-party message delivery — any of which can fail. They are aids. They are not a substitute for a proper watch, an EPIRB or DSC radio, or contacting the coastguard.

4. Your boat

Boat profiles (name, type, make, model, dimensions, MMSI, call sign, flag, home port, photos, description), maintenance logs, crew and guest-pass lists, invitations, courtesy-flag and clearance records, paired onboard devices, and boat documents you upload (PDF, GPX, KML). Documents can contain sensitive things — registration, insurance, identity papers — so upload only what you need to. They are stored in a private bucket and served only through short-lived signed links to you and your crew; we do not use their contents for anything else.

Deleting a boat is scheduled with a 24-hour notice to its crew and then carried out automatically.

5. Community content and private messages

Content you publish: posts (text, photos, videos, links, attached conditions), stories, comments, reactions, hashtags and @-mentions, reviews and photos of places and anchorages, contributed place information, event listings and RSVPs, berth listings, competition entries and votes, and your follows, subscriptions, blocks, saved posts and reports. Public content is visible to other users — that is what it is for. When you share a link, our server fetches that page once to build a preview (title, description, a downscaled image) and caches it for up to 30 days; the site you linked sees our server, not you.

Journeys and shared miles. If you are marked aboard when someone records a journey on your boat, you are credited on that journey (name, role) and its distance counts towards your own profile statistics. Journeys are private by default; their visibility is set by the person who recorded them.

Private messages. We store your conversations, who is in them, and their messages (text, photos, voice notes, shared posts and listings, reactions, edits) so we can deliver them to the participants and to no one else. Be clear-eyed about what that means:

• Messages are not end-to-end encrypted. They are protected in transit and by access rules, and we do not read them in the ordinary course of business, but they exist on our servers in a form we could technically access — for example when legally required, or to investigate abuse you report.
• Photos and voice notes in messages are stored with our media provider and delivered from our content delivery network at a long, unguessable address. That address is not protected by your login: anyone who has it can open the file. Do not send anything you could not afford to have forwarded.
• "Delete for me" hides a message from your copy only. Deleting a message marks it deleted for everyone; the file behind a photo or voice note is not removed from storage (section 6).
• Blocking someone stops direct messages between you.

Translation. When you translate a post, message, place review or weather warning in the app, its text is sent to Anthropic's Claude model to be translated (or, if that fails, to Google's Cloud Translation service) and the result is cached by us for about 90 days so the same text is not translated twice. Deciding whether a translate button is worth showing happens on your device; nothing is sent for that. If you switch on automatic translation in Settings, items in languages you have not listed are translated as they are shown.

Moderation. Contributions to places and anchorages are checked by rules and, for free-text fields, by Google's Gemini model, which records an advisory opinion — it never rejects or removes anything on its own. Some place edits by established contributors are applied immediately under those rules and can be corrected later by other users; everything else waits for a person to review it. Nothing is hidden or removed by automated means alone. Posts, comments and messages are moderated on report, by people: reports you file are stored (with a snapshot of a reported message, so it cannot be edited away) and reviewed by our staff, who can hide content and record the outcome. The author of hidden content can still see it.

6. Photos, video and voice notes

Media you attach to posts, places, stories, messages and your profile is uploaded through a short-lived signed link to our storage provider and delivered through a content delivery network (both in section 10). We process it to display it — resizing, thumbnails, and similar variants — and, if you use the built-in editor, we store the edited result you chose to post. We keep an upload log (path, size, kind, time) tied to your account to enforce fair-use limits on upload volume.

Removing content from the app removes it from what other users can see; the underlying file is not currently deleted from storage when you delete a post, message or photo (the one exception is that replacing your avatar deletes the old one). If you want files removed, email support@openoceanhub.com with the content or links concerned; we delete the files within 30 days. Copies already cached by our delivery network expire on their own cycle.

7. Your device

• Push tokens for the devices you sign in on, so we can send notifications. They are passed to Expo's push service with the content of each notification.
• Your phones. For each phone you sign in on, we store its platform (iOS or Android), its model (for example "iPhone 17" or "Pixel 9"), when it was last seen, a random identifier the app creates for it, and, where it reports one, its battery level. We do not store the name set on your phone. In the app a phone is called by its owner's first name and its model (for example "Even's iPhone 17") unless you or your crew rename it, and that name is stored. Your boat's captain and crew can see your phones — the name, model, platform, battery level and when each was last seen, next to your name and profile photo — on the boat's Devices page, so they can choose which one tracks the boat. A phone you have not used for 60 days drops off that list unless it is attached to the boat. Guest-pass holders see only the devices attached to the boat, such as its tracking device. Nobody else can see them.
• Update checks. The app checks Expo's update service for new JavaScript bundles when it starts; that request carries the platform, the app's runtime version and your IP address.
• Crash reports. If the app crashes or hits an error we caught, a report goes to Sentry: the stack trace, device model, operating-system and app versions, and a trail of recent in-app steps (screens and network calls with query strings removed). We have configured it not to record your identity or IP address, and we do not attach your account to it; a stack trace or a URL path can still contain an internal identifier for a piece of content. Reports are not sent from development builds in normal use.
• Onboard devices. If you pair a Lookout or transponder device, we store a pairing code, the name typed for it when it was paired, its model and platform, its battery level, when it was last seen, which crew member paired it (shown next to it on the Devices page), and — for a Lookout — a device account of its own (a signed-in device with no email).
• On your phone. The app keeps a local cache (recent posts, places, tiles, your settings and language preferences, drafts waiting to send while offline). It stays on the device and is removed when you uninstall.

8. Purchases and earned features

OpenOcean has no paid plan at the time of writing; nothing in the app takes a payment. Some features unlock through contributions ("Earned Premium"). To run that, we keep a ledger of qualifying acts (what you added or corrected, when, and whether it stood uncorrected for 30 days), your progress on each route, and which unlocks you have seen. If we introduce a paid plan, purchases will run through Apple or Google, and we will update this policy before we receive any subscription data.

9. Things we compute about you

We derive statistics and standing from your activity: journeys and distance sailed, places added, photos uploaded, countries visited, follower counts, reputation scores for you and your boat, badges, the Earned Premium routes above, and the crew presence label in section 2b. These are computed from data described in this policy; we do not buy data about you from anyone.

10. Service providers — who your data reaches

We do not sell your personal data, and we do not share it with anyone for their own advertising. The following providers process data on our behalf to run OpenOcean:

Each provider is bound to use the data only to provide its service to us.

Data that flows the other way. OpenOcean also receives data from third parties to show you the world: weather and ocean data from public meteorological and oceanographic services (ECMWF, DWD, NOAA, Copernicus Marine and others, listed at openoceanhub.com/attributions), vessel-traffic (AIS) data from shore-based receiver networks (the aisstream.io community network and Open Waters, which re-serves open government feeds from Norway and Finland, AISHub and volunteer receivers), and anchorage and place data from open datasets, community contributions and licensed data providers. Those sources do not receive your personal data from us.

If your own boat appears in the vessel-traffic layer. AIS is a public radio broadcast, but the MMSI of a private leisure craft can identify its owner, so we treat it as personal data. If that is your boat and you do not want it shown, email support@openoceanhub.com with the MMSI: we remove it from the layer and from anything we retain, and you can object at any time.

11. Legal bases, automated decisions and your rights

Where the law (such as the EU and UK GDPR) requires a legal basis for processing, ours are:

• Performing our contract with you — running your account and delivering the features you use: content, messaging, boat position sharing at the visibility you set, journeys, safety alerts you set up, contributions and earned features.
• Consent — where your operating system asks you for a permission (location, background location, notifications, photos, microphone), that permission is your consent for that use, and revoking it in your device settings revokes it here too. Adding buddy or emergency contacts is your act; you can remove them at any time.
• Legitimate interests — keeping the service secure, working and free of abuse (moderation, crash reporting, upload limits, rate limits, report evidence), and the crew-position sharing in section 2b, which is on by default with a one-time notice and an unconditional, immediate opt-out rather than an up-front consent screen. We chose that design because crews rely on finding each other; the balance we struck is that only your own crew can ever see you, no history is kept, the notice is shown on the Crew screen and recorded, and you can switch it off at any moment without anyone being told. You may object to processing based on legitimate interests.
• Legal obligations — where we must keep or disclose data because the law requires it.

Automated decisions. No decision with legal or similarly significant effects on you is made by automated means alone. Automated screening only assists the people who moderate.

Your rights. Depending on where you live, you may have rights to access, correct, export, delete or restrict the use of your data, to object to processing, to withdraw consent, and to complain to your data-protection authority (in Singapore, the Personal Data Protection Commission; in the EU/UK, your national authority). Most of these you can exercise directly in the app: your profile, visibility tiers, crew-location switches, contacts and account deletion are all self-service. For anything else, email support@openoceanhub.com from your account email address; we answer within one month.

Point of contact. For users, authorities and anyone with a legal notice about content: support@openoceanhub.com (a person reads it; it is not an automated inbox).

12. Where your data lives, and transfers

Our database is hosted in Singapore; uploaded media is stored in the European Union; our tile servers are in Germany; and several providers in section 10 operate in the United States. If you are in the EU, UK or elsewhere, this means your data is transferred internationally. Where transfer rules apply, we use providers that offer the safeguards those rules recognise, such as standard contractual clauses and data-processing agreements. Providers may also keep backup copies in other locations to protect against data loss; where they do, those copies are held under the same contracts and access controls as the live data.

13. How long we keep things

• Account, profile and content — for as long as your account exists.
• Your position while crewing — no history: only the latest position exists and is overwritten as you move (section 2b).
• Boat track history — a rolling 30-day window while the boat keeps reporting: each new position removes points older than 30 days. A boat that stops reporting keeps the trail it had (at most its last 30 days) until it reports again or is deleted.
• Saved journeys, routes and places — until you delete them.
• Private messages — until deleted by the participants or with the account.
• Safety records (SOS alerts, check-ins, anchor-watch sessions) — with your account.
• Buddy and emergency contacts — until you remove them, the person asks us to (section 3), or your account is deleted.
• Media files — files behind deleted content are not currently purged on deletion, and account deletion does not remove them either (sections 6 and 14); we delete them on request.
• Translation cache — about 90 days.
• Link previews — up to 30 days.
• Alert rate-limit records — days.
• Crash reports — retained by Sentry according to its plan retention (30 to 90 days).
• Server and delivery logs at our providers — short periods set by each provider.

When you delete your account, the data above is deleted or unlinked from you as described in the next section; residual copies in backups age out on the backup cycle.

14. Deleting your account

You can delete your account in the app (Settings), with no exit interview and no retention tricks. Here is exactly what happens:

• If you still own a boat that has other accepted crew, deletion is refused until you hand the boat to another captain or delete the boat (its crew get 24 hours' notice). This protects your crew, not us.
• Your messages and comments are kept but reassigned to an anonymous "deleted user" record, so other people's conversations do not lose their half.
• Everything else tied to your account — profile, preferences, boats you own and their positions and tracks, journeys, contacts, safety records, contributions ledger, reports you filed, devices and push tokens — is deleted with it. A few records are kept without your identity: places you created or claimed (they belong to the map now), guide sections you contributed, and moderation stamps.
• Your login is removed; you cannot sign back in.
• Media files you uploaded are not removed from storage by account deletion, and once the account is gone we can no longer tell which files were yours. If you want them removed, email support@openoceanhub.com before you delete the account; we delete them within 30 days, before the account. Copies cached by our delivery network expire on their own cycle, and copies in backups age out on the backup cycle.

If you cannot access the app, email support@openoceanhub.com from your account email and we will delete the account for you. This email path is also how to request deletion without reinstalling the app.

15. Children

OpenOcean is not directed at children, and its store listing carries a 17+ age rating. Do not use OpenOcean if you are under the age at which you can agree to these terms in your country without a parent's consent, and never if you are under 16. We do not knowingly collect personal data from children; if you believe a child has created an account, contact support@openoceanhub.com and we will delete it.

16. Security

Data is encrypted in transit. Database access is governed by per-row access rules, so that, for example, only a message's participants can read it, and your settings and check-ins are readable only by you — an SOS you trigger is the deliberate exception (section 3). No system is perfect — which is one more reason not to put anything in the app you cannot afford to have exist on a server.

17. This website and the launch list

This website, openoceanhub.com, is served by Cloudflare. Like any web host, it sees your IP address when your browser asks for a page. We set no cookies on the site and run no analytics or advertising trackers on it.

If you join the launch list, we keep three things: the email address you type, which page you joined from, and when. We use them for one purpose, to tell you when the app is out, and we do not share the list or use it for anything else. Our legal basis is your consent. The list is held in a Cloudflare database. We delete it within 30 days of sending the launch email. To come off it sooner, email support@openoceanhub.com and we remove you.

18. Contact

OPENOCEAN HUB PTE. LTD.
68 Circular Road, #02-01
Singapore 049422
support@openoceanhub.com

Questions, rights requests, removal requests from safety contacts, and anything this policy failed to make clear — that address reaches a person.