Privacy Policy — YSS (Your Sailing Stats)

Version: 6.0 · Published: 26 Oct 2026

Effective date: October 26, 2026 Last updated: October 26, 2026

This Privacy Policy explains how DEEPSPACEOTTERS LLC ("YSS", "we", "us") collects, uses, shares, and protects personal data when you use the YSS sailing/GPS analytics service — the mobile app, website, and backend API (together, the "Service") available at https://your-sailing-stats.net.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), DEEPSPACEOTTERS LLC is the data controller for the personal data described here. Because we are established outside the EU and the UK, we have appointed representatives there under Article 27 of the GDPR and the UK GDPR — see Section 14.

---

1. Summary

• YSS analyzes GPS activity tracks (sailing, windsurfing, and similar). To do this we process precise location data, a sensitive category that receives special treatment (see Section 9).
• We do not keep the file you upload, and we keep heart rate only if you consent. An upload is read when it arrives and then discarded; only the track points inside it are stored. Heart-rate samples are thrown away during processing unless you have given your consent for the way that track reached us — and you can withdraw it at any time (see Section 2.4). If you export your data, we build you a standard GPX file from the track points we hold.
• You control who can see each track — public, friends-only, or private. Tracks you mark public are listed in a feed that anyone can browse without an account, together with an approximate location. You can also create a share link that lets whoever holds it view a single track — regardless of that track's privacy setting — and you can revoke it at any time (see Section 4 and Section 8).
• We use a small set of service providers ("sub-processors") to run the Service (hosting, content delivery, email, sign-in). We describe them in Section 4.
• We do not sell your personal data, and we do not use it for third-party advertising.
• You can delete individual tracks yourself at any time, and you can request deletion of your account and associated data by contacting us (see Section 6 and Section 8).
• You can download a copy of everything we hold about you from the app at any time; we email you a private link to the archive, which stays available for 5 days (see Section 8).

---

2. Personal data we collect

2.1 Account and profile data

• Email address (used to sign in, verify your account, and send transactional messages).
• Display name and, optionally, an avatar image.
• Preferences and settings — measurement units (e.g. knots / km/h), appearance settings, and your default track-privacy preference.
• Subscription tier (currently free for all users), used to apply the correct usage/rate limits. We do not currently collect or process any payment or billing information; if we introduce paid plans, we will update this Policy before doing so.
• Account timestamps — when your account was created and last active.

2.2 Authentication and device/session data

• Password — if you register with a password, we store only a cryptographic hash of it, never the plaintext.
• Third-party sign-in identifiers — if you sign in with Google, we receive and store basic profile information from Google (your email, name, and profile-picture URL) to create and identify your account, together with the access token Google issues for that sign-in. (Other social sign-in providers may be offered in the future.)
• Session tokens — we issue short-lived access tokens and longer-lived refresh tokens so you stay signed in. For refresh tokens we store a one-way hash of the token, an expiry, and, where available, your client's user-agent (device/browser identifier).
• Guest sessions — you can browse public content without creating an account. We then issue a temporary token holding a randomly generated identifier that is not linked to you or to any account and is not stored in our database. It exists only to apply request limits, and it expires automatically (by default after 24 hours); requesting another one produces a new, unrelated identifier.
• Verification codes — short-lived one-time codes generated for email confirmation and password reset.

2.3 Location and activity data (sensitive)

When you upload or record an activity, we process:

• Precise GPS location data — the route's coordinates over time (latitude/longitude), start/finish times, and derived geometry (e.g. a bounding box of the track).
• Performance data — speed, distance, duration, and tactical metrics (e.g. tacks/jibes).
• A place label (e.g. the venue name) and any description and tags you add.
• Wind direction for the track — estimated by our servers from the track itself, or entered by you.

2.4 Health data (heart rate) - only with your consent

Activity files often include heart-rate measurements, because the devices that record them write heart rate into the same file as the track.

We keep heart rate only with your explicit consent, which you give — or refuse — separately for each way a track reaches us:

• uploading an activity file from the app;
• each connected service (currently Polar) — one consent per service;
• syncing workouts from Apple Health or Health Connect.

The screen for each of these shows whether you have consented, and the date and time you gave or withdrew that consent. We keep a record of every time you give or withdraw it; that record is part of your data export.

Without consent, or after you withdraw it, heart rate is discarded. Where the app reads the file itself, it removes heart rate before sending anything; in every case our servers remove it again before anything is stored, so a track imported without consent holds no heart rate in any form.

Connected services send us every activity with its heart rate included, so connecting one requires your consent for that service. If you withdraw it, the connection stays, but no activities are imported from it until you consent again. In the settings of each connection you can additionally choose whether heart rate from it is kept; it is off unless you turn it on.

What happens to heart rate we keep, with your consent:

• It is stored as part of the track, encrypted like the rest of the track, and it is included in the archive you get if you export your data.
• Only you can see it. It is sealed inside the track with a separate key that we give only to you, so it is not shown to your friends, to members of groups you post the track to, to anyone holding a share link, or on the public feed — whatever the track's privacy setting.
• Tracks processed before September 30, 2026: heart rate kept with such a track was stored without this separate key, so it remains visible to everyone who can see that track until the track is edited or reprocessed. You can remove it at any time by deleting the track.
• We do not use it for advertising and do not share it with third parties.

Withdrawing consent stops heart rate being kept from the next import onwards. Heart rate already stored with a track under your earlier consent stays with that track until you delete the track or your account.

See Section 9.

2.5 Uploaded files — we do not keep the file itself

• When you upload an activity file (e.g. GPX or FIT), we read it, extract the track it contains, and discard the file. The file you sent is not retained. We keep the track points — position, elevation and time — together with the file's name and size, which is what identifies the upload in your history.
• If you export your data, we rebuild a standard GPX file from those track points for you. It is not a copy of your upload: it holds the positions, elevations and timestamps, and it does not hold heart rate or values that only existed inside the original file, such as a speed your device measured by Doppler. Heart rate we keep with your consent is in the export too, in the track records next to the GPX files.
• Files uploaded before this change are still stored and are still returned to you in full if you export your data. They are deleted with the track they belong to.

2.6 Social and community data

• Connections — friends, friend requests, and follows.
• Groups — groups you create or join, including a group's optional location, group membership and roles, invitations, and blocks.
• Content you post — posts that share your tracks in a group and comments you write.
• Reports and moderation — when you report content we record your report (the reason and any comment you add) together with a copy of the reported content as it was at that moment, including a copy of a reported picture. When a moderator decides on your content we record the decision, any warning or temporary restriction, and the notice we send you. We never tell a reported user who reported them.

2.7 Derived and aggregate data

• Aggregates, statistics, histograms, and polar diagrams computed from your activities.
• Leaderboard entries — your ranked performance within groups.
• Categories and tags you define.

2.8 Technical and usage data

• IP address — for anonymous (signed-out) requests we read the client IP (from X-Real-IP / X-Forwarded-For headers) solely to apply rate limits. These IP values are used for in-memory/short-lived counters and are not written to durable logs by the Service.
• Operational telemetry — request metrics and traces used to keep the Service reliable; these may include an account identifier for diagnostics.

---

3. How we use personal data and our legal bases

We use personal data for the following purposes. Where GDPR applies, the corresponding legal basis is shown.

We do not use your personal data for third-party advertising or profiling that produces legal or similarly significant effects.

---

4. How we share personal data

4.1 With other users — according to your settings

Your tracks are shared with other people only as you direct:

• Track privacy: Public (anyone), Friends (your friends only), or Private (only you). You set a default and can change it per track.
• Public discovery feed: tracks you mark Public are listed in a feed that can be browsed without an account. An entry shows the track's statistics (distance, speeds, duration, date), its description, a place name, an approximate location — the centre point of the area the track covers — and your display name and profile picture. Opening a track from that feed additionally shows its category and tags and gives access to the full GPS route. Changing a track to Friends or Private removes it from this feed.
• Share links: you can create a link to an individual track. Anyone who has the link can view that track without an account — its statistics, description, tags and full GPS route, plus your display name and profile picture. A share link works regardless of the track's privacy setting: a link to a Private track makes that track viewable by whoever holds the link. The link contains a long random secret and cannot be guessed, but it is not otherwise restricted — treat it like a password and give it only to people you intend to have access. You can revoke a link at any time, which immediately stops every copy of it from working.
• Groups: if you post a track to a group, it is visible to the members of that group according to its visibility rules.

4.2 With service providers (sub-processors)

We use the following providers to operate the Service. Each processes personal data only on our instructions and only to provide services to us, under a data processing agreement meeting the requirements of Article 28 GDPR.

Google Sign-In (Google Ireland Limited, Ireland, for users in the EEA/UK and Switzerland; Google LLC, USA, elsewhere) is not a sub-processor: if you choose to sign in with Google, Google acts as an independent controller under its own privacy policy, and we receive from it the profile data you authorize (email, name, profile-picture URL) plus the sign-in access token.

The following run on our own servers at the hosting provider above and involve no further third party:

• Rate-limit store (Redis) — short-lived request counters, keyed by account identifier or IP.
• Monitoring (OpenTelemetry → VictoriaMetrics / VictoriaLogs / VictoriaTraces) — operational metrics, logs, and traces; may include an account identifier.

We use no third-party product-analytics, advertising, or crash-reporting SDKs. We will update this list before adding a new sub-processor.

4.3 Legal and safety disclosures

We may disclose personal data if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and security of our users, the public, or the Service.

4.4 Business transfers

If we are involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction; we will notify you and honor the commitments in this Policy.

4.5 No sale of personal data

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws (e.g. CCPA/CPRA).

---

5. International data transfers

Where your data is stored. Everything the Service stores is held in the European Union:

• our servers and database — Hetzner, Falkenstein, Germany;
• track files and transactional email — Amazon Web Services, eu-west-1 region, Ireland.

When personal data is processed outside the EEA/UK, it is in the following cases only, each with the safeguard shown:

• Content delivery. Track files and data-export archives are delivered through Amazon CloudFront, which serves each request from the edge location nearest to the person making it — which may be outside the EEA/UK — and may cache the file there for a short time. Track files are encrypted, so an edge location holds only unreadable bytes; a data-export archive is protected by its private, time-limited link. Safeguard: the European Commission's Standard Contractual Clauses (and the UK Addendum) incorporated in the AWS Data Processing Addendum; Amazon Web Services, Inc. is also certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions).
• Google Sign-In, if you choose to use it. Google LLC (USA) receives your sign-in as an independent controller and is certified under the EU-U.S. Data Privacy Framework.
• Our own access. DEEPSPACEOTTERS LLC is established in the Republic of Armenia, which the European Commission has not recognised as providing an adequate level of data protection. Our team accesses personal data from Armenia to operate and support the Service. The GDPR applies to us directly (Article 3(2)) because we offer the Service to people in the EEA/UK, and we apply its protections and the measures in Section 7 to that access.

Details and a copy of the safeguards are available on request at support@your-sailing-stats.net.

---

6. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it.

Deletion mechanisms.

• Deleting a track: when you delete a track, we remove its database record and the associated stored files — the processed track object, the track points behind it, and, for an upload made before we stopped keeping originals, that file too.
• Account deletion: account deletion is currently performed by us on your request (see Section 8). It cascades across the database, removing your owned data — tracks, uploaded files, categories, aggregates, friend connections, and group memberships. Residual copies in backups or content-delivery caches may persist for a limited period before they expire or are overwritten.

---

7. How we protect personal data

We use technical and organizational measures appropriate to the sensitivity of the data, including:

• Encryption in transit (TLS) for connections to the Service, terminated at our ingress/CDN edge.
• Password protection: passwords are stored only as cryptographic hashes (Argon2id); refresh tokens and email/reset codes are stored only as one-way hashes.
• Stored data (processed track files and the application database) is protected by the access controls below and by infrastructure-level encryption provided by our hosting and object-storage providers, rather than application-level encryption.
• Access controls: track access is enforced by ownership, friendship, and group membership checks; stored track files are delivered only through time-limited signed URLs.
• Abuse controls: rate limiting on sensitive operations.

No method of transmission or storage is completely secure; we cannot guarantee absolute security.

---

8. Your choices and rights

8.1 In-product controls

• Set your default track privacy and change per-track privacy (public / friends / private).
• Create and revoke share links for individual tracks. Revoking a link immediately stops it working for everyone you sent it to.
• Manage friends and group membership.
• Give or withdraw consent to keep heart rate, separately for uploads, each connected service and health-app sync — on the screen where you use each of them.
• Delete individual tracks you have uploaded.
• Download a copy of your data — request an export from the app; we build an archive of everything we hold about you and email you a private download link (see Section 8.2).
• Update your profile and preferences, or sign out of all sessions.
• Request account deletion by contacting us (see Section 6).

8.2 Your legal rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and obtain a copy (portability). You can exercise this yourself: request a data export in the app and we will email you a link to a ZIP archive containing your account and profile data (including your profile picture, if you uploaded one), all of your tracks and their metadata (including distance, top speeds, start and finish times and wind), your original uploaded activity files, and your social and group activity (including the avatar and cover image of any group you own). The archive includes a README.txt and a manifest.json explaining every file and listing anything that could not be included, and why. The derived analytics we compute from your activities — speed and maneuver histograms and the category aggregates shown in the app — are held in an internal binary format with no portable equivalent and are not included; they are recalculated from the original activity files, which the archive contains in full. For security, the archive deliberately excludes credentials (password hash, session tokens, verification codes, encryption keys, third-party access tokens); other people appear only by display name, as Article 15(4) requires.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") — including account deletion described in Section 6.
• Object to or restrict certain processing.
• Withdraw consent at any time where processing is based on consent (this does not affect prior processing).
• Lodge a complaint with your data protection authority.

For residents of California and similar U.S. states (CCPA/CPRA): you have the right to know, access, delete, and correct your personal information, to opt out of any "sale"/"sharing" (we do neither), and to non-discrimination for exercising your rights. You may exercise these rights, including via an authorized agent, using the contact below.

8.3 How to exercise your rights

For access and portability, use Download a copy of your data in the app — that is the fastest route and needs no correspondence. For anything else, use the other in-product controls where available, or contact us at support@your-sailing-stats.net. We may need to verify your identity before acting. We respond within the timeframes required by applicable law.

If you are in the EU/EEA or the UK, you may also submit an access, deletion or other GDPR request through our Article 27 representative's secure portal — see Section 14.

---

9. Sensitive data

The Service processes one category of sensitive data:

• Precise geolocation — the routes and positions in your activities. This one is unavoidable: a GPS track is the thing the Service exists to analyze.

We process it only with your explicit consent, given when you create an account and upload or record activities, and/or through a clear in-product consent where required. You can withdraw consent by deleting the relevant activities or your account.

Health data — only with your explicit consent. Heart-rate measurements are a special category of personal data (GDPR Art. 9). We store them only on the basis of your explicit consent (Art. 9(2)(a)), asked for separately for each way tracks reach us, and never as a condition of using the Service — except that a connected service cannot be connected without it, because that service sends heart rate with every activity. Without consent, heart rate is discarded before anything is stored. You can withdraw consent at any time on the same screen where you gave it; withdrawal does not affect heart rate already stored under your earlier consent, which you can remove by deleting the tracks concerned. See Section 2.4 for the details.

---

10. Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact support@your-sailing-stats.net and we will delete it.

---

11. Cookies, local storage, and tokens

The YSS app and API authenticate you using access and refresh tokens (stored on your device), or, if you are browsing without an account, a temporary guest token carrying only a random identifier (see Section 2.2), not third-party tracking cookies. The web-based administration panel uses a session cookie that is strictly necessary to keep an administrator signed in. We do not use advertising or cross-site tracking cookies.

---

12. Automated processing

We apply algorithmic processing to your tracks (e.g. filtering GPS noise, computing speeds, detecting maneuvers, and building statistics). This is analytics on your own data to produce the results you request. We do not make automated decisions that produce legal or similarly significant effects about you, and we do not perform behavioral profiling for such decisions. Moderation decisions about reported content are made by a person, not automatically.

---

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Effective date" and, for material changes, provide additional notice as required by law. Your continued use of the Service after an update means you accept the revised Policy.

---

14. Contact us

Questions or requests regarding this Policy or your personal data:

• DEEPSPACEOTTERS LLC
• 3 H. Hakobyan St., Yerevan 0033, Republic of Armenia
• Registration no.: 999.110.1611980
• TIN: 08334744
• Email: info@deepspaceotters.com

EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative:

• Euverify Limited (Ireland)
• Unit 3D North Point House
• North Point Business Park
• New Mallow Road
• Cork
• T23 AT2P
• Ireland
• Email: gdpr@euverify.com

UK Representative:

• Euverify Ltd (UK)
• 3rd Floor
• 86-90 Paul Street
• London
• EC2A 4NE
• United Kingdom
• Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

If you are in the EEA/UK and believe we have not addressed your concern, you may lodge a complaint with your local supervisory authority. This Policy is governed by the laws of the Republic of Armenia.