Privacy & Cookies

Mervare is operated by the site administrators reachable at kepsic@gmail.com. Email us for any data-protection request — access, rectification, erasure, portability or objection under GDPR Articles 15–22.

These are required to operate the site. Under the ePrivacy Directive (2002/58/EC, Art. 5(3)) they do not require your prior consent. They are HTTP-only, Secure and SameSite=Lax.

Stored in your browser's localStorage on this device. Never sent to our servers. Clearing your site data removes them.

For signed-in users: email address (login), display name, the boats you own or have access to, and any data you choose to publish on your boat page (photos, documents, guestbook entries, relay-scenario settings).

For boats with telemetry: position, wind, depth, battery and similar measurements transmitted by your on-board gateway. This data is associated with your boat slug and retained as a rolling history (typically 90 days for full-resolution samples, longer for daily aggregates).

For marina staff: the booking calendar, guest contacts and Stripe payout details you enter into the marina dashboard.

For harbour photos you choose to send for review (a pilot at one Estonian harbour): the photo, re-encoded so that all camera data including GPS location is removed before it is stored; the date it was taken; the harbour, view and credit you chose; the licence terms you accepted; and, only if you give it, an email address. A declined photo is deleted when it is decided, and you can withdraw your photo at any time from your private link. A published photo is shown with your chosen credit under CC BY 4.0.

For boats on the telemetry package, contributing depth soundings is on by default, as part of the service under our terms. While it is on we store, in a separate depth archive, the depth and position the boat's sounder reports while it is moving (above 1 knot), thinned to about one sounding every 10 seconds and 20 metres, with time rounded to 10 minutes and position to about 1 metre — including the boat's earlier underway soundings still in its telemetry history. The archive holds no boat name, MMSI, owner or email: each sounding carries only a pseudonymous key that we can link back to the boat and to the owner it was issued to with a secret held on our server, so that we can show you your own contribution and remove it on request.

We publish the soundings only aggregated into map cells, on the public community depth layer on mervare.io: at least 7 days after they were recorded, never as tracks or individual soundings, and never naming the boat. A cell can come from a single boat and soundings in a boat's home harbour are shown too, so someone who knows where a boat sails may recognise its routes as a corridor of cells. We do not send the soundings to anyone else or release them under an open licence.

You can turn it off at any time in the boat's Settings → Depth sounder, or in My Mervare → My depth contributions; from then on nothing new is stored and we do not turn it back on. You can also choose "Remove my past contributions", which deletes every archived sounding stored under your key for that boat and takes it off the public layer within about an hour. That removal is the only way soundings leave the archive: unlike the rolling telemetry history in section 4, the anonymised depth archive is never pruned. Soundings are raw and uncorrected and are not navigational data.

These run as separate data processors. Loading any map or payment view sends your IP address to the corresponding provider — that is unavoidable, the same way visiting any web page reveals your IP to the host.

• OpenStreetMap — base map tiles (privacy policy).
• EMODnet Bathymetry — depth raster tiles when the depth overlay is enabled (terms).
• OpenSeaMap — seamark overlay when enabled (imprint).
• Windy — embedded as an iframe only when you turn the wind overlay on (privacy policy).
• Stripe — payment processing during booking (privacy policy).
• Vercel — site hosting and CDN (privacy policy). We also run two Vercel measurement products. Neither sets a cookie or stores anything on your device, and neither is used for advertising or shared with an ad network.
• Vercel Speed Insights — how fast pages load. Per page load it reports the route and URL, the Core Web Vitals timings, your browser, device type and operating system, your connection class (e.g. 4g) and your country. It attaches no visitor identifier at all (what it collects).
• Vercel Web Analytics — how many people read which pages. Per page view it reports the URL and route, the referring site, filtered query parameters, your browser, device and operating system, and your approximate location from your IP address (country, region and city — the IP itself is not stored). To count returning visitors it uses a hash Vercel derives from your request rather than a cookie; that hash is discarded after 24 hours and does not work across other websites (what it collects). It is an identifier, which is why we say "no cross-site tracking" rather than "no tracking".
• What we strip before either one sees it. Private links are redacted in your browser before anything is sent: the token in a boat-share, passage or crane-day link (/p/…), a door link and its guest token (/d/…), and every query parameter that is not on a short allow-list (language, country, campaign). Questionnaire pages under /kysitlus/ send no analytics event at all, so answering a survey stays anonymous, and operator pages under /admin/ send none either.
• Clicks to a harbour operator's own website. On a harbour page that names its operator, following the official harbour website, booking or operator link adds one to a daily count on our own server: the harbour, which link, the page language and site, and your country as our hosting provider derives it from the request. Nothing else — no IP address, no identifier, no cookie — and the counts are kept for about 13 months.
• Supabase — primary database for accounts, marinas and bookings (EU region).
• Google — only if you choose Sign in with Google; we receive your name, email and avatar URL.

Under GDPR you may request access to, correction of or deletion of your data, restrict or object to processing, and receive a machine-readable export. Email kepsic@gmail.com — we respond within 30 days. You also have the right to lodge a complaint with the data-protection supervisory authority of your country (for example Andmekaitse Inspektsioon in Estonia, CNPD in Portugal or IMY in Sweden).

If we add anything that needs explicit consent (behavioural analytics, advertising, anything stored on your device or tied to an identifier) we will replace the informational notice with a proper accept / reject prompt before the new tracker runs, and bump the date at the top of this page.