Privacy

Boat Budget, by Marc Robitaille. Last updated 22 October 2026.

What stays on the phone

Everything you enter - expenses, receipts, the logbook, the track, budgets, people, checklists - is stored on the phone, and on the other phones of the boat when you sync. Sync happens directly between the phones, over Wi-Fi, a VPN or Bluetooth, encrypted with the boat's key; no server of ours takes part and none holds a copy. A backup is a file you keep where you like.

What leaves the phone, and when

• Updates. On Android, now and then (at most every fifteen minutes) the app reads a small file on our server to learn whether a newer build is published. The request carries nothing about you.
• Exchange rates. When online, the app fetches public reference rates (Frankfurter, the European Central Bank's rates; fawazahmed0 currency-api).
• Maps. The maps load tiles from OpenFreeMap and OpenSeaMap as a web map would; those services see the request as any web server does. Tiles are cached on the phone.
• Family map. Only while you have it switched on, the boat's phones post the boat's position, speed and heading, its status (anchored or under way, the last anchorage), its name and its track to our server, every five minutes when online, so the page you share shows them. The page is protected by the password you set; family who gave it keep a cookie for thirty days. Switching the map off stops the posting; "Reset the track" removes the positions from the server. Each post also carries the phone's report of itself (see Premium).
• Premium. The app asks our server for the boat's licence once a day and when you open the Premium screen, sending the boat's page id (a hash of the boat id), a hash of the boat key, the boat's name and the phone's report of itself: a short id of the phone, the app's build number, the platform, the app's language, whether Premium is active, and counts of what the app holds (how many expenses, incomes, receipt photos, log entries, logbook days, track points, voyages, people and cards, and the number of months with expenses). The family map's posts carry the same report. Counts only: never an entry, an amount, a place or a person's name. That tells us how many phones a licensed boat has and how the app is used, and nothing about the people, the places or the money.
• Gift links. A gift link (boatbudget.site/track/gift/…) opens a page that shows the gift code; opening Boat Budget from it, or typing the code, sends the code with the boat's page id and name to our server, which checks that the gift was made for that boat.
• Payments. Boat Budget Premium is sold by Paddle.com, our reseller and merchant of record. Paddle collects the payment details and the email address for the receipt under its own privacy policy. We receive the transaction id, the email address used and the boat's page id, and keep them for as long as the purchase can be claimed, renewed or refunded, and as long as accounting law requires.
• Family messages. Messages written between the boat and the family page are kept on our server so both sides see them: the last 50 per boat, older ones are deleted. A message from the family page is stored with the writer's IP address, to stop abuse.
• Contact form. What you send through Get in touch (your name, your email address, the message and your IP address) is kept so we can answer, for one year.

How long our server keeps it

Deleted automatically, every day:

• The family map's positions: until you reset the track, and at the latest one year after the boat last posted.
• Family messages: the last 50 per boat; the writer's IP address after 90 days.
• Each phone's report (see Premium): only the latest one per phone, deleted one year after the phone last checked in.
• The log of licence checks and gift codes: IP addresses after 90 days, the entries after two years. Purchases, refunds and licences stay as the record that accounting law requires.
• Contact-form messages: one year.
• The web server's access logs (address, time, page): fourteen days.
• Purchase records: as long as the purchase can be claimed, renewed or refunded, and as long as accounting law requires.

Our server is a rented machine at Linode (Akamai). The services named above (Paddle for payments; OpenFreeMap, OpenSeaMap and the rate providers for public data) receive only what is described here, and handle it under their own privacy policies.

What we do not do

No third-party analytics, no advertising, no tracking across apps or websites, no account to create. The only usage figures are the counts in each phone's report, described above. We do not sell, rent or share what we hold.

Your rights

Write to us (Get in touch) to see, correct or delete what our server holds about your boat or about you: the family map data (which the app can also remove: Reset the track), the family messages, the phones' reports, the log, and your contact messages. We answer within 30 days. The purchase record is kept while accounting law requires it. Switching the family map off, or stopping to use the app, stops anything new from reaching us. Where the law of your country gives you further rights, they apply.