Privacy Policy

1. Scope

This policy explains how ShipWatch handles personal data when you use shipwatchapp.com. It applies to visitors and account holders worldwide, and is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK, Law No. 6698).

ShipWatch is the controller of the personal data described below. Contact: shipwatchapp@gmail.com.

2. Vessel data is not personal data about you

Ship positions, voyages, ownership and inspection records displayed in the Service concern vessels and companies, not you. They are not collected from you and are not linked to your account. Where a company record contains a business contact detail supplied by a maritime register, it is processed on the basis of our legitimate interest in operating a maritime information service; any individual named in such a record may contact us to request correction or removal.

3. What we collect

• Account data — email address, and where you sign in with Google, the name and profile identifier Google returns. Passwords are never stored by us in readable form.
• Sign-in records — date, time, sign-in method and browser type for each session, kept as a security and abuse-prevention record.
• Content you create — watchlists, saved vessels, uploaded vessel photographs and captions, and company listing submissions including any logo, address, website and contact details you provide.
• Legal acceptance records — the version of the Terms you accepted and when, retained as evidence of consent.
• Technical data — IP address and request metadata processed transiently by our hosting provider for delivery, security and abuse prevention.
• Assistant messages — questions you type into the ShipWatch Assistant are processed to answer them. Do not enter confidential or personal information into the Assistant.

We do not use advertising trackers, do not build advertising profiles and do not sell personal data.

4. Why we process it and on what basis

• To provide the Service (account access, watchlists, listings) — performance of a contract with you.
• To keep the Service secure (sign-in records, abuse prevention, rate limiting) — our legitimate interests.
• To review submitted listings and photographs before publication — our legitimate interests in accuracy and in protecting third-party rights.
• To evidence acceptance of our Terms — our legitimate interests and compliance with legal obligations.
• To comply with law — legal obligation.

5. Processors and international transfers

We use a small number of service providers who process data on our behalf under contract:

• Supabase — authentication, database and file storage.
• Vercel — application hosting and content delivery.
• Google — optional sign-in, where you choose to use it.
• Datalastic — maritime data supplier. We send vessel and port identifiers to this provider; we do not send your personal data.

These providers may process data outside your country, including in the United States. Where personal data is transferred out of the European Economic Area or Türkiye, the transfer is made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the provider.

6. Cookies and local storage

We use only what the Service needs to work: a session cookie to keep you signed in, and browser local storage to remember your acceptance of the Terms and your map preferences. We do not set advertising or cross-site tracking cookies, so no consent banner beyond the Terms acceptance is required.

7. Retention

• Account data — until you delete your account.
• Sign-in records — 12 months.
• Watchlists and submitted content — until you delete them or delete your account.
• Legal acceptance records — for the duration of the account and five years afterwards, as evidence.
• Published company listings — until withdrawn by you or removed by us.

8. Your rights

Subject to applicable law, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. Under KVKK you also have the right to learn whether your data is processed and to request that any resulting adverse outcome be reviewed.

To exercise any right, write to shipwatchapp@gmail.com. We respond within 30 days. You may also complain to your local supervisory authority, or in Türkiye to the Personal Data Protection Authority (KVKK).

9. Children

The Service is intended for professional and general adult use. It is not directed at children and we do not knowingly collect data from anyone under 16.

10. Changes

We may update this policy. Material changes will be published here with a new version number and, where required, we will ask you to review them before you continue. See also our Terms of Use & Data Disclaimer.