What we collect, and what we do with it.

This Privacy Policy explains how BoatDay Group LLC ("BoatDay," "we," "us") collects, uses and shares information when you use the BoatDay website and app (the "Platform").

Account information: name, email, and password (handled by our authentication provider; we never see or store your plaintext password), plus anything optional you choose to add: profile photo, a short bio, and phone number. We also store your marketing email preference and, if you opted in, when you did.

Booking information: trips you book or list, dates, guest counts, and messages exchanged with the other party through the Platform.

Payment information: card details are collected and processed directly by Stripe, our payment processor; BoatDay's own systems never receive or store your full card number or security code. What we do store is limited to what Stripe returns to us: the card's brand, last 4 digits, expiration date, and Stripe's own reference token for the payment method, used to charge or refund it. Stripe also receives your name and each trip's amount in order to process charges, refunds and payouts.

Location: if you allow it, your device's location, used to autofill an address or show boats near you. You can decline this and enter a location manually instead. Address autocomplete and reverse lookup are powered by the Komoot Photon and OpenStreetMap Nominatim services, which receive the address text (and, for "use my location," the coordinates) you're searching.

Usage information: standard technical data like IP address, browser type and pages visited, collected automatically the way any website collects it.

Product analytics: we record a small set of actions taken on the Platform so we know where to add boats and what is not working: searches (the place and category searched, and how many results came back), which listings are viewed, and when someone starts a checkout. These are tied to a random session identifier that is stored only for the current browser tab and is erased when you close it, plus your account id if you are signed in. We do not record your IP address, browser, device or referring site alongside these events, we do not use them to build an advertising or personalization profile about you, and they are never shared with anyone outside BoatDay.

• To operate the Platform: create your account, process bookings, and connect Guests and Captains.
• To verify Captains before they're allowed to list a boat (see our Trust & Safety page for what that review covers).
• To communicate with you about your account, a booking, or support request.
• Only if you opt in, to send occasional marketing email about new captains, seasonal trips and offers. You can withdraw that at any time from Account settings or with the unsubscribe link in any such email.
• To keep the Platform safe: investigating reports, preventing fraud, and enforcing our Terms of Service.

We share your information only in these situations:

• The other party to a booking. A Guest and Captain can see each other's name, profile photo, and the messages related to their trip. Neither can see the other's email address or phone number through the Platform.
• Service providers who process data only to run the Platform on our behalf, under contract, and only for that purpose: Supabase for our database, authentication and file storage; Stripe for payment processing and captain payouts; Resend for transactional email and, for those who have opted in, marketing email; Twilio for phone verification; Komoot Photon and OpenStreetMap Nominatim for turning an address into map coordinates; Cloudflare for content delivery and security; and Google Fonts, which serves the typefaces used on the site and therefore receives your IP address when a page loads.
• Legal process and safety. When we are legally required to, or when we believe in good faith it is necessary to protect the safety of a user or the public, or to investigate fraud or a violation of our Terms.
• A business transfer. If BoatDay is ever involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction. We would notify you first, and any acquirer would remain bound by this policy for information collected under it.

BoatDay uses browser storage for two things. Your login session is stored in your browser's local storage so you stay signed in between visits and page loads, and Cloudflare, which delivers and protects the site, sets its own security cookies (such as __cf_bm) to distinguish real visitors from bots and to defend against abuse.

Your browser also holds a random session identifier used for the product analytics described in section 2. It lives only for the current tab, is erased when you close it, and cannot be used to recognise you on a later visit or on another device.

We do not use third-party analytics, advertising trackers, session-recording tools, or social media pixels. There is no cross-site tracking on BoatDay, and nothing we record is sent to any advertising or analytics company.

You can review and update most of your account information any time from your account settings. You can delete your account by contacting us. Note that we may need to retain some records (e.g. booking/payment history) as required by law or for legitimate business purposes like fraud prevention. Marketing email is off unless you turn it on, and you can turn it off again in Account settings or with the unsubscribe link in any such email.

We keep your information only as long as we need it:

• Account information: for as long as your account is active, and up to 12 months after you delete it, so we can handle disputes and prevent abuse.
• Booking and trip records: 7 years, because they are financial records we are required to retain for tax and accounting purposes.
• Payment records: retained by Stripe under its own retention schedule. BoatDay itself stores only the card brand, last four digits, and expiration date.
• Messages between Guests and Captains: for as long as both accounts are active, and up to 12 months after either is deleted, so we can investigate reports about a past trip.
• Verification documents (ID, registration, insurance): for as long as the Captain is listed, and up to 12 months after their last listing is removed.
• Product analytics events: 12 months, after which they are deleted automatically.
• Anything we are required to keep longer by law, or must preserve for an active legal claim or investigation, is kept until that obligation ends.

BoatDay is not intended for anyone under 18, and you must be at least 18 to create an account. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us at contact@boatdayus.com and we will delete it.

Wherever you live, you can ask us to:

• Access the personal information we hold about you and get a copy of it.
• Correct anything inaccurate. Most of it you can edit yourself in Account settings.
• Delete your account and the information associated with it, subject to the retention periods above and anything we are legally required to keep.
• Object to or restrict certain processing.

To make a request, email contact@boatdayus.com from the address on your account. We will respond within 45 days. We will never charge you, deny you service, or give you a worse price or experience for exercising any of these rights.

If you are a California resident, the California Consumer Privacy Act gives you the rights above, plus the right to know the categories of personal information we collect, the purposes we collect them for, and the categories of third parties we disclose them to, all of which are set out in this policy. Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing for you to opt out of, but you may still submit any of the requests above.

We protect your information with encryption in transit, access controls that restrict data to the accounts entitled to see it, and row-level database security. Payment card details never touch BoatDay's own systems. Stripe collects them directly. No system is perfectly secure, and we cannot guarantee absolute security, but if a breach ever affects your personal information we will notify you as required by law.

We may update this policy from time to time. If we make a material change, we'll update the "Last updated" date above and, where required by law, notify you directly.

Questions about this policy? Reach us at contact@boatdayus.com.