Privacy

Places you save ("pins")

A pin is a latitude, a longitude, a radius and a name you choose — "Deck", "Mom's dock". It is stored so the next-ship times, tide, wind and weather can be worked out for that spot, and so a Bell can ring when a ship is headed past it. If you tap Use my location, the app reads your position once to move the map marker; you can drag it anywhere before saving, and the coordinate that is saved is wherever the marker ends up. Nothing is recorded until you save a pin, and deleting the pin deletes the coordinate.

A device identifier

On first launch the app is issued a random device key. It is a random number, not derived from your hardware and not shared with anyone. It exists so your pins and Bells belong to your phone before you have created an account, and so the app works with no account at all. It is stored on your device in the system keychain.

Push notification token, if you turn on Bells

Turning on Bells registers an Apple Push Notification service (APNs) device token for your phone and stores it against your device key, together with your time zone so quiet hours land at the right hour of your night. It is used only to deliver the alerts you turned on. Alerts are sent to Apple directly. Turning Bells off, or deleting the app, ends this.

Purchase data, if you subscribe to Pro

Buying Pro in the app sends us Apple's own transaction identifiers, the product you bought (Bells, Supporter or Patron), its status (active, in a billing grace period, cancelled, expired) and its expiry date, linked to your account or device key. That is what unlocks Pro and keeps it unlocked while the subscription is active. Apple handles the purchase itself — no card or payment details ever reach us. Deleting your Ship O'Clock account unlinks this record from you but does not cancel the Apple subscription; cancel that separately in your Apple ID settings.

Basic app facts

Platform and app version, so a bug can be traced to a release. Nothing about your hardware model, and no advertising or vendor identifier.

An account, only if you make one

An account is optional. Almost everything — the map, pins, the times, Bells and the widgets — works without one. Signing up stores a handle you choose and a password that is stored only as a salted hash, never as text. A Ship O'Clock account is its own account: it is not shared with, and does not sign in to, any other app.

Feedback you choose to send

The form on the support page stores the message, the email address if you leave one, and which page you sent it from. Nothing else. It is the only user-written content the service holds.

This website's live board

The live board works with no account and sets no cookies. The spot you pick is sent to our server to fetch the ships and times for it, and it is written into the page address so you can share the link; it is not stored against you. Tapping Use my location reads your position once, in your browser, and only when you tap it.

• Apple delivers push notifications to your phone and receives the notification and the token it is addressed to. Apple also processes Pro purchases and subscription billing — Pro is sold and billed entirely through the App Store, and we never see your payment details.
• Map tiles. Esri serves the map background on this website; in the app the map comes from OpenFreeMap. Loading map tiles reveals your IP address and which part of the map you are looking at to that service, as any map does.
• Public agencies, ferry operators and a commercial ship-position feed supply tides, weather, ferry sailings and ship positions. Data flows from them. Nothing about you is ever sent to them.

There is no other processor, and no other recipient.

Pins and account details are kept until you delete them. Deleting a pin deletes it. Deleting your account, from Settings → Account in the app, deletes the account and everything attached to it — sessions, pins, Bells — and detaches it from any device. That is immediate and cannot be undone.

Deleting the app without deleting the account leaves the account in place; delete the account first if that is what you want. To have data removed by hand, or to ask what is held, write to the address below.

Everything travels over HTTPS. Session tokens and the device key are held in the iOS keychain, not in ordinary storage. Passwords are stored only as salted hashes. No credential is ever sent to the browser or written into a page.

Ship O'Clock is not directed at children and does not knowingly collect anything from a child under 13.

If this policy changes in a way that affects what is collected, the effective date at the top changes and the app notes it on the next update.

[email protected] for anything about your data · [email protected] for everything else