Privacy

Places you save ("pins")

A pin is a latitude, a longitude, a radius and a name you choose — "Deck", "Mom's dock". It is stored so the next-ship times, tide, wind and weather can be worked out for that spot, and so a Bell can ring when a ship is headed past it. If you tap Use my location, the app reads your position once to move the map marker; you can drag it anywhere before saving, and the coordinate that is saved is wherever the marker ends up. Nothing is recorded until you save a pin, and deleting the pin deletes the coordinate.

Live position, course and speed (Crossing only)

Used only to compute ships' times at your line. Memory only, for at most ten minutes. While the Crossing screen is open, your position, course and speed are sent every few seconds and held in memory for at most ten minutes after your last update. They are never written to disk, never joined to your pins, Bells or account, and never kept as a history unless you save a trip (next row).

Saved trips (only if you turn on Save this trip)

Where you went during a crossing: the track (time, position, speed, course and GPS accuracy, about one point every few seconds), when it started and ended, the figures worked out from it (distance, speeds, stopped time), which ships with AIS came close and when, and which shipping lanes or ferry routes you crossed and when. A trip is stored only when you tap Keep at the end of a crossing. It is kept against your device key or account and is private by default. Trips are never public. You can explicitly create a private invitation for one signed-in recipient, with expiry and revocation as described below. Trips are kept until you delete them — one at a time from the trip, or all at once with your account or device.

Apple Watch recordings (optional)

Apple Watch recordings are optional. After you tap Record and allow Location, the companion records time, position, available speed and course, and GPS accuracy while recording is active, including with the screen lowered. Stop ends GPS capture. Recordings are limited to four hours; interruptions or unavailable GPS can leave gaps.

The route is saved locally on the Watch and transferred to the paired phone when available. You review it on the phone and choose Keep or Discard. Keep requires signing in and saves the journey privately, using a local upload queue when offline. The Watch retains its copy until the phone acknowledges your decision. Watch-only recording does not collect the phone’s live AIS feed or HealthKit data.

Private journey invitations

An owner can explicitly create a private invitation containing a route, times and recorded encounters. One signed-in recipient can accept it, and the owner can see the accepting account’s handle. Invitations expire after 30 days and the owner can revoke access sooner. Recipients cannot edit or invite others. They may retain screenshots or exported copies; revocation cannot remove copies already taken. Deleting the server-stored journey or its owner’s account removes its invitations.

A device identifier

On first launch the app is issued a random device key. It is a random number, not derived from your hardware and not shared with anyone. It exists so your pins and Bells belong to your phone before you have created an account, and so the app works with no account at all. It is stored on your device in the system keychain.

Push notification token, if you turn on Bells

Turning on Bells registers an Apple Push Notification service (APNs) device token for your phone and stores it against your device key, together with your time zone so quiet hours land at the right hour of your night. It is used only to deliver the alerts you turned on. Alerts are sent to Apple directly. Turning Bells off, or deleting the app, ends this.

Purchase data, if you subscribe to Pro

Buying Pro in the app sends us Apple's own transaction identifiers, the product you bought (Bells, Supporter or Patron), its status (active, in a billing grace period, cancelled, expired) and its expiry date, linked to your account or device key. That is what unlocks Pro and keeps it unlocked while the subscription is active. Apple handles the purchase itself — no card or payment details ever reach us. Deleting your Boat O'Clock account unlinks this record from you but does not cancel the Apple subscription; cancel that separately in your Apple ID settings.

Basic app facts

Platform and app version, so a bug can be traced to a release. Nothing about your hardware model, and no advertising or vendor identifier.

An account, only if you make one

An account is optional. Almost everything — the map, pins, the times, Bells and the widgets — works without one. Signing up stores a handle you choose and a password that is stored only as a salted hash, never as text. A Boat O'Clock account is its own account: it is not shared with, and does not sign in to, any other app.

Feedback you choose to send

The form on the support page stores the message, the email address if you leave one, and which page you sent it from. Nothing else. It is the only user-written content the service holds.

This website's live board

The live board works with no account and sets no cookies. The spot you pick is sent to our server to fetch the ships and times for it, and it is written into the page address so you can share the link; it is not stored against you. Tapping Use my location reads your position once, in your browser, and only when you tap it.

This website's Crossing page

The Crossing page works with no account. The first time you start a crossing, your browser is issued a random device key, kept in the browser's local storage, so the server can hold your live position against your session and no one else's; it is not a cookie and holds no pins. Your position is read continuously only while the page is open and in view, after you agree on the page, and is handled as described under Live position, course and speed above. Clearing this site's data in your browser removes the key. If you save a trip on this website, it is stored against that browser key; Your trips lists them, and each can be renamed, downloaded as a GPX file or deleted there. A browser key that has not visited for 18 months is removed with its trips.

• Apple delivers push notifications to your phone and receives the notification and the token it is addressed to. Apple also processes Pro purchases and subscription billing — Pro is sold and billed entirely through the App Store, and we never see your payment details.
• Cloudflare carries requests to the service and sees your IP address and request metadata. It is not used for advertising or tracking.
• Place search. When you search for a place while making a pin in the app, or the live board's search box does not know a place, what you type goes from your phone or browser straight to Photon (run by komoot, built on OpenStreetMap) with the map's centre, so nearby places come first. Photon sees that text, that point and your IP address, as with any web request; nothing identifying is sent, and the search is not sent to our server.
• Map tiles. Esri serves the map background on this website; in the app the map comes from OpenFreeMap. Loading map tiles reveals your IP address and which part of the map you are looking at to that service, as any map does.
• Public agencies, ferry operators and a commercial ship-position feed supply tides, weather, ferry sailings and ship positions. Data flows from them. Nothing about you is ever sent to them.

The services described above help operate the app. A recipient you explicitly invite can view the journey they accept.

Pins and account details are kept until you delete them. Deleting a pin deletes it. Deleting your account, from Settings → Account in the app, deletes the account and everything attached to it — sessions, pins, Bells — and detaches it from any device. That is immediate and cannot be undone.

Deleting the app without deleting the account leaves the account in place; delete the account first if that is what you want. To have data removed by hand, or to ask what is held, write to the address below.

Trips are kept until you delete them. A trip saved without an account belongs to the device key that saved it. If you delete the app, or it has to register a new key, those trips can no longer be opened by anyone and are removed after 18 months without a visit — sign in first if you want to keep them, or delete them from Trips before you go. To have any trip removed by hand, write to the address below.

Everything travels over HTTPS. Session tokens and the device key are held in the iOS keychain, not in ordinary storage. Passwords are stored only as salted hashes. No credential is ever sent to the browser or written into a page.

Boat O'Clock is not directed at children and does not knowingly collect anything from a child under 13.

If this policy changes in a way that affects what is collected, the effective date at the top changes and the app notes it on the next update.

[email protected] for anything about your data · [email protected] for everything else