Aweigh is a marine weather and forecast application. This policy explains what information we collect, why we collect it, and how we use it.

The short version

• You can use the forecast features without creating an account.
• If you create an account, we store your email address, display name, and the harbors and vessels you choose to save.
• Using the “Use my location” feature does not store your location in your account.
• If you choose “Stay signed in,” we keep a sign-in cookie on that device for up to a year. You can end it at any time.
• If you turn on the daily outlook in the Aweigh app, we store a notification address for that phone. Turning it off or signing out removes it.
• We email you news and updates about Aweigh only if you opt in.
• We do not sell or rent your personal information.
• The live site uses Google Analytics, and the Aweigh app uses Google Analytics for Firebase, to understand how Aweigh is used.

Information we collect

If you create an account

We store:

• Your email address.
• Your display name.
• If you chose to answer them when signing up: how you heard about Aweigh, and where you go boating. Both questions are optional.
• A secure bcrypt hash of your password. We cannot read your password.
• Your saved harbors, including their coordinates. You can set a harbor's coordinates yourself by typing them, by placing them on a map, or from your device's location. They are stored to about 100 meters.
• Your saved vessels and their settings.
• Whether you chose to receive news and updates by email, and when you chose it.
• The date and IP address of your most recent sign-in.
• A record of the versions of our legal documents that you accepted, along with the date and technical information needed to demonstrate that acceptance.
• For each device where you chose “Stay signed in”: your browser and operating system as reported by that browser, the IP address it was set up from, and when it was last used. This is what lets your account settings list your signed-in devices so you can recognize and end them.
• If you turn on the daily outlook in the Aweigh app: the hour you chose and your phone's time zone, and for each phone where it is on, a notification token issued by Google Firebase Cloud Messaging, whether the phone is an iPhone or an Android phone, the app version, and when the token was registered and last used.

Whether or not you have an account

We may store:

• Session cookies, once you have signed in.
• A sign-in cookie lasting up to one year, but only if you choose “Stay signed in” when signing in. It is not set otherwise, and never for a guest.
• Standard web-server logs.
• Temporary records of failed sign-in attempts used for rate limiting.
• Feedback you submit through the app, including any email address you provide and technical details that help us understand the issue.

Some preferences, such as your selected vessel, measurement units, theme, and location-permission choice, are stored locally in your browser. Clearing your browser data removes them.

How we use information

We use information only to operate and improve Aweigh, including:

• Signing users in and maintaining accounts.
• Saving your harbors, vessels, and preferences.
• Sending password-reset emails when requested.
• Sending the daily outlook notification, if you turned it on.
• Telling you about important changes to Aweigh, to this policy, or to the security of your account.
• Sending news and updates about Aweigh, such as new features, by email, but only if you opted in.
• Protecting the service from abuse and automated attacks.
• Processing feedback and responding when contact information is provided.
• Maintaining records of legal agreements you have accepted.

We do not use your information for advertising.

Location services

If you choose “Use my location,” your browser or the Aweigh app asks for permission before it shares your device's location.

Your device sends its precise coordinates to our server. The server rounds them to roughly one kilometer, then uses them to show a forecast for that area. We do not substitute a different location for yours.

The forecast page does not store your location in your account or profile. If you choose "Use my location" while setting one of your saved harbors, that position is saved as the harbor's coordinates, rounded to about 100 meters. You can change or reset it at any time.

Map. When you open the map to set a harbor's coordinates, your browser loads map images directly from the OpenStreetMap Foundation. That service receives your IP address and the area of the map you view. The map loads only when you open it.

We use the rounded location, and a place name supplied by OpenStreetMap's Nominatim service, so the app can display a human-readable location. This information is cached for performance and is not tied to your account.

You can revoke location permission through your browser or device settings at any time. The app continues to function without location access.

Daily outlook notifications

The daily outlook is available only in the Aweigh app, and only if you turn it on in your account settings. The app asks your phone for permission to show notifications.

Once a day, at the hour you chose, we send the Go/No-Go verdict for your home harbor and default vessel. The notification is delivered through Google Firebase Cloud Messaging and, on an iPhone, through Apple Push Notification service. Both receive the notification's text and the phone's notification token.

Turning the outlook off on a phone, or signing out on it, deletes that phone's token. We also delete a token when Google reports that it is no longer valid, for example after the app is removed.

Analytics

The live website uses Google Analytics 4 to understand how the application is used. Analytics may collect information such as pages viewed, features used, and interactions with the app.

Google Analytics also estimates your approximate location, to about the level of a city, from your IP address. Google Analytics 4 does not store the IP address itself.

The Aweigh app does not use the website's Google Analytics. It uses Google Analytics for Firebase, which records when the app is opened and how long it is used, the phone's model and operating system, an identifier for that installation of the app, and an approximate location, to about the level of a city, from your IP address. It does not use your phone's advertising identifier.

Analytics data is not linked to your Aweigh account.

The website's analytics is not enabled in local or staging environments.

Third-party services

Aweigh relies on several service providers to operate:

• InMotion Hosting for hosting, database infrastructure, and the kirkor.com mail server that delivers password-reset email.
• Open-Meteo for weather and marine forecasts, with OpenWeather as a weather fallback.
• NOAA CO-OPS for tide predictions and water temperature, with WorldTides as a tide fallback.
• The National Weather Service for precipitation probability and marine and severe-weather alerts.
• The OpenStreetMap Foundation, for location lookups (Nominatim) and for the map you can use to set a harbor's coordinates.
• Google for Analytics, and Google Firebase for app analytics and for delivering daily outlook notifications.
• Apple for delivering daily outlook notifications to iPhones.

These providers receive only the information necessary to perform their services.

We may also disclose information when required by law.

What we will never do

We will not:

• Sell or rent your personal information.
• Use your saved harbors or vessels for advertising.
• Send you news or marketing emails unless you opt in.

Aweigh sends the service emails you request, such as password resets, and may tell you about important changes to the service or your account. News and updates are sent only if you opt in, and each one includes a link to stop them.

Your choices

You can update your display name, password, harbors, and vessels through your account settings. Your email address is your sign-in identifier and cannot be changed there yet; write to info@kirkor.com if you need it corrected.

Your account settings list the devices set to stay signed in, and “Sign out everywhere else” ends all of them except the one you are using. Changing your password ends every one of them, including the current device.

You can turn news and updates by email on or off at any time in your account settings, or with the link in any of those emails.

You can turn the daily outlook off on each phone in your account settings, or stop Aweigh's notifications in your phone's settings.

You can delete your account yourself, at any time, from the bottom of your account settings. It asks for your password and a typed confirmation, and it takes effect immediately.

Deletion removes the account and everything stored with it: your saved harbors, your vessels and thresholds, your password-reset records, your signed-in device records, your daily outlook settings and notification tokens, and the record of which legal documents you accepted. Nothing is archived and no copy is kept, so an account cannot be restored once it is deleted. You are welcome to sign up again with the same email address.

Retention

Account information is kept while your account exists, and is removed immediately when you delete it.

Password-reset tokens expire after one hour and can only be used once.

“Stay signed in” records expire after one year. They also end immediately when you sign out, change your password, or use “Sign out everywhere else,” and expired records are deleted automatically.

Notification tokens are kept while the daily outlook is on for that phone, and are deleted as described under “Daily outlook notifications.”

Failed sign-in records are retained only long enough to support rate limiting.

Cached forecast and tide information expires automatically.

Security

Aweigh is served over HTTPS.

Passwords are stored as bcrypt hashes and are never stored in readable form. Session cookies are configured for secure use, and sign-in attempts are rate-limited.

“Stay signed in” cookies are stored only as a hash, so the stored value cannot be turned back into a working sign-in. Each one is replaced with a new value every time it is used, which lets us detect a copied cookie and end that device's access.

No online system can guarantee absolute security. We recommend using a password that is not reused on other websites or services.

Children's privacy

Aweigh is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

If we make a material change to this policy, we will update its version and ask account holders to review and accept the revised version before continuing to use account features.