Privacy Policy
Effective
On this page
FirstByte, LLC ("FirstByte," "we," "us") operates SailTrace, an iOS application and web service that lets sailors record, replay, and analyze sailboat races (the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.
This Policy covers the SailTrace iOS app, the SailTrace web dashboard, and the SailTrace API. It does not cover third-party services that we link to or that process payments on our behalf; those services have their own privacy notices.
§01 Who we are
FirstByte, LLC, a Delaware limited liability company. Contact us at support@firstbytestudio.com.
§02 Information we collect
We collect the following personal information. These categories match the data types declared in SailTrace's Apple App Privacy disclosure and in the app's PrivacyInfo manifest. For California residents, each item maps to a statutory category under Cal. Civ. Code §1798.140(v)(1); the mapping is in Section 9.1.
(a) Account information
- Name (display name on your sailor profile).
- Email address.
- Password (stored as a salted hash; we never see your plaintext password).
- The date and time you accepted the Terms of Service.
- Optional profile photo.
(b) Sailing data you create
- Precise GPS location while you are recording a session. Precise geolocation is "Sensitive Personal Information" under California law; see Section 9.1.
- Boat metadata you enter (boat name, class, hull number, sail number).
- Race participation, course mark positions, line reads, and wind observations you capture during a race.
- Recordings and the derived race geometry we compute from them.
- A weather forecast for the time and place of a recording, fetched by the app on your device from Apple WeatherKit and uploaded with the session as context for wind analysis.
- Yacht club, team, event, and series memberships you join.
(c) Subscription and billing information
- Whether you have an active Pro subscription, when it began, and when it renews or ends.
- Billing identifiers issued by Apple (in-app purchase) or Stripe (web checkout). We do not receive your full credit-card number; payment data is collected directly by Apple or Stripe under their own privacy notices.
(d) Device and diagnostic information
- Crash reports and performance data via Apple's diagnostic channel (only if you have opted in via iOS Settings → Privacy & Security → Analytics).
- Basic device information needed to operate the Service: iOS version, SailTrace app version, device model, and locale.
- IP address used to issue your session.
(e) Communications
- Email we send you and any reply you send to support, retained for the period necessary to handle the request.
We do not collect device advertising identifiers, do not track you across other apps or websites, and have no third-party ad SDKs in the app.
§03 How we use the information
| Purpose | Information used |
|---|---|
| Operate the core Service: record sessions, reconstruct races, show maps | GPS location, sailing data, account information |
| Authenticate your account and keep it secure | Email, password hash, IP address |
| Process Pro subscriptions and sponsored access | Subscription and billing information, account information |
| Respond to support requests | Communications, account information |
| Detect, prevent, and investigate fraud or abuse | Account information, IP address, device information |
| Improve race reconstruction and our machine-learning models | Aggregated or de-identified sailing data only (see below) |
| Send service announcements (e.g., security notices, terms changes) | Email address |
| Comply with legal obligations and respond to lawful requests | Any of the above as required |
We do not use your personal information for advertising and we do not sell it.
Machine-learning and aggregated data
We use aggregated and de-identified data derived from sailing activity (such as anonymized GPS tracks, boat-class performance distributions, and fleet-wide wind observations) to train and improve the machine-learning models that power race reconstruction, wind inference, and other automated features of the Service. Aggregated and de-identified data does not identify you, is not personal information, and we may use it for any purpose consistent with this Policy, including publishing aggregate insights.
§05 Who else can see your sailing
Racing is shared by nature, and the replay is most useful when the whole fleet is in it. This section describes exactly who can see what.
Your recordings start out visible only to you (and to our staff where needed to operate the Service).
Races are collective. When your recording becomes part of a race and that race is finalized, the race page and its replay (including your display name, boat name, sail number, and your boat's GPS track in that race) can be viewed by the other sailors in the race and by anyone who has the race's link. Some views, such as the full-fleet overlay, are limited to Pro and sponsored viewers, but you should assume that anyone who can open the race can see your boat in it.
Clubs, teams, events, and series. Joining one exposes your participation, results, and race replays within that group to its members and organizers.
Race links can travel. We ask search engines not to index replay pages, but we cannot control who re-shares a link. Treat a finalized race like a posted result: public to the people who care about the racing.
If you don't want that, delete the recording or your account (Section 9); deleting a recording removes your boat's track from the race. For questions about a specific race, email support@firstbytestudio.com.
§07 Data retention
| Category | Retention |
|---|---|
| Account information | While your account is active. Deleted within 30 days of account deletion, except where we are required to retain it longer (tax, fraud, or legal hold). |
| Sailing data (recordings, races, marks, line reads) | While your account is active or until you delete the item. Deleted within 30 days of account deletion. |
| Subscription and billing records | 7 years after the transaction, to meet US tax and accounting requirements. |
| Crash and performance data | Up to 13 months. |
| Support communications | Up to 3 years after the last message. |
| Server access and security logs | Up to 90 days. |
When you delete your account or an individual recording, we will confirm completion by email. Backup copies may persist for up to an additional 30 days before being overwritten in the ordinary course of our backup rotation.
§08 Security
We use industry-standard administrative, technical, and physical safeguards to protect personal information, including encryption in transit (HTTPS/TLS), encryption of database backups at rest, scoped access controls, and audit logging on our admin tooling. No system is perfectly secure, and we cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed in breach of our safeguards.
If a security incident affects your personal information in a way that requires notice, we will notify you and the applicable regulators as required by law, without unreasonable delay.
§09 Your rights
You can do the following at any time:
-
Update
Update your name, email, profile photo, and password from the SailTrace app or web dashboard.
-
Delete
Delete individual recordings or races from the app.
-
Delete account
Delete your entire account from Account → Delete Account in the app, or by emailing support@firstbytestudio.com. We will complete the deletion within 30 days.
-
Export
Export your sailing data on request to support@firstbytestudio.com.
-
Withdraw consent
Withdraw consent for optional iOS permissions (Location, Photos, Diagnostics) in iOS Settings; this may disable parts of the Service.
9.1 US state privacy rights
Many US states give their residents rights over personal information. Wherever you live, we honor these for every SailTrace user:
- Right to know / access. You may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
- Right to delete. You may request deletion of personal information we collected from you.
- Right to correct. You may request correction of inaccurate personal information.
- Right to opt out of "sale" or "sharing." SailTrace does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of (see "No sale or sharing" below).
- Right against retaliation. We will not retaliate against you for exercising any of the above.
Categories collected (last 12 months). California law asks us to map what we collect onto the statutory categories in Cal. Civ. Code §1798.140(v)(1); the same table answers the equivalent question under other states' laws:
| Category | What we collect | Source | Disclosed to |
|---|---|---|---|
| (A) Identifiers | Name, email, user ID, IP address | You, your device | AWS, Postmark |
| (B) Customer records (§1798.80(e)) | Name, email, billing identifiers | You | Stripe |
| (D) Commercial information | Subscription history, sponsored-access status | You, Stripe, Apple | Stripe, Apple |
| (F) Internet or network activity | App usage events, session logs | Your device | AWS |
| (G) Geolocation data, precise (Sensitive PI) | GPS location recorded during sailing sessions | Your device | AWS; other users, as described in Section 5 |
| (I) Sensory information (visual) | Profile photo, if you upload one | You | AWS |
| (K) Inferences | Inferred wind, race geometry, maneuvers, derived sailing analytics | Computed from (G) | AWS; other users, as described in Section 5 |
Every category above is also processed by Heroku, which hosts the Service. Categories not listed are not collected.
Sensitive Personal Information. SailTrace collects precise geolocation, which California treats as Sensitive Personal Information under Cal. Civ. Code §1798.140(ae). We process precise geolocation only for the purposes listed in Section 3 (operating the Service, security, fraud prevention, and aggregated improvement of the Service), all of which are permitted under Cal. Civ. Code §1798.121(a). Race visibility, described in Section 5, is part of operating the Service you signed up for: showing a race to the people allowed to see it. We do not use or disclose Sensitive Personal Information for any other purpose. No "Limit the Use of My Sensitive Personal Information" link is required.
No sale or sharing. SailTrace does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined under California law. No opt-out link is provided because nothing is sold or shared.
Right to non-discrimination. We will not deny you the Service, charge you different prices, or provide a different level of service because you exercised a privacy right.
To submit a request, email support@firstbytestudio.com with the subject line "Privacy Rights Request" and tell us which right you wish to exercise. We will verify your identity using the email associated with your SailTrace account. You may use an authorized agent; we will require written authorization. We respond within 45 days and may extend once by an additional 45 days where permitted.
Appeals. If we decline a request, we will tell you why. You may appeal by replying to our decision with "Appeal" in the subject line; we will respond to an appeal within 45 days (or the period your state's law requires). If we deny your appeal, you may contact your state Attorney General.
9.2 Outside the United States
SailTrace is offered from the United States and is intended for use in the United States. If you use the Service from elsewhere, you do so on your own initiative; your information will be transferred to, processed, and stored in the United States as this Policy describes. For any request about your information, email support@firstbytestudio.com.
§10 Children
SailTrace requires all users to be at least 18 years old, and the Service is not directed to minors. We do not knowingly collect personal information from anyone under 18, including anyone under 13, whose information receives special protection under the Children's Online Privacy Protection Act. If you believe a minor has provided us with personal information, contact support@firstbytestudio.com and we will delete the information and close the account.
§11 Changes to this Policy
We may update this Policy from time to time.
Material changes, such as new categories of personal information collected, new categories of recipients, or new purposes of use, will be announced by updating this Policy's effective date and by email or in-app notice to users with active accounts at least 14 days before the change takes effect.
Non-material changes, such as clarifications, formatting changes, contact updates, and corrections, may be made without notice; the effective date will reflect the change.
Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
§12 Contact us
FirstByte, LLC
Attn: Privacy