Privacy

Your polar

A polar you paste travels only inside the request that carries it: the performance model is normalised, sent to your browser in a single no-store response, and held in memory for the session. It is not logged, and by default it is not written anywhere. Only a digest is kept with each route — a one-way fingerprint used to recognise a repeated request.

If you choose to save a polar to your account, we store the table you pasted, under the name you gave it, so you can load it again and rerun routes with the same boat. A saved polar belongs to your account alone. It is never shared with anyone, never appears in a shared route, and is never read or processed for any purpose beyond preparing your own routes — no analytics, no aggregation, no training, nothing. Deleting it removes the stored table immediately.

What is stored

Route requests and results: the course, the forecast model, the departure window and the computed track, so that a share link reopens what it names and your account can list and rerun what it computed. These are deleted when the retention period for your plan expires.

An email address and the person record it belongs to. Nothing else is required to sign in.

Operational logs and metrics: request counts, timings, error traces and job-queue depth. These keep the service running and decide how many forecast workers to start. They are not used to build a profile of anyone.

Rate-limit records, keyed on the account or on a hashed IP address, so that one caller cannot exhaust the shared forecast budget.

Shared routes are public

A share link is an unguessable token, not a password. Anyone holding it can open the route and see the course, the forecast and the track. They cannot see the polar — a shared route carries only its digest, whether or not you saved the polar to your account. Treat the link the way you would treat the route itself.

Cookies

One, and only after you sign in: a session cookie, set HttpOnly, SameSite=Strict and Secure. There are no advertising cookies and no third-party trackers, so there is no consent banner because there is nothing to consent to.

Your theme preference is kept in local storage in your own browser and never sent anywhere.

Sibling sites

WX Navigator shares a database with Regatta Pages and Saildex, so one person record works across all three. Sessions do not cross. The session cookie sets no Domain attribute, which makes it host-only, so signing in here does not sign you in there. That separation is deliberate.

Third parties

GRIB files are fetched by the server, not by your browser, so NOAA and ECMWF never see you. Map tiles and the bathymetry archive are served from infrastructure run for this site. When payments launch, card details will be entered on Stripe's own pages. They are never entered on this site and never reach it.

Your rights

Ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Email the developer. There is no form and no department to route through.