Privacy policy

Who this covers

This policy covers the JibTrak app for phones and tablets, the JibTrak app for Garmin watches, and this website, including its club pages. JibTrak is made by an independent developer and sailor. You can reach us through the support page.

What JibTrak keeps on your device

Everything you type in stays in the app’s private storage on your device. Depending on how you use it, that can include:

• your boat’s details and photo;
• crew names, roles and availability;
• crew contact details (phone numbers and email addresses) and emergency contacts, and, only if you choose to add them, passport and other identity details for a crew manifest;
• reminder times, including medication reminders;
• race calendars (including any race you copied from a yacht club’s list, with its class ratings and the boats entered), schedules, results, and helm and seasickness logs;
• your settings and your latest position (used for sun, moon, tide and weather times).

We never receive any of it.

JibTrak also remembers, on each phone, the date it was first opened there and which version of the app it was. That is all it holds: a date and a version number. It stays on that phone, goes into the file you export from Crew ▸ Settings ▸ My data (so it can follow you to a new phone), and is never sent to us or to anyone else. It is there so that a later version can tell, with no account and no server, how long you have been using JibTrak. Settings ▸ About shows it.

Backups. JibTrak can write a backup of your boat’s data to a file: automatically to your Downloads folder on Android, and whenever you choose Share, Save or Export. Backup files are readable text and are not encrypted. They hold your boat’s crew and race information, its last known position, and crew phone numbers, email addresses and next-of-kin details. They do not hold passport details (passport number and expiry, date and place of birth, nationality): those stay on the phone they were sent to, and a crew member’s phone sends them again after a restore. The file you export yourself from Crew ▸ Settings ▸ My data does hold your own details, passport included. On the owner’s phone, and on an admin’s, the file also holds the boat’s secret key, the one every crew member’s encryption key is made from (see Sharing with your crew). Keep backup files private, don’t pass one to anyone you wouldn’t trust with that information, and delete old ones when you no longer need them.

What goes online, and when

These are the only times the app contacts the internet. Each one happens because you used the feature, and none of them sends your name, your crew or your boat in a form anyone could read.

That is the complete list. Apart from the crew and watch sharing described below, nothing else leaves your device.

Sharing with your crew

Live plan on the same WiFi

When someone who runs the boat switches on sharing, their phone becomes the host phone, and JibTrak can show a live plan page to any device on the same WiFi that has the address: who’s on watch, the schedule, the watch chart, the race and the weather (including the position the forecast is for, rounded to about a kilometre). The page is for web browsers, so crew who don’t have the app can still see the plan.

Joining a boat

When a crew member joins a boat with an invite, their phone fetches the crew list, schedule and races from the host phone over the same WiFi, and again whenever it syncs. Passport and other identity details, phone numbers, email addresses and next-of-kin details are left out of that copy. The boat’s last known position is included. The joining phone also tells the host phone that it has joined, using a random identifier for the phone.

The invite also carries the address and key of an online copy of the boat, and your phone fetches the crew list, schedule and races from there when you join, wherever you are, and again whenever you open the app with internet. Over the same WiFi, with no internet, it can still sync with the host phone as above.

What your phone sends the host phone. Once you have joined, your phone also sends the host phone your own details from Crew ▸ Personal, so the crew manifest can be filled in without anyone typing them. It sends whichever of these you have filled in:

• your phone number;
• your email address;
• your next of kin (name, relationship and phone number);
• your passport number and expiry date;
• your date of birth;
• your nationality;
• your place of birth.

This happens automatically, each time you save your Personal details and each time your phone syncs with the host phone. Your phone also sends the watch patterns you have created, at each sync, and any contacts you choose to suggest to the skipper. The host phone keeps your passport details for three months after they last arrive, then clears them; your own phone keeps yours. The owner or an admin can also ask your phone to send them again, for example after they have been cleared: your phone then tells you and lets you fill them in. If you would rather the host phone did not hold your passport details, leave those fields empty. All of this is encrypted and goes only to the host phone.

What your phone leaves online. With internet, your phone also leaves one short, encrypted message for the owner’s and admins’ phones in the boat’s online records, so they hear from you without being on the same WiFi. It holds that you have joined (using a random identifier for the phone), your phone number, email address and next-of-kin details if you have filled them in, any contacts you have suggested to the skipper, and the watch patterns you have made and any you have asked to have removed. Your passport number and expiry date, date of birth, nationality and place of birth are never part of it: those go only to the host phone, over the same WiFi, as above. The message is replaced each time your phone sends a new one, and only the owner’s and admins’ phones can open it.

Owners and admins

The owner’s phone, and the phone of anyone the owner has made an admin, also swap changes with each other, so that each one holds the same boat. They do it through an encrypted working copy kept in the boat’s online records, which only their phones can open, or directly over the same WiFi when there is no internet. What goes across is the whole boat: the crew list with everyone’s phone numbers, email addresses and next-of-kin details, the schedule, the races and the boat’s settings. Passport details do not go across: each phone keeps only the passport details its own crew sent it (or that were typed into it), so an admin’s phone sees the same phone numbers, email addresses and next-of-kin details as the owner’s, but passport details only for the crew who have synced with it. The boat’s secret key (the one every crew member’s encryption key is made from) reaches a new admin’s phone with their invite: the owner’s or an admin’s phone leaves it in the online records, encrypted with the key in that person’s own invite, and it is removed from the service as soon as their phone has collected it. It can also reach an admin’s phone the first time it syncs with the owner’s over the same WiFi.

The boat’s online records

On the same WiFi, a crew phone can join or sync only while it is near the host phone. To let phones join, fetch the newest boat, leave their news and swap changes from anywhere, the owner’s and admins’ phones keep encrypted records of the boat on our sync service. There is nothing to switch on: the first time the owner or an admin makes an invite for a boat, their phone starts keeping them, and it keeps them up to date whenever it has internet.

• What is kept. Four kinds of record, each encrypted on the phone that makes it and each replaced by the next one: the crew copy, which is the crew list (names and roles), the schedule, the races, the tides, the boat’s setup and links (including the crew chat link) and its last known position, the same copy the host phone sends a crew phone over the WiFi, with no passport details, phone numbers, email addresses or next-of-kin details and no secret key; the admins’ copy, the whole boat as the owner’s and admins’ phones swap it, which does include crew phone numbers, email addresses and next-of-kin details but never passport details; a key for a new admin, the boat’s secret key encrypted with the key in that person’s invite, removed as soon as their phone has collected it; and a crew member’s message, described under “What your phone leaves online” above, encrypted with that person’s own key.
• Who can read it. The crew copy: only phones that have an invite from the owner or an admin. The admins’ copy and the keys for new admins: only the owner’s and admins’ phones (and the new admin, for their own key). A crew member’s message: that person’s phone and the owner’s and admins’ phones. Everything is compressed and encrypted (AES-256, with a check that it hasn’t been changed) on the phone that makes it, with keys made from the boat’s secret. Those keys go into the invites and nowhere else, so neither we nor Cloudflare can read any of it, and the service can’t make a record that a phone would accept.
• What we and Cloudflare can see. That records exist under a random address, how big they are, when they last changed, and the internet address of each request. The service itself keeps no internet addresses: it counts requests against a scrambled version of the address that changes every day, only to stop abuse. Cloudflare, which runs the service, keeps its ordinary logs under its own privacy policy.
• How long it is kept. Only the newest of each record: each upload replaces the one before. Nothing is deleted automatically: the service has no timer that removes a boat’s records, so a crew member’s message stays until their next one replaces it. The records are taken down when the owner or an admin deletes the boat from their phone, and when they use Clear all data (if their phone can’t reach the internet at that moment, it keeps trying whenever the app is next open with internet, and Clear all data asks before it goes ahead). A new admin’s key is removed once it has been collected.
• Limits. The service caps the size of each record and how often one boat or one internet address can use it, so it can’t be used as free storage.
• Nothing depends on it. With no internet, everything works over the same WiFi exactly as before. It needs no account, and it is free.

Anyone who holds an invite can open that boat’s crew copy, and an admin’s invite lets whoever holds it collect the boat’s key until the person it is for does, so give an invite only to the person it is for. Taking someone off the crew does not take back an invite they already hold: they can open the newest crew copy for as long as it stays online.

Who sees your passport and other details

Your passport number and expiry date, date and place of birth, nationality, phone number, email address and emergency contact are all optional, and the Personal page where you type them links to this section. They are seen by:

• The boat’s owner and admins. Once you have joined a boat, your phone sends them to the host phone, encrypted, each time you sync. The phone you sync with holds your passport details, does not pass them to other admins’ phones, and clears them three months after they last arrived. Phone numbers, email addresses and next-of-kin details are held on the owner’s and admins’ phones. Other crew never receive any of them: the crew list sent to a crew phone leaves them out.
• Whoever the skipper hands the crew manifest to. The manifest lists the vessel, the voyage and each crew member with these details, for a marina office, customs or race organisers. It is a page inside the app (Race crew ▸ Crew manifest) that only the owner and admins can open. The skipper chooses whether to share it and where it goes; JibTrak never sends it anywhere itself.
• Anyone you give a file to. The file you export yourself from Crew ▸ Settings ▸ My data holds your own details, passport included. Boat backup files hold phone numbers, email addresses and next-of-kin details but no passport details (see Backups).
• Nobody else. Not us, not the app stores and not your watch. Passport details never go into the online records. Phone numbers, email addresses and next-of-kin details do, in the encrypted records only the owner’s and admins’ phones can open, so we can’t read them.

Encrypted between phones

Everything JibTrak itself sends from one phone to another over the same WiFi is encrypted with AES-256, with a check that it hasn’t been changed on the way. That covers a crew phone’s sync, the message that says it has joined, a crew member’s own details, suggested contacts, shared watch patterns and the swapping of changes between the owner’s and admins’ phones. Only your phone and the host phone can read it; anyone else on the WiFi sees scrambled data. Each person’s key is made from a secret held by the owner’s and admins’ phones and reaches that person’s phone inside their invite (the code or QR), never across the WiFi, so give an invite only to the person it is for. If a phone can’t encrypt a message, it doesn’t send it. Every online record is encrypted in the same way, on the phone that makes it, before it is uploaded.

The one thing that can’t be encrypted this way is the web page above, which a browser has to be able to open. Your Garmin watch doesn’t use WiFi to talk to your phone at all: it uses Bluetooth (see Your Garmin watch).

Yacht clubs on this website

A yacht club can set itself up on this website (the pages called Yacht clubs, Sign in or set up your club and Club races) and publish its races for crews to read. This is separate from the boat’s own records above: nothing from a boat or a crew member is ever sent to the club service or kept there. The JibTrak app reads the club service, and only when you choose Join a race; What goes online, and when says exactly what it sends.

• Who can read it. What a club publishes is public by design: anyone can find a club by searching for its name, or open its page from a link, and read it, without an account. That includes the club’s address and logo. A search never gives the whole list: it needs at least two letters and answers with at most twenty clubs. A club’s page address holds a code of ten random letters and numbers that the service makes; nobody has to know it. We do not check who sets a club up, so a club may not be what its name says, and every club page says so.
• Almost nothing about people. The club pages ask for no names of people and no phone numbers, and ask clubs not to enter any. The only thing about a person that a club gives is the email address for its account, described below. Boat names and sail numbers can sometimes be linked to the person who owns the boat, so a club should publish only what it would pin on its own notice board. A club’s address should be the club’s own, not an officer’s home, and a logo should not be a picture of a person. A club is responsible for what it publishes.
• Signing in: a username and a password. A club signs in with a username the officer chooses when setting the club up (it is not shown on the club’s public page, and it is not the club’s public code) and a password. The password never leaves the officer’s browser: the browser scrambles it, slowly and on purpose, together with a random value we keep, into a long key, and sends only that key to sign in. We keep only a one-way fingerprint of that key, so we cannot read the password or recover it; a forgotten one is set again with an emailed link (next). Whoever has the password can change or delete the club, so it should go only to the club’s other officers. Wrong passwords are counted, by club and by internet address, and after a few the service refuses further tries until the hour is up.
• The email address. When a club is set up the officer gives an email address (one that the club’s officers share is best). We keep it on the club’s account, next to the username, and use it for two messages and nothing else: a link to confirm the address, and, if the password or the username is forgotten, a link to choose a new password, which also tells the officer the username. A password link is only ever sent to an address that has been confirmed, so a mistyped address, or someone else’s, never receives one. Each link works once and ends after an hour (a confirmation, after three days), and changing the address ends them. Asking for a link always gets the same answer whether or not a club matches, so the pages do not say whether a username or an address belongs to a club. We do not keep the messages ourselves, and the address is never shown on the club’s public page. An address that is not confirmed within a month is forgotten. If the address was never confirmed, or nobody can read that mailbox any more, we cannot reset the password and the club cannot be opened again; the club can make a new one.
• In your browser. While an officer is signed in, the club page keeps the club code, the username and a sign-in token (never the password) in that tab’s session storage, which the browser clears when the tab is closed, so reloading the page does not sign them out. If they tick “Keep me signed in on this device”, the page keeps them in the browser’s local storage instead, until they sign out or the sign-in ends after 30 days; otherwise a sign-in ends after 12 hours. Signing out removes them and ends the sign-in at the service. They are not cookies, and the token is sent nowhere except as the sign-in for that club’s own requests. The page for reading a club stores nothing.
• How long it is kept. A club that never gets a race or a rating list is removed after a week. A club nobody has changed or looked at for 12 months is removed, with its races. An officer can delete the club at any time, which removes it, its races, its address and logo, its username and email address, its password fingerprint, its sign-ins and any links not yet used straight away. A sign-in, or an emailed link, is kept, as a one-way fingerprint, only until it ends, and ended ones are cleared daily. The service keeps no internet addresses: it counts requests, wrong passwords and emails sent against scrambled versions of the internet address, the username or the email address that change every day, only to stop abuse, and throws those counts away after two days. Cloudflare keeps its ordinary logs under its own privacy policy, and Resend may keep a record of the messages it delivers under its own.
• Limits. The service caps how many clubs and races there can be, how big they can be (a logo is at most 100 KB), how many devices can be signed in to one club at once, how often one internet address can set up a club, save, or ask for an email to be sent, and how many emails go out in a day, so that it cannot be used as free storage or to send unwanted messages.
• Nothing depends on it. JibTrak works without the club pages and the club service.

Permissions, and what each is for

• Location. To work out sunrise, sunset, moon and tide times, the weather where you are, and your speed for distance estimates. Your position is used on the device. It goes online only as part of the weather and tide look-ups above. It also appears in the backup, sharing and joining copies described in this policy, including the encrypted crew copy in the boat’s online records.
• Camera. To scan a crew invite’s QR code, and for Scope, which shows a rival’s rig at its true size over the live view and can measure how far away a boat is. Pictures are shown on screen only. They are not saved or sent anywhere.
• Microphone. The camera component JibTrak uses requires the app to declare microphone access, so both Android and iPhone ask for it. JibTrak never records audio.
• Notifications, alarms and reminders. To deliver handover alerts and reminders on time, including exact alarms, full-screen alerts if you turn on the phone alarm, and restarting them after your phone reboots.
• WiFi and local network. To share the live plan with other devices on the same WiFi, and to find it by name.
• Bluetooth (iPhone). To talk to your Garmin watch: to send it your schedule and reminders, and to hear back what you do on it. iPhone asks the first time you use the watch link. JibTrak also uses iPhone’s background Bluetooth mode, so it can hear back from your watch while the phone is in your pocket. Bluetooth is used for the watch and nothing else.
• Staying awake. While sharing is on, JibTrak shows a notification and keeps the phone’s processor and WiFi awake so the page stays reachable.
• Photos. On iPhone, to let you pick photos to share with a race result. On Android the app uses the system photo picker.

You can withdraw any permission at any time in your phone’s settings.

Your Garmin watch

If you use the JibTrak watch app, JibTrak sends your schedule, crew names and reminders to your watch, and, for the handicap tools, the boats in your fleet with their ratings and your latest pings. The watch can send back actions you take on it, such as postponing a start, logging a mark rounding or a GPS ping, or its battery level. A GPS ping includes the position you were at when you tapped the boat, so that position is shared between phone and watch as well. This travels between your phone and your watch, not to us, and no passport or other identity details are sent to the watch.

On Android, the link goes through the Garmin Connect app on your phone. On iPhone, you choose your watch once in Garmin Connect, which hands your choice back to JibTrak, and after that JibTrak talks to the watch over Bluetooth itself, using Garmin’s own software library. iPhone asks for Bluetooth permission the first time, and JibTrak uses iPhone’s background Bluetooth mode so it can hear back from the watch while the phone is in your pocket. Garmin’s own apps, software and services are covered by Garmin’s privacy policy.

No adverts, analytics or tracking

JibTrak contains no advertising and no analytics, crash-reporting or tracking services. If the app hits an error, the details are kept on your device, and only leave it if you choose to include them in a message to us.

This website sets no cookies, runs no analytics and loads nothing from other companies. The club pages connect to our own club service (clubs.jibtrak.com) and to nothing else, and, while a club’s officer is signed in, keep a sign-in token in that browser (for the tab, or on the device if you ask them to), as described under Yacht clubs on this website. Like any website, the service that hosts it may keep ordinary technical logs, such as your IP address and the pages requested, for security and reliability.

Your choices, and deleting your data

• You can edit or delete anything you have entered from inside the app.
• To erase everything JibTrak holds on a phone, use Settings ▸ Hosting & backup ▸ Clear all data, or uninstall the app. Clear all data also removes the temporary copies JibTrak makes for the share menu.
• The boat’s online records are deleted when the owner or an admin deletes the boat from their phone or uses Clear all data. If their phone can’t reach the internet at that moment, it keeps trying whenever the app is next open with internet; Clear all data asks before it goes ahead, and if you clear anyway the records stay on the service, because nothing is deleted by a timer. A crew member’s message stays until their next one replaces it.
• A club’s officers can delete the club, and everything published in it, together with its username and email address, at any time, from the club’s page once signed in. They can also change the email address there.
• Backup files in your Downloads folder, files you have shared with others, and details already sent to another phone are separate copies. Delete the files yourself. For details your phone has sent to the host phone, ask whoever runs the boat to remove them there: clearing a field on your own phone does not clear the host phone’s copy. Passport details on the host phone also clear themselves three months after they last arrived.

Because we hold no readable copy of your data (the online records are encrypted, and we can’t open them), we can’t retrieve, correct or delete it for you. Where the law gives you rights over personal data, those rights apply, but there is nothing on our side to give you access to. The steps above are how you do it on your own device. The one thing we do hold in a form we can read is what a yacht club has published on the club pages, together with the username and email address its officers gave: they can change or delete them themselves, and if you think something on a club page shouldn’t be there, or an email address has been used without your say-so, tell us through the support page and we will look at it.

Security

Your data sits in the app’s private storage on your device, and everything the app sends between phones, and the online records, is encrypted, as described under Sharing with your crew. Use your phone’s screen lock, and treat backup files and WiFi sharing with the care described above. The club pages and the club service use only encrypted (https) connections, a club’s password is scrambled in the officer’s browser before anything is sent, and the token in each emailed link is after a # sign, so it is never sent to a server.

Children

JibTrak isn’t aimed at children, and we don’t knowingly collect anything from anyone.

Changes to this policy

If this policy changes in a way that matters, we’ll update the date at the top. The latest version is always at jibtrak.com/privacy.

Questions

Ask us through the support page, or email hello+web [at] jibtrak [dot] com.