Privacy Policy

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) for the Rivanaut apps and this website is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany
Email: app-support@donner.io

Rivanaut is an independent app by a single developer. There is no designated data protection officer because the legal threshold is not reached. For every privacy question or request, write to the address above. More contact details are in the legal notice.

2. What this policy covers

This policy covers the Rivanaut apps for iPhone and iPad, Apple Watch, Android and Wear OS, the home-screen widget and Live Activity, and the website rivanaut.donner.io, including the pages that open shared links.

3. Using the app and its data sources

You need an account to use Rivanaut on all platforms (iPhone, iPad and Android; section 4). In addition, the app has to talk to servers to load maps and data:

• Map and data requests. To load map tiles, waterway data, water levels, notices and weather, the app sends requests to the services listed in section 11. Each request contains the map area or position concerned and, as with every internet connection, your IP address.
• Route calculation. To calculate a route, the app sends the start and end coordinates, the names of the stops and your vessel profile (for example draft, air draft, beam and length) to the Rivanaut backend (Supabase).
• Shared routing cache. When the app calculates a route on your device, it sends the route geometry, distance, duration, start and end points and vessel data to a shared cache so that other users get routes faster. This contribution contains no account ID or name. The start and end points can still reveal where you were planning to go.
• Route error logs. If a route calculation fails, technical error details (route request and error type) are stored to fix and improve the routing engine. They contain no account ID.
• On your device only. Offline maps and caches, the anchor watch, local copies of your trips, routes, favourites and costs, and the data shown in widgets, Live Activities, Apple Watch and Wear OS stay on your device. The watch apps receive display values such as speed, course and ETA, not your raw position.

Legal basis: Art. 6(1)(b) GDPR (providing the app you use). For the shared routing cache and error logs: Art. 6(1)(f) GDPR — the legitimate interest in fast and reliable routing.

4. Your account

An account is required to use the app on all platforms; it is also the basis for sync, community features and live location. You can sign in with:

• Email and password (iOS and Android). Your email address is stored; the password is only stored as a secure hash by the authentication provider (Supabase). You receive confirmation and password-reset emails. The app language is stored so these emails arrive in your language.
• Sign in with Apple (iOS). The app receives a user identifier from Apple and — if you share them — your name and email address (which may be an Apple relay address).

Your profile contains a display name, a friend code and, optionally, a profile photo, vessel photos and vessel details. Your session is stored in the iOS Keychain or in the app’s private storage on Android.

When a new account is created, I receive an internal notification email with the account details (such as email address, name, sign-in method and time) so that abuse can be spotted.

Legal basis: Art. 6(1)(b) GDPR; for the notification email Art. 6(1)(f) GDPR (protecting the service against misuse).

5. Sync between your devices

When you are signed in, the app automatically syncs the following to your account so that it is available on all your devices: favourite places, saved and recent routes, trips and your logbook including the recorded GPS tracks, start and end places and the locks and bridges passed (with time), costs, route tags and app settings (for example vessel profiles, units, currency, map and navigation preferences and your home harbour with its position). Access is restricted to your account by database access rules.

Legal basis: Art. 6(1)(b) GDPR.

6. Location

With your permission, the app uses your device location to show your position on the chart, navigate, record trips, run the anchor watch and find nearby gauges and places. On iPhone, the app can keep using location in the background while you navigate, record a trip, run the anchor watch or share your live location (if you allow “Always”); iOS shows this with a location indicator. On Android, the app uses a visible foreground service for these tasks and does not request background location.

Your position leaves your device only in these cases:

• as a map area or point in requests to map, weather, water-level and traffic services (sections 3 and 11);
• as start and end points of route calculations and AI route suggestions (sections 3 and 9);
• as GPS tracks and home harbour when you sync while signed in (section 5);
• to the system’s geocoding service (Apple on iOS, the Android geocoder from Google on Android) to turn coordinates into place names, for example in the logbook;
• when you share it yourself — live location, shared trips, shared routes, reviews or reports (sections 7, 8 and 10).

Legal basis: Art. 6(1)(b) GDPR. Access to location on your device requires your permission, which you can withdraw at any time (section 21).

7. Live location with friends

Live location is off until you turn it on with “Go live” or enable automatic sharing while navigating (off by default). You choose who can see you — all accepted friends or selected friends — and for how long (for example one hour or the current trip).

While sharing, the app sends your display name, user ID, exact position, course, speed and time about every 12 seconds or 25 metres through a real-time channel of the Rivanaut backend (Supabase). During active navigation, the destination name, ETA, remaining distance and a simplified route line are also sent so friends can follow you. The data is relayed live to your audience; the app does not write it to a database. When you stop sharing or the time window ends, broadcasting stops.

Friends connect via a friend code. You can remove friends at any time.

Legal basis: Art. 6(1)(a) GDPR (your consent when you start sharing). You can withdraw it at any time by stopping sharing.

8. Sharing and community features

• Share links for routes. If you create a share link, the route (name, stops, geometry, vessel profile) and your display name can be opened by anyone who has the link — in the app or on this website.
• Public routes. If you publish a route, it appears in the in-app catalogue for signed-in users with your display name, route details, tags and likes. The backend stores which account liked which route. You can unpublish a route at any time.
• Shared trips. If you share a trip, your friends can see its track, name, times and speeds.
• Reviews and photos of places. Reviews (rating, text, optional details) and photos are stored with your display name and the place. They are only published after a manual review. Before upload, photos are checked automatically for inappropriate content using Google Cloud Vision (SafeSearch). Photos are selected with the system photo picker, so the app only receives the photos you pick; they are scaled down and re-encoded before upload. You can delete your own reviews and photos.
• Google reviews. For some places, the app shows ratings, review excerpts and photos from Google Places. For this, the Rivanaut backend sends the place name, its position and the app language to Google — no data about you.
• Profile and vessel photos are visible to other signed-in users.
• Reporting content. If you report a review or photo, the reported content and your account ID are stored.

Moderation of reviews, photos and reports happens in an internal admin tool. New reviews, photos and reports trigger an internal notification email containing the submitted content.

Legal basis: Art. 6(1)(b) GDPR for the features you use; Art. 6(1)(f) GDPR for moderation and the automated photo check (protecting users and preventing unlawful content).

9. AI route suggestions

When you ask the app for route or trip suggestions, the Rivanaut backend sends the names of the stops, rounded coordinates, your vessel profile and the app language to OpenAI to generate the suggestion. No name, email address or account ID is sent. The result is a suggestion — it is checked against the waterway network and is not a navigation instruction.

Legal basis: Art. 6(1)(b) GDPR.

10. Feedback, route and infrastructure reports

• Feedback: message, category, optional contact email, app version, platform, device model, locale and your account ID.
• Route reports: report type, message, optional contact email, route geometry and stops, vessel data, optional map pin, app version, device details, locale and your account ID.
• Infrastructure reports (lock waiting times and bridge clearance heights): type, object and its position, waiting time or clearance height, optional comment, time and account ID. If you confirm another user’s report (“Still there”), the confirmation is stored as a report of its own that refers to the confirmed report. Recent reports and confirmations, including the reporter’s account ID (used so that nobody can confirm their own report), are visible to other signed-in users.
• Email: if you write to me, I process your message and contact details. On Android, the pre-filled support email contains your app version, device and your account ID.

New feedback and route reports trigger an internal notification email with their content. If you give a contact email, it is set as the reply address of this email so that I can answer you directly.

Legal basis: Art. 6(1)(f) GDPR (answering you and improving routing and data quality); Art. 6(1)(b) GDPR where you get in touch about your account or purchases.

11. Maps, weather, traffic and water levels

To show maps and live data, the app connects directly to these services. They receive your IP address and the map area or position concerned, and process this data under their own responsibility:

• Map tiles: OpenFreeMap (base map) and OpenSeaMap (nautical overlay).
• Waterway data: public Overpass servers for OpenStreetMap data (in Germany, France and Switzerland). On Android, a fallback server operated by VK in Russia (maps.mail.ru) is also used if the primary server fails.
• Weather: Open-Meteo, with the coordinates of the place concerned and, for the weather along a planned route, the coordinates of points along the route.
• Vessel traffic (AIS): aisstream.io, with the visible map area.
• Water levels and notices: the public gauge services of Germany (PEGELONLINE), the Netherlands, France, Belgium, Austria, Poland, Czechia, England, Scotland, Ireland, the USA and Canada, and the European River Information Services (EuRIS).

Legal basis: Art. 6(1)(b) GDPR.

12. Analytics, crash reports and install attribution

To keep the app stable and understand which features are used, the app uses:

• Amplitude (product analytics, EU data region): app events (for example onboarding steps, feature use, purchase events), a device ID, device and app details, language, and — after sign-in — your account ID plus summary properties such as trip count, vessel type and size range, permission states and purchase status. Amplitude derives your approximate location (country, region, city) from your IP address. No GPS coordinates and no advertising ID are sent.
• Google Firebase (Crashlytics, Performance Monitoring, Analytics): crash reports, performance metrics and usage events with device and app details and an app instance ID.
• Install attribution: on iOS, an Apple AdServices token to learn whether the app was installed through an Apple Search Ads campaign; on Android, the Google Play Install Referrer, reduced to whether the install came from a paid campaign.

The app does not access the advertising identifier — neither the IDFA on iOS nor the Google advertising ID on Android — and does not track you across apps or websites of other companies. The app shows no ads and no advertising profiles are built.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in a stable, improving app. You can object at any time (Art. 21 GDPR) by writing to app-support@donner.io; your account will then be excluded from analytics.

13. In-app purchases

Purchases are made through the Apple App Store or Google Play. Apple and Google handle payment — Rivanaut never receives your payment details. To manage your entitlements across devices, the app uses RevenueCat: it receives your purchase status, product identifiers, transaction data from the store and your account ID. The app also stores a few summary attributes with RevenueCat (for example app version, locale, vessel type and usage counts) for support and analysis.

If you cancel, the app may ask you for a reason. Your answer, including an optional free-text comment, is sent to RevenueCat. Giving feedback is voluntary.

Legal basis: Art. 6(1)(b) GDPR; for the attributes and voluntary feedback Art. 6(1)(f) GDPR.

14. Notifications

Alerts (for example anchor alarm, arrival, off-route or speed alerts) are created locally on your device. The app does not register for push notifications and sends no notification token to any server.

15. This website

• Hosting: when you visit the website, the web host processes technical access data (IP address, time, page, browser) in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR).
• No cookies, no analytics, no tracking. Apart from the account pages described below, the pages load no fonts, scripts or images from other servers.
• Language choice: if you switch the language, your choice (“en” or “de”) is saved in your browser’s local storage under rivanaut-lang so the start page opens in that language next time. You can delete it via your browser settings. If your browser prefers German, the start page opens the German version.
• Account emails: the pages that confirm your email address or reset your password load the Supabase JavaScript library from the jsDelivr CDN, which receives your IP address.
• Shared links: pages that open a shared route, friend invitation or place load the shared content from the Rivanaut backend (Supabase).

16. Recipients and processors

These service providers process data as processors on my behalf (Art. 28 GDPR). Their privacy policies are linked in the table:

Apple and Google also receive data as independent controllers when you use their app stores, Sign in with Apple, install attribution or the geocoding services of your operating system. The map, weather, traffic and water-level services in section 11 process your requests under their own responsibility. Other users see what you choose to share (sections 7, 8 and 10). Personal data is never sold.

17. Transfers outside the EU

Some providers are based in the USA or may process data there (in particular Supabase, Google, RevenueCat, OpenAI, Resend and aisstream.io; Amplitude stores the analytics data in its EU data region). Where data is transferred to a country without an EU adequacy decision, the transfer is based on the provider’s certification under the EU-U.S. Data Privacy Framework where available, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The Android fallback server for waterway data (section 11) is located in Russia, for which no adequacy decision exists; it only receives the map area and your IP address.

18. How long data is kept

• Account, profile, synced data and community content are kept until you delete them or your account.
• Deleting your account: you can delete your account at any time in the app under your profile (“Delete account”). This deletes your account and the place photos you uploaded. If you want to be sure that all remaining files (such as profile and vessel photos or trip tracks) are removed, write to me and I will delete them.
• Route and infrastructure reports remain after account deletion without the link to your account, because they help with routing. Please write to me if a report should be deleted completely.
• Feedback, route error logs and the shared routing cache are kept as long as needed for their purpose and deleted on request where they relate to you.
• Analytics and crash data are deleted according to the retention settings of Amplitude and Firebase. Purchase records are kept as long as required by tax and commercial law.
• Data on your device stays there until you delete it or uninstall the app. It may be included in your device backups (iCloud or Google).

19. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Write to app-support@donner.io.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU country where you live. The authority responsible for Rivanaut is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg data protection authority), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

20. Children

Rivanaut is not intended for children. You must be at least 16 years old to create an account and use the community features. If you believe a child under 16 has given me personal data, please get in touch and I will delete it.

21. Permissions and how to revoke them

• Location (“While Using” or “Always” on iOS; precise or approximate on Android): position on the chart, navigation, trip recording, anchor watch, live location. Revoke in Settings → Privacy & Security → Location Services → Rivanaut (iOS) or Settings → Apps → Rivanaut → Permissions (Android).
• Notifications: local alerts such as the anchor alarm. Revoke in your device’s notification settings.
• Photos: the app uses the system photo picker and only receives the photos you select — no access to your library is requested.

The app does not request access to the camera, microphone or contacts.

22. Security

All connections to the Rivanaut backend use encryption (TLS). Sign-in sessions are stored in the iOS Keychain or in the app’s private storage on Android. Database access rules restrict personal data to the account it belongs to, unless you share it. No system is perfectly secure; please use a strong password and keep your device locked.

23. Changes to this policy

I update this policy when the app or the law changes. The current version is always available on this page; the date at the top shows when it was last changed. Please also see the Terms of Use.