Aweigh is a marine weather and forecast application. This policy explains what information we collect, why we collect it, and how we use it.

The short version

• You can use the forecast features without creating an account.
• If you create an account, we store your email address, display name, and the harbors and vessels you choose to save.
• Using the “Use my location” feature does not store your location in your account.
• If you choose “Stay signed in,” we keep a sign-in cookie on that device for up to a year. You can end it at any time.
• We do not sell or rent your personal information.
• The live site uses Google Analytics to understand how the app is used.

Information we collect

If you create an account

We store:

• Your email address.
• Your display name.
• If you chose to answer them when signing up: how you heard about Aweigh, and where you go boating. Both questions are optional.
• A secure bcrypt hash of your password. We cannot read your password.
• Your saved harbors, including their coordinates.
• Your saved vessels and their settings.
• The date and IP address of your most recent sign-in.
• A record of the versions of our legal documents that you accepted, along with the date and technical information needed to demonstrate that acceptance.
• For each device where you chose “Stay signed in”: your browser and operating system as reported by that browser, the IP address it was set up from, and when it was last used. This is what lets your account settings list your signed-in devices so you can recognize and end them.

Whether or not you have an account

We may store:

• Session cookies, once you have signed in.
• A sign-in cookie lasting up to one year, but only if you choose “Stay signed in” when signing in. It is not set otherwise, and never for a guest.
• Standard web-server logs.
• Temporary records of failed sign-in attempts used for rate limiting.
• Feedback you submit through the app, including any email address you provide and technical details that help us understand the issue.

Some preferences, such as your selected vessel, measurement units, theme, and location-permission choice, are stored locally in your browser. Clearing your browser data removes them.

How we use information

We use information only to operate and improve Aweigh, including:

• Signing users in and maintaining accounts.
• Saving your harbors, vessels, and preferences.
• Sending password-reset emails when requested.
• Protecting the service from abuse and automated attacks.
• Processing feedback and responding when contact information is provided.
• Maintaining records of legal agreements you have accepted.

We do not use your information for advertising.

Location services

If you choose “Use my location,” your browser asks for permission before sharing your coordinates.

Your coordinates are rounded to roughly one kilometer and used to show a forecast for that area. We do not substitute a different location for yours.

Your location is not stored in your account or profile.

We use the rounded location, and a place name supplied by OpenStreetMap's Nominatim service, so the app can display a human-readable location. This information is cached for performance and is not tied to your account.

You can revoke location permission through your browser settings at any time. The app continues to function without location access.

Analytics

The live version of Aweigh uses Google Analytics 4 to understand how the application is used. Analytics may collect information such as pages viewed, features used, and interactions with the app.

Analytics data is not linked to your Aweigh account.

Analytics is not enabled in local or staging environments.

Third-party services

Aweigh relies on several service providers to operate:

• InMotion Hosting for hosting, database infrastructure, and the kirkor.com mail server that delivers password-reset email.
• Open-Meteo for weather and marine forecasts, with OpenWeather as a weather fallback.
• NOAA CO-OPS for tide predictions and water temperature, with WorldTides as a tide fallback.
• The National Weather Service for precipitation probability and marine and severe-weather alerts.
• Nominatim (OpenStreetMap) for location lookups.
• Google for Analytics.

These providers receive only the information necessary to perform their services.

We may also disclose information when required by law.

What we will never do

We will not:

• Sell or rent your personal information.
• Use your saved harbors or vessels for advertising.
• Send marketing emails because you created an account.

The only emails sent by Aweigh are service-related messages that you request, such as password-reset emails.

Your choices

You can update your display name, password, harbors, and vessels through your account settings. Your email address is your sign-in identifier and cannot be changed there yet; write to info@kirkor.com if you need it corrected.

Your account settings list the devices set to stay signed in, and “Sign out everywhere else” ends all of them except the one you are using. Changing your password ends every one of them, including the current device.

You can delete your account yourself, at any time, from the bottom of your account settings. It asks for your password and a typed confirmation, and it takes effect immediately.

Deletion removes the account and everything stored with it: your saved harbors, your vessels and thresholds, your password-reset records, your signed-in device records, and the record of which legal documents you accepted. Nothing is archived and no copy is kept, so an account cannot be restored once it is deleted. You are welcome to sign up again with the same email address.

Retention

Account information is kept while your account exists, and is removed immediately when you delete it.

Password-reset tokens expire after one hour and can only be used once.

“Stay signed in” records expire after one year. They also end immediately when you sign out, change your password, or use “Sign out everywhere else,” and expired records are deleted automatically.

Failed sign-in records are retained only long enough to support rate limiting.

Cached forecast and tide information expires automatically.

Security

Aweigh is served over HTTPS.

Passwords are stored as bcrypt hashes and are never stored in readable form. Session cookies are configured for secure use, and sign-in attempts are rate-limited.

“Stay signed in” cookies are stored only as a hash, so the stored value cannot be turned back into a working sign-in. Each one is replaced with a new value every time it is used, which lets us detect a copied cookie and end that device's access.

No online system can guarantee absolute security. We recommend using a password that is not reused on other websites or services.

Children's privacy

Aweigh is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

If we make a material change to this policy, we will update its version and ask account holders to review and accept the revised version before continuing to use account features.