Privacy Policy

1. Who is responsible

The controller responsible for the processing described here is:

Thumanns LLC
7901 4th St N, Ste 300
St. Petersburg, FL 33702
United States
Email: mail@boatparts.app

boatparts.app is available worldwide. The EU General Data Protection Regulation applies to the processing described here, and we comply with it.

Our representative in the European Union (Art. 27 GDPR), whom people in the EU may contact on any question about their personal data, in addition to or instead of contacting us:

Moritz Thumann · mail@boatparts.app

We have not appointed a data protection officer, because we are not required to under Art. 37(1) GDPR: we are a very small operation, and our core activity is neither large-scale regular and systematic monitoring nor large-scale processing of special categories of data.

2. What we process, at a glance

boatparts.app is a marketplace for boat parts. To run it we need a small amount of data about you. We do not sell your personal data. We do not share it for cross-context behavioural advertising. The app and this website carry no advertising networks, no analytics and no tracking. The one exception is the optional newsletter, where we measure opens and clicks — described in section 9.

3. Account and profile data

You can browse listings without an account. To publish a listing, send a message or make a purchase request you need to register — with an email address and password, or via Sign in with Apple or Sign in with Google.

Authentication runs on Firebase Authentication. We never see your password: it is transmitted to Firebase and stored only as a salted hash. If you use Apple or Google sign-in, we receive the identifier and the email address released by that provider — with Apple you can choose to hide your real address and use a relay address instead.

Your public profile is visible to other users and contains what you enter: display name, optional boat name and length, optional avatar and social links, your rating, and the number of your active listings. Please only enter what you are happy to make public. Your email address is never shown to other users.

4. Listings, photos and messages

Listings you publish are visible to everyone using the app, including people who are not signed in. That includes the text, the category attributes, the price, the photos and the approximate location.

Photos. Images you upload are stored in Firebase Storage. Photos can carry metadata (EXIF), including the exact coordinates where the photo was taken. Check your camera settings if you would rather not share that.

Messages. Chats and purchase requests between buyers and sellers are stored so both sides can access the conversation. They are not end-to-end encrypted: we are technically able to access message content, and we will do so only where it is necessary to investigate a report, to prevent abuse, or where the law requires it. Do not send payment details, passwords or identity documents through the chat.

5. Location data

Location is the heart of the app: it is how you find parts in the harbour you are actually in. We ask for location access when you first need it, and you can decline or revoke it at any time in your device settings. Without it you can still use the app, but you will not see distances or a radius search around your position.

We use your position only to answer the question you are asking the app at that moment — what is for sale near me, and where should my own listings appear. We do not build movement profiles, we do not keep a location history, and we do not use location for advertising or analytics.

• Your device position is used to sort and filter listings by distance and to place your listings on the map.
• Other users see a rounded, approximate location and a place label (for example the town or harbour), plus the distance to them. Your exact coordinates are never made available to other users.
• Dealer accounts are the exception. A dealer is a business, and a dealer's listing location is its trading address — already published on its own website and its door — so those listings show the exact position rather than a rounded one, and the app says so on the listing form. This applies only to accounts on the Dealer plan. A private seller's position is rounded whatever they pay.
• Your position is used on your device to work out distances. We do not store a location history — no trail, no track, no record of your passage.
• We do store one position: the last place at which we asked you whether to move your listings, rounded the same way a listing's location is. It is overwritten each time we ask, so it is a single point and never a sequence. Its only purpose is to work out whether you have moved far enough to be worth asking again, so that the app does not repeat the question every time you open it.
• A listing keeps the location you gave it when you published it. If you have moved more than about ten nautical miles, the app asks whether to bring your active listings along; it never moves them on its own, and you can decline or edit any listing's location yourself at any time.
• To turn coordinates into a place name and back, we use the geocoding service built into your operating system (Apple or Google, depending on your device).

Map tiles. The map is drawn from OpenStreetMap data with tiles served by CARTO. When the map loads, your IP address reaches CARTO's servers as a technical necessity of requesting the tiles. Harbour and anchorage data is retrieved from the OpenStreetMap Overpass API.

6. Push notifications

If you allow notifications, we use Firebase Cloud Messaging to tell you about new messages and purchase requests. To do that we store a device push token. Withdraw permission in your device settings at any time; the token is then no longer usable.

7. Subscriptions and payments

boatparts.app is free to use. Optional Premium and Dealer subscriptions raise how many listings you can keep active at once.

We never see your payment details. Subscriptions are sold and billed exclusively through Apple's App Store or Google Play. Your card, address and billing data stay with Apple or Google, who are independent controllers for that processing.

To know whether your subscription is active, we use RevenueCat, Inc. as a processor. RevenueCat receives a pseudonymous app user ID and the purchase and entitlement status from the app stores. It does not receive your name, your email address or your payment details from us.

8. This website

This website sets no cookies, embeds no third-party fonts, no analytics and no tracking pixels. Loading a page requests nothing from any other company. That is why you see no cookie banner: there is nothing to consent to. The contact form has no server behind it — it opens a message in your own email app, and nothing you type reaches us until you send it yourself. The one place where data leaves this site is the newsletter form, and only at the moment you submit it — see the next section.

The site is hosted on Firebase Hosting (Google). When you request a page, the server processes technical data such as your IP address, the time of the request, the page requested, the referrer and your browser identification. This is technically necessary to deliver the page and to keep the service secure and stable (Art. 6(1)(f) GDPR). Server logs are deleted or anonymised on Google's standard schedule.

9. Newsletter

You can subscribe to our newsletter on the home page. It is entirely optional and has nothing to do with using the app.

We use Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, part of Brevo SAS, France) to send it. When you submit the form, your email address and the fact that you gave consent are transmitted to Brevo and stored there on our behalf as a processor under Art. 28 GDPR. Brevo processes the data on servers in the European Union.

Double opt-in. After you submit the form we send you one email with a confirmation link. Only once you click it are you actually subscribed. If you do not confirm, the address is not used and is removed. This step exists so nobody can sign up an address that is not theirs, and it gives us a record of your consent.

Legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future — every newsletter contains an unsubscribe link, and you can also write to mail@boatparts.app. Withdrawing consent does not affect the lawfulness of what we sent before.

What we measure. We measure how the newsletter performs, so we can tell which topics are worth writing about and stop sending things nobody reads. Concretely:

• Opens. Each newsletter contains a small invisible image hosted by Brevo. When your email program loads it, we learn that the message was opened, when, and roughly which kind of program and device you used.
• Clicks. Links in the newsletter point at a Brevo address that forwards you to the real page. That tells us which link was clicked, and when.

Both are tied to your email address, so this is personal data and not just anonymous statistics. It is covered by the consent you give when you subscribe — the checkbox on the sign-up form says so, and this section explains it in full (Art. 6(1)(a) GDPR). We use the result only to write a better newsletter. We do not build a profile of you, we do not use it to target advertising, and it has no effect on your boatparts.app account.

If you would rather not be measured: set your email program to not load remote images, and open links by copying the address rather than clicking. That removes the open tracking entirely and most of the click tracking. Unsubscribing ends both, and you can tell us at mail@boatparts.app that you object to the measurement while staying subscribed — we will then exclude your address.

Retention: your address stays in the newsletter list until you unsubscribe. Open and click statistics are kept for as long as you are subscribed and deleted with your address. We keep a record of your consent — the confirmation, with its timestamp — for as long as we send you the newsletter and for three years afterwards, so we can show that it was given.

Your newsletter subscription is separate from your boatparts.app account. Deleting your account does not unsubscribe you, and unsubscribing does not delete your account.

10. Service providers

We use the providers below. Where a provider processes personal data on our behalf — Google/Firebase and RevenueCat — we have a data processing agreement in place under Art. 28 GDPR. CARTO and the OpenStreetMap Foundation are not our processors: your device requests map tiles and harbour data from them directly, and only your IP address and the requested area reach them.

Beyond this we pass your data on only where you have consented, where it is necessary to perform our contract with you, or where we are legally obliged to — for example in response to a lawful order from a public authority.

11. Where your data is processed

We are based in the United States, and the service is operated from there. When you use boatparts.app, your data reaches us in the United States. Our providers may also process data in the United States and in other countries.

For users in the European Union: sending your own data to a company outside the EU by choosing to use its service is not an "international transfer" needing a transfer tool — but the GDPR still applies to us, and we still protect your data to its standard. Where we pass data on to providers outside the EU, we rely on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR or, for providers certified under the EU–U.S. Data Privacy Framework, on the adequacy decision under Art. 45 GDPR. You can ask us for a copy of the relevant safeguards.

Please also keep in mind that boatparts.app is a worldwide marketplace: a listing you publish or a message you write can be seen by people in other countries.

12. How long we keep data

• Account data — for as long as your account exists.
• Listings — until you delete them or delete your account. Sold and paused listings may be kept for a short period so both sides can refer back to a completed deal.
• Messages — until the conversation is deleted by both participants, or until either participant deletes their account, which removes the conversation for both sides.
• Location — we store no location history on our servers.
• Ratings — ratings you gave stay visible on the profile of the rated user, since removing them would distort the record for everyone else. After you delete your account they are shown without a link to your deleted profile.
• Newsletter — until you unsubscribe; the record of your consent for three years after that.
• Reports and abuse cases — for as long as needed to handle the case and to defend against legal claims.
• Business and tax records — where accounting, tax or other law requires us to keep records, we keep them for the applicable statutory period and use them for nothing else in the meantime. In practice we retain financial records for seven years.

You can delete your account yourself at any time, in the app under Profile → Settings → Danger zone. Deletion runs immediately once you have typed the confirmation word. See boatparts.app/delete-account for exactly what is removed, what stays, and what to do if you no longer have the app installed.

13. Your rights in the European Union

If the GDPR applies to you, you have the right to:

• Access (Art. 15) — ask what data we hold about you.
• Rectification (Art. 16) — have inaccurate data corrected.
• Erasure (Art. 17) — have your data deleted.
• Restriction (Art. 18) — have processing limited.
• Data portability (Art. 20) — receive your data in a machine-readable format.
• Objection (Art. 21) — object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3)) — withdraw consent at any time, with effect for the future. This applies in particular to location access and push notifications, both of which you control in your device settings.

To exercise any of these, write to mail@boatparts.app, or contact our EU representative named in section 1. We will respond within one month.

14. Your rights in the United States

US privacy law is a patchwork of state statutes, most of which apply only above thresholds a company of our size does not reach. Rather than copy boilerplate, here is the honest position:

• California. We are not a "business" under the California Consumer Privacy Act, because we meet none of its thresholds — we are far below the revenue figure, we do not handle the personal information of 100,000 or more consumers or households, and we earn no revenue from selling or sharing personal information. We do not sell or share your personal information for cross-context behavioural advertising, which is why you will find no "Do Not Sell or Share" link on this site. If that ever changes, we will change this policy first.
• Do Not Track. We do not track you across third-party websites or services over time, so there is nothing for a Do Not Track signal to switch off. We therefore do not respond to Do Not Track browser signals. No third party collects personal information about your activity across other sites through boatparts.app.
• Florida. The Florida Digital Bill of Rights applies to controllers with more than one billion dollars in global annual revenue. It does not apply to us. Being a Florida company does not by itself change that.
• Other states. The comprehensive privacy laws of Virginia, Colorado, Connecticut, Texas and other states share the same pattern of volume or revenue thresholds, and we are below all of them.

None of that stops you from asking. Whatever state or country you are in, write to mail@boatparts.app and we will give you a copy of your data, correct it, or delete it. We would rather do that than argue about whether we have to.

15. Security

All traffic between the app, the website and our backend is encrypted in transit with TLS. Access to production data is restricted, and database security rules limit what each account can read and write. No system is perfectly secure, but we take appropriate technical and organisational measures to protect your data.

If a security breach affects your personal data, we will notify you and the relevant authorities where the law requires it, and without undue delay.

16. Children

boatparts.app is not directed at children and we do not knowingly collect personal data from them. You must be at least 16 years old to create an account.

If you are a parent or guardian and believe a child has given us personal data, write to mail@boatparts.app and we will delete the account and the data.

17. Changes to this policy

We may update this policy when the app changes or the law does. The current version is always at boatparts.app/privacy-policy, with the effective date at the top. If a change materially affects you, we will tell you in the app or by email before it takes effect.