Privacy policy
You can read every page without an account. We measure visits with Google Analytics and Cloudflare Web Analytics only if you say yes.
This policy says what we collect, why, for how long and who sees it, and how to ask us to show you, change or delete it.
In short
- No accounts. Nobody needs one to read or to report.
- Analytics only if you agree. Nothing from Google loads before you choose.
- Email only if you give it, to reply about your report.
- Photos without location data, faces and boat names blurred.
On this pageOn this page
Introduction
OlaSail is a guide to sailing in Croatia at olasail.com. It is published by Zukunft d.o.o., Grožnjanska ulica 32, 10000 Zagreb, Croatia, which we call "we" in this policy.
This policy explains how we collect, use and protect your personal data when you read the site, report a change, send us a photo or save a week in the route planner. Our Photo licence covers who owns the photos you send, and our terms of use say what you may send us and how we moderate it.
Definitions
- The site
- olasail.com and all its pages.
- Personal data
- Anything that tells us who you are, on its own or with other data, like your email address.
- Usage data
- What is recorded about a visit, like the pages you read and for how long.
- Cookies
- Small files a website keeps in your browser.
- Controller
- Whoever decides why and how your data is used. For this site, that is us.
- Processors
- Companies that handle data for us, like our web host. We call them service providers.
- You
- The person the data is about, whether you read the site or send us something.
Information collection and use
We collect a few kinds of information, each for a clear reason: to run the site, to keep its facts right, to thank the sailors who help, and, if you agree, to see which pages people read.
We collect as little as we can. Report a change needs only the report itself and one question about ties, and the rest is up to you. The operator form also needs a name, an email and a website, so we can confirm who sent it.
Types of data collected
Personal data
- Report a change
What you tell us: the page or place, what changed, how you know, the day you saw it, and whether it is about safety.
- Ties to a business
Your answer when we ask whether you work for, own, or have family in a business at or near the place, and which business if you say yes. We ask everyone, so an editor can check the report with a source that has no ties to you.
- Your boat
Only if you give it: its type and length, like "a catamaran", never its name. It lets two reports from one boat count once.
- Your email
Optional when you report a change. The operator form asks for it, so we can confirm who sent it.
- Credit me as
Only if you fill it in: your first name and the first letter of your family name.
- Your age
You must be 16 or older to send us anything. If you give us an email or a credit name, you tick a box to confirm it. We never ask for your date of birth.
- Operators
If you send your business's prices, hours and services: the business, its place and website, what you tell us, your name and role, your email and, if you give it, your phone.
- "Still right?"
When you tap "Yes, I saw it" or "Something changed" on a fact: the fact, your answer and the day you were there. Nothing that says who you are.
- Photos you send
The photo and the details a phone stores in it, such as when and where it was taken.
- Area stewards
If you look after an area for us: your name, how to reach you, the areas you sail and any ties to operators there.
Saved weeks and route shares
If you save a week, we keep its route choices, any boat measurements you enter, and your private booking notes on our server. Boat details and notes are encrypted in storage, and no editor's screen shows saved weeks. A cookie, the planner cookie, lets this browser find its saved weeks without an account. Clearing it, or using another browser, loses private access.
You can delete a saved week, or every week this browser saved, from the route planner. We delete them 365 days after your last use of the planner. "Delete all saved weeks in this browser" deletes them at once, and deleting your last saved week deletes your planner record and the cookie at once too. A shared route is a separate read-only copy of its route choices. It never includes your boat details or private notes. Anyone with its link can read it until you revoke its shared copies or delete the saved week: shares go with their week. Later edits do not change a shared copy.
Public posts we quote
In "What sailors told us", some pages quote or retell short public posts from sailing forums, blogs and news pages. We show the author's name as the post shows it, the date and a link to the post. We do this for a fair reason of ours (GDPR Article 6(1) point f): a sailor's first-hand account helps other sailors plan, and the author posted it in public. We have no way to reach most authors to tell them, so this paragraph is how we tell them (Article 14(5)(b)). If a post is yours, write to us to object, or to have it taken off our pages.
Usage data
If you allow analytics, Cloudflare Web Analytics counts the page, the site you came from, your country, your device and browser, and how fast the page loaded. It sets no cookie, keeps nothing in your browser, doesn't keep your address and doesn't follow you to other sites. We can see its counts for six months.
If you allow analytics, Google Analytics also records how you use the site: the pages you read, how long you stay, how far you scroll, the links to other sites you follow, the words you type in our search, the forms you start or send, the videos you play, the files you download, the site you came from, your rough location, and your device and browser. It also records our own events: when you first move a map, save a week, share a page, answer "Still right?", send a form or change the boat speed. See Analytics.
Our web host, Cloudflare, sees every request, such as the address it came from and the time, to keep the site running and safe. The pages keep no request logs of their own. Our server for forms and saved weeks, api.olasail.com, keeps short technical logs to run safely, for up to 28 days. It doesn't log your browser's address. Cloudflare keeps its logs only as long as its purposes and the law need, and names no fixed period: see Cloudflare's privacy policy, section 11.
Cookies
When you first visit, a small banner asks whether we may use analytics. You can press "Accept" or "Reject", or close it, which counts as "Reject". "Settings" shows the two choices:
| Choice | What it does |
|---|---|
| Essential | Always on. It keeps the site working, and the cookie olasail_consent remembers your choice, so the banner doesn't ask again: a yes for 12 months, and a no, or closing the banner, for 6 months. |
| Analytics | Off until you turn it on. It lets Google Analytics and Cloudflare Web Analytics measure visits and how pages are used, so we can see which pages help. (From the operator, ) |
When you start filling in a form, the page loads Cloudflare's spam check, Turnstile. It is essential, like the first choice, because the forms can't work safely without it, so it is not a choice in the banner. See Service providers.
Saving a week sets one cookie of our own, the planner cookie. It is strictly necessary for the service you asked for, so it needs no banner choice:
| Cookie | What for, and how long |
|---|---|
__Host-olasail_planner | Lets this browser find the weeks it saved, with no account. First set only when you press Save or Share, next to a note that says it uses a cookie. HTTP-only, so no script on a page can read it, and sent only to our planner's own address, api.olasail.com, never to another site. Strictly necessary, so it needs no banner choice. Each use renews it, and it expires 365 days after your last use. |
If you allow analytics, Google Analytics sets these cookies:
| Cookie | What for, and how long |
|---|---|
_ga | Tells one visitor from another. It lasts 2 years. (From the operator, ) |
_ga_KCK7P9PT4J | Keeps track of one visit. It lasts 2 years. (From the operator, ) |
Google Analytics 4 sets two first-party cookies: _ga, to tell visitors apart, and _ga_ followed by the site's measurement ID, to keep track of a visit. Both last 2 years by default. A browser may delete them sooner if you don't come back: Chrome after 400 days and Safari after 7 days. If you say no, they are never set. If you take your yes back later, we delete them and reload the page, so Google Analytics stops at once.
Your browser also keeps three small settings for you, outside any cookie. They stay on your device and are never sent to us:
| Setting | What for, and how long |
|---|---|
olasail_boat_speed | The boat speed you pick on a route page, so the hours under way match your boat. Kept until you clear your browser's data. |
olasail_strip_size | The height you choose for the map on a phone or tablet. Kept until you close the tab. |
olasail_consent_saved_off | Shows "Saved. Analytics is off." after the page reloads, then is deleted. |
Change your mind at any time. Use the button below, or the "Privacy and cookie settings" link at the foot of every page.
Photos
- We remove the location dataThe copy we use has no position, time or phone details stored in it. We note the date and the place ourselves.
- We blur faces, boat names and registrationsOther crews never agreed to be on our pages.
- We keep your original privatelyOnly to check when and where it was taken, and only editors can see it.
Use of data
- To check and fix our pagesA report is checked with the source before a page changes. Its words may also show in "What sailors told us", marked as sent, shortened or in our words.
- To reply to youYour email is only for questions about your report, or to tell you what we changed.
- To thank youYour credit name goes on the page you helped with, its change log and People, only if you asked.
- To keep the weeks you saveYour route choices, boat details and private notes, only when you save a week, so this browser can open it again. Nobody else sees them.
- To share a route you choose to shareA read-only copy of its route choices, for the people you send the link to.
- To see which pages helpVisit counts from Cloudflare Web Analytics and Google Analytics, only if you agreed.
- To keep the site running and safeThe web host's short logs.
- To keep the forms free of spamCloudflare's check when you send a form, and a limit on how many forms one address can send in a short time.
In the words of the law (GDPR Article 6(1)), we use your data:
- Because you agreedPoint a: analytics, your public credit name and an area steward's public name. You can take a yes back at any time.
- To run a service you asked forPoint b: your saved weeks, their notes and the routes you share, and an area steward's contact details and areas.
- For a fair reason of oursPoint f: to check reports and reply to the email you left, to check and publish the photos you send, without location data, faces or boat names, to note a steward's ties to operators and keep a steward's details after they stop, to confirm who sent an operator form, to quote short public posts with their author's name and a link, to answer your emails and keep a record of them in case of a legal claim, to show maps and forecasts, and to keep the site and its forms safe. You can object to this: see Your rights.
Retention of data
| What | How long |
|---|---|
| Your email, from a report | Deleted 12 months after we close the report. |
| An email you send to hello@olasail.com | Kept 5 years after our last contact, in case a question or a legal claim comes up. Then we remove your name and email address and keep only what you wrote. |
| An area steward's details | While you look after an area, and 5 years after you stop. Then we remove your name and contact details. |
| An operator's name, email and phone | Deleted 12 months after we close the report. |
| Your report's words, your boat and your answers | Kept with the fact's history while the page exists. The public log shows only what changed, when and why. |
| A report no editor decides | Closed on its own, unchecked and without an email, 24 months after it came in. The times above then count from that day. |
| Your credit name | Until you ask us to take it off. Then the page and the log say "a sailor". |
| Your original photo | Deleted 12 months after we close the report. A photo we published stays until you ask us to take it down. |
| A public post we quote | As long as a page shows it, or until the author asks us to take it off. |
| "Still right?" answers | Kept as counts. They hold nothing that says who you are. |
| The address your browser sends with a form | Held for minutes, at most a day, only to limit how many forms one address can send. Never kept with your report. |
| Analytics data at Google | 14 months, then Google deletes it. We don't restart the clock when you come back. (From the operator, ) |
| Your cookie choice | A yes: 12 months, then we ask again. A no, or closing the banner: 6 months, then we ask again. |
| Visit counts at Cloudflare Web Analytics, if you allow analytics | We can see them for six months. They hold nothing that says who you are. |
| Your saved weeks and their private notes | Deleted 365 days after your last use of the planner, or at once when you delete them. |
| A route you shared | Shares go with their week: until you revoke it or delete its saved week. |
| The planner cookie and the record it points to | Deleting your last saved week deletes your planner record and the cookie at once. Otherwise the cookie expires, and we delete the record, 365 days after your last use. |
| Anything deleted, in our database backups | 30 days, when the backup that holds it ages out. |
Transfer of data
We keep your data in the EU where we can. Our database and saved weeks are on servers in Germany, and photos and database backups are in Cloudflare's EU storage.
Some companies we use are in the United States and may handle data there:
- GoogleGoogle Analytics, only if you allow it, and the inbox where emails to hello@olasail.com arrive. Google LLC has certified that it follows the EU-US Data Privacy Framework for personal data it receives from the EU, and it is subject to the US Federal Trade Commission. (From the operator, )
- CloudflareIt serves every page from servers around the world and forwards emails sent to hello@olasail.com. Cloudflare is certified under the Data Privacy Framework.
- Mailgun (Sinch)It sends receipts and replies about reports through its EU region. Messages and delivery logs are stored in that region. Account data is replicated globally, and support may involve processing outside the EU.
- GitHubIt keeps the site's text, including accepted changes and credit names. GitHub is certified under the Data Privacy Framework.
- Amazon Web ServicesIt serves the hill shading on our maps. AWS is certified under the Data Privacy Framework.
The EU-US Data Privacy Framework covers transfers to the certified providers above. Sinch's data processing agreement also provides safeguards for international transfers, including the European Commission's standard contractual clauses. If you don't allow analytics, nothing about your visit goes to Google Analytics.
Disclosure of data
- Our editorOur editor reads every report and every email. Only an editor sees your email address and your original photo.
- The area stewardFor an area that has one, they read the reports about it, without your email address.
- Never the operatorA marina, buoy field or restaurant never sees who sent a report about it.
- The publicOnly your credit name, if you asked for one, and a photo we published, credited as you asked.
- When the law asksWe share data with the authorities only when the law requires it.
We never sell your data.
Security of data
Only editors can reach reports, emails and original photos, and every page is sent over an encrypted connection. No method is perfectly safe, but we keep what we hold small and delete it on time.
Your rights under the GDPR
Under the EU's data protection law, the GDPR, you can ask us to:
Get a copy of what we hold about you.
Article 15Fix anything that is wrong.
Article 16Remove your email, your name, your photos and your saved weeks.
Article 17Press "Delete all saved weeks in this browser" in the route planner: every saved week, note and shared link of this browser goes at once, with its cookie.
Article 17Pause how we use it while we check what you told us.
Article 18Where we use your data for a fair reason of ours, object at any time. We stop unless our reasons clearly outweigh yours.
Article 21Get what you gave us in a file you can reuse.
Article 20Take back a yes, for analytics or a credit, at any time.
Article 7Your saved weeks are found only through this browser's planner cookie. Without it we can't tell which weeks are yours, so we can't show or delete them for you, and they go 365 days after your last use of the planner (Article 11). Whatever is deleted stays in our database backups for 30 days, until they age out.
We haven't appointed a data protection officer, because the law doesn't ask a site like ours to. We make no automated decisions about you and build no profiles.
Write to us and we answer within one month. If you think we got it wrong, you can complain to a data protection authority (Article 77): the one where you live or work (the EU's list), or ours in Croatia. Croatia's data protection authority is the Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr. (Official source, ) In the UK, it is the Information Commissioner's Office.
"Do Not Track" signals
Some browsers can send a "Do Not Track" signal. You don't need it here: analytics stays off unless you turn it on in the banner.
Service providers
We use these companies to run the site and deliver its services:
- Cloudflare
Hosts the site and keeps its short technical logs, counts visits with Web Analytics if you allow analytics, forwards emails sent to hello@olasail.com, and stores photos and database backups in the EU. It also runs Turnstile, the spam check on our forms. Turnstile is essential: it loads only when you start filling in a form, answer "Still right?" or save a week, and it is not a cookie choice. Turnstile reads the IP address, the browser's TLS fingerprint and User-Agent, and the site's key and address, only to detect and block bots, not to identify, profile or target anyone. Cloudflare also uses them to improve its bot detection. (From the operator, )
- Mailgun (Sinch)
Sends your receipt and our answer about your report through its EU region. It receives your email address and the email's content, and records delivery or failure. Open and click tracking are off: we don't use Mailgun to record whether you open our emails or click their links. Mailgun also handles security and abuse-prevention data under its own privacy notice.
- Hetzner
Runs our server and database for reports and saved weeks, in Germany.
Google Tag Manager and Google Analytics, only if you allow analytics, and Gmail, where emails to hello@olasail.com arrive.
- GitHub
Keeps the site's text, where accepted changes and credit names go.
Services your browser asks itself. On pages with a map or a forecast, your browser fetches map data from OpenFreeMap, hill shading from Amazon Web Services and forecasts from Open-Meteo. On list and route pages the map loads by itself shortly after the page opens. Like any website you visit, these services see your browser's address and the area it asks for, and we send them nothing else.
The site serves its fonts and photos itself, not from Google or other sites.
Analytics
We use Google Analytics 4, through Google Tag Manager, and Cloudflare Web Analytics to measure visits and how pages are used, so we can see which pages help sailors. Both run only if you choose Analytics in the banner. Cloudflare Web Analytics sets no cookie, keeps nothing in your browser and doesn't keep your address.
- Nothing before you chooseWe use Google's basic consent mode. Every kind of consent starts as "denied", and the Google tags don't load until you choose. (From the operator, )
- No advertisingThe three advertising kinds of consent stay "denied" whatever you choose. We don't link Google Ads, we keep Google signals off, and every data sharing setting in Google Analytics is off.
- No IP addresses keptGoogle Analytics does not log or store the IP addresses of visitors from the EU, Switzerland or the UK. It uses them only to work out a rough location, such as the country and the city, and then drops them. (From the operator, )
- 14 months, then deletedA site can tell Google Analytics to keep visit-level data for 2 or 14 months. After that it is deleted automatically, once a month. We use 14 months. (From the operator, )
How Google uses the data is in Google's own page on sites that use its services.
Links to other sites
Our pages link to official sources, operators and other sites. Once you follow a link, their own privacy policy applies, not ours.
Children's privacy
You can read the site at any age. To send us anything, such as a report, a photo or an email, to become an area steward, or to allow analytics, you must be 16 or older. In Croatia a child can agree to an online service on their own from the age of 16. (Official source, )
Changes to this privacy policy
- First version.
When this policy changes, we list the change here first, with its date, and change "Last updated" at the top. If the change affects your cookie choices, the banner asks you again.
Contact us
Questions about this policy or your data: hello@olasail.com. We answer within one month.
Sources
8 facts from 8 sources, last checked .