← Back

Privacy & Cookies

Effective: 11 May 2026 · Applies to mervare.app and all <marina>.mervare.app subdomains.

We try to be honest and minimal. There is no analytics product, no advertising network, and no third-party tracker on this site. The tables below list every cookie and browser-storage item the site sets, what it is for, and how long it lives.

1. Who we are

Mervare is operated by the site administrators reachable at kepsic@gmail.com. Email us for any data-protection request — access, rectification, erasure, portability or objection under GDPR Articles 15–22.

2. Strictly-necessary cookies

These are required to operate the site. Under the ePrivacy Directive (2002/58/EC, Art. 5(3)) they do not require your prior consent. They are HTTP-only, Secure and SameSite=Lax.

NamePurposeLifetime
marina_sessionKeeps you signed in (JWT). Set after email-OTP or Google login.30 days
marina_boat_shareGrants read access to a single boat after you enter the owner's PIN.Until expiry set by the owner
stateAnti-CSRF nonce during a Google OAuth round-trip.5 minutes

3. Functional local storage

Stored in your browser's localStorage on this device. Never sent to our servers. Clearing your site data removes them.

KeyPurpose
mervare:consent:v1Remembers that you dismissed the cookie notice.
mervare:routeYour last drawn passage waypoints.
mervare:show-vesselsAIS vessel layer toggle.
mervare:show-harborsEstonian Harbor Register layer toggle.
mervare:show-windWindy wind-forecast overlay toggle.
mervare:show-depthEMODnet bathymetry / OpenSeaMap seamarks toggle.
mervare:guest-boatLength / beam / draft you typed into "fit my boat".
mervare:hide-misfitsHides harbours your boat won't fit.
hara:landing:viewMap vs. list view preference on the landing page.
marina:show-depthDepth/seamarks toggle on a marina's dock map.

4. Personal data we hold

For signed-in users: email address (login), display name, the boats you own or have access to, and any data you choose to publish on your boat page (photos, documents, guestbook entries, relay-scenario settings).

For boats with telemetry: position, wind, depth, battery and similar measurements transmitted by your on-board gateway. This data is associated with your boat slug and retained as a rolling history (typically 90 days for full-resolution samples, longer for daily aggregates).

For marina staff: the booking calendar, guest contacts and Stripe payout details you enter into the marina dashboard.

5. Third-party services we rely on

These run as separate data processors. Loading any map or payment view sends your IP address to the corresponding provider — that is unavoidable, the same way visiting any web page reveals your IP to the host.

  • OpenStreetMap — base map tiles (privacy policy).
  • EMODnet Bathymetry — depth raster tiles when the depth overlay is enabled (terms).
  • OpenSeaMap — seamark overlay when enabled (imprint).
  • Windy — embedded as an iframe only when you turn the wind overlay on (privacy policy).
  • Stripe — payment processing during booking (privacy policy).
  • Vercel — site hosting and CDN (privacy policy).
  • Supabase — primary database for accounts, marinas and bookings (EU region).
  • Google — only if you choose Sign in with Google; we receive your name, email and avatar URL.

6. Your rights

Under GDPR you may request access to, correction of or deletion of your data, restrict or object to processing, and receive a machine-readable export. Email kepsic@gmail.com — we respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority (in Estonia: Andmekaitse Inspektsioon).

7. Changes

If we add anything that needs explicit consent (analytics, advertising, etc.) we will replace the informational notice with a proper accept / reject prompt before the new tracker runs, and bump the date at the top of this page.

Terms & navigation disclaimer