Privacy Policy

1. Scope

This policy explains how the Gillby operator identified above handles information through the Service. Information processed depends on the features used and whether the Service runs with local or hosted storage. Third-party websites and applications have their own privacy policies.

2. Information we process

• Accounts: email address, authentication information, session records, and terms acceptance version and time. Password authentication is handled by the configured authentication system; local accounts store password hashes. If you register a passkey, the authentication provider processes its credential information.
• Your settings and plans: boat profile and dimensions, preferences, saved places, trips, alert settings and other information you choose to save. Some information stays in browser storage; hosted accounts store preferences, planning records and explicitly saved boat-storage addresses on our backend. Personal files saved through Private device documents are encrypted in this browser and are not uploaded to Gillby. File names and contents remain inside the encrypted device vault.
• Location: selected places, map areas, route endpoints and coordinates submitted in requests. If you permit browser location access, coordinates may be used for relevant location features and requests. A selected place or submitted route can reveal location even if device permission is denied.
• AI requests: prompts, recent conversation context, tool inputs and results needed to answer you. Do not submit passwords, payment information, sensitive health details or information you are not authorized to share.
• Technical information: requests, IP addresses and device or browser information available to hosting and service providers, timestamps, errors and security logs. When enabled, first-party product telemetry records page categories, feature interactions, request status and timing, a tab-session identifier and AI usage information.
• Communications: information you send when contacting us, including privacy and legal requests.

3. Why we use information

We use information to provide accounts, forecasts, maps, AI responses and planning tools; save preferences; operate and troubleshoot the Service; measure performance; prevent abuse; respond to requests; document agreements; and meet legal obligations or establish, exercise or defend legal claims. Where a law requires a specific legal basis or consent, we will rely on an applicable basis or obtain that consent before the relevant processing.

4. AI providers and other recipients

AI requests and relevant conversation, boat, location and tool context are transmitted to the configured AI provider, which may include OpenAI or Anthropic. Provider processing and retention depend on the provider, product, account settings and applicable agreements. Do not assume an AI conversation is confidential or that a provider retains no data.

Hosting, authentication, database and infrastructure vendors process information needed to operate the Service; the hosted implementation can use Supabase for authentication and saved account settings and planning records. Private device documents are excluded from these backend records. Map tiles, fonts, camera players and external media can involve direct requests to their providers, revealing your IP address and the area or content requested. Opening an external link shares information according to your browser settings and that provider’s policy.

We may disclose information when legally required, to protect rights and safety, investigate abuse, or in connection with a merger, acquisition or asset transfer subject to applicable protections. We do not currently sell personal information or share it for cross-context behavioral advertising. We do not treat this policy as permission to start such activities without required notices and choices.

5. Cookies, browser storage and telemetry choices

Authentication uses cookies. Browser storage can remember display preferences, boat settings and other feature state. Optional first-party browser telemetry records page categories, feature use, signup completion, and broad traffic-source categories (such as Google or an AI assistant), without sending raw referrer URLs or query strings. A tab-scoped session connects these events. It runs only when enabled in the deployment and is skipped when the browser sends Do Not Track or Global Privacy Control. Production website traffic is also measured with Vercel Web Analytics, which provides page views, estimated visitor counts, referrers and broad device/location statistics in our hosting dashboard without analytics cookies. We remove page query strings and fragments and limit collection to recognized page routes. We skip this tracking when the browser sends Do Not Track or Global Privacy Control. That choice does not disable operational requests, account storage, security logs or all third-party processing. Server-side MCP operational analytics count protocol discovery, tool names, broad client categories, outcomes and timings. A keyed fingerprint of the edge-provided network address and normalized client software information estimates repeat usage; raw IP addresses, prompts, tool arguments, coordinates and credentials are not stored in these analytics. Directory scanners and internal checks are separated from external adoption. Fingerprint aggregates are retained for up to 90 days and non-identifying daily usage aggregates for up to one year, with scheduled cleanup.

Our product telemetry schema limits recorded properties and does not accept raw prompts, email addresses or precise coordinates as telemetry properties. This does not mean those details cannot be processed in feature requests or infrastructure logs. You can clear browser storage, block cookies, deny or revoke location permission, and stop using optional features through browser controls; some functions may then stop working.

6. Retention and security

Private device documents require a compatible passkey to derive their encryption key. They lock when the page is hidden and periodically while open. Gillby does not back up, recover or synchronize these files. Clearing this browser’s site data or losing the necessary device data or passkey can permanently remove access; keep your originals. Your passkey provider may synchronize the passkey under its own settings, but Gillby does not synchronize the document files. Choosing Save copy creates a separate file under your device’s normal file protections.

We retain information as needed for the purposes described here, including operating accounts, providing saved features, investigating issues, meeting legal obligations and resolving disputes. Local product telemetry has a cleanup process targeting records older than 30 days; hosted logs, backups, authentication records, saved settings and plans, and AI provider records have separate retention arrangements. Deleting browser storage or signing out does not delete server-side records. We do not promise immediate erasure from backups or third-party systems.

We use technical and organizational safeguards appropriate to the Service, but no system or transmission method is completely secure. Please protect your account and report suspected security issues to our contact below.

7. Requests and your rights

Email info@onewave-ai.com to request access, correction, a copy of your information, account deletion or other privacy assistance. Include the account email and what you are requesting; do not include your password. We may need to verify identity or authority before acting. Depending on your location and applicable law, you may have rights to deletion, portability, restriction, objection, consent withdrawal, an appeal or a complaint to a regulator. We will respond as required by applicable law, subject to lawful exceptions and retention obligations.

Changing saved data in the Service changes the relevant records where supported. Account deletion requests are handled through the email contact; signing out is not account deletion. We do not discriminate against you for exercising legally protected privacy rights.

8. Children and international processing

Gillby is intended for adults 18 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

Our providers may process information in the United States and other countries with different privacy laws. Where applicable, transfers must use safeguards required by law; using the Service does not waive those protections.

9. Updates and contact

We will update the version date when this policy changes and provide additional notice or obtain consent when legally required. A policy update does not itself authorize a materially different use of previously collected information where consent or another legal basis is required.

Privacy requests and concerns: info@onewave-ai.com. The operator’s legal business name remains pending as identified above.