Privacy

Embarca has no analytics, no advertising and no third-party SDK that tracks anything, and you do not need an account to use it. Almost everything stays on your iPhone. Only what is essential to show you the map, the depth and the forecast leaves it; your route only if you share it, ask for help with the SOS or publish it in the community. The only account that exists is the one for the route community, and only if you want to publish.

What stays on your iPhone

Recorded trips, saved routes, points (fishing grounds, anchorages, sightings), the photos you save on the map or on a route, favourites and your boats are stored on the phone and, if you are signed in to iCloud, are copied automatically to your own iCloud, in the private database of your Apple account. That copy is yours: Apple stores it, it does not go through our servers and we cannot see it. It means that if you delete the app or change iPhone, your logbook comes back when you reinstall it with the same account. Without an iCloud sign-in, or with iCloud turned off for Embarca in iPhone Settings, everything stays only on the phone and is deleted if you delete the app. In the app's Settings you will see whether the copy is active; to delete it, go to iPhone Settings, your name, iCloud, Manage Storage, Embarca.

Photos on the map. When you add a photo to a map point or to a route (from your photo library or taken with the camera), Embarca stores a downsized copy (2,048 pixels at most), re-encoded and without its internal metadata (no camera, no GPS, no time inside the file). Stored with it are the position you chose (that of the point you tapped, that of the photo if you ask to use it, or the one derived from its time along your track), the date and the note you write. They are private: they stay on your iPhone and in your iCloud like the rest of the logbook, and nobody else sees them unless you share one in the community.

Your name, your boating qualification and your emergency contacts are stored only on the phone and are not copied to iCloud. If you delete the app, they are deleted with it.

On Android: your Embarca account

Android has no iCloud, and a logbook that lives only on the phone is lost with it. That is why the Android app offers an Embarca account (email and password, or your Google account). With it, your trips, routes, points, areas, favourites, boats, the photos you save on the map, your name, your boating qualification and your emergency contacts are copied to our server (api.embarca.app, in the European Union), encrypted in transit, and come back to your phone when you sign in on another one. Only your account can read them; we do not use them for anything else or pass them to anyone. Without an account, everything stays on the phone.

For the account we store your email, your name if you enter it, a hash of your password (never the password itself) and, if you sign in with Google, the identifier Google gives us. To tell your other devices that something changed we store each phone's notification token (Firebase Cloud Messaging, by Google; the notice carries none of your data). Google Play handles the Embarca Pro purchase: we never see your card.

When you sign out, your data is removed from the phone and stays in your account. You can delete the account and everything in it from the app (Settings, Embarca account, “Delete my account”) or at api.embarca.app/borrar-cuenta; it is deleted immediately.

The app uses GPS for speed, heading, distance to the coast and the logbook. You can withdraw the location permission at any time in iOS Settings: you lose those features, not the rest.

The connections the app makes to work

None of these requests carries your name or an account (except the iCloud copy, which goes to your own Apple account). The ones that go to our server (live.embarca.app; earlier versions of the app use sigue-embarca.codelabs.studio, the same server) also carry a random installation identifier and your IP address, as explained just below the table.

The detailed chart of Spain, the guide, the dictionary and the species are built into the app and work offline.

Installation identifier and IP address

Every request to our server, including simply exploring the route community, carries a random identifier that the app generates when installed (the X-Embarca-Install header) and arrives from your IP address. They serve a single purpose: limiting abuse (for example, how many SOS alerts or reports are accepted per day). The identifier is not linked to your name or your account, and the abuse counters delete themselves after one day. It is deleted when you uninstall the app.

“Always” location in the background

Embarca asks for the “Always” location permission for two reasons: to record your trip and its speed even when the screen is locked, and, if you share your route live and iOS closes the app, to be able to reopen it when you move so sharing can resume. It is only used in the background while you record, navigate with guidance or share live; otherwise it is not. You can leave it on “While Using the App” or withdraw it in iOS Settings at any time: you lose recording with the screen locked, not the rest.

Anonymous Embarca Pro counters

To find out whether the free trial and the price of Embarca Pro work, the app counts how many times four things happen: a trial starts, a trial ends, the purchase screen is shown for a specific feature, and Pro is bought. From time to time (when the app goes to the background or opens) it sends our server only these totals, together with the platform (iOS or Android) and the app version. No person, installation or device identifier is sent, nor your account or your location: the server stores only daily totals and cannot tell whose they are. We use no third-party analytics SDK, and nothing is shared with anyone.

Technical server logs

The Cloudflare server keeps, for one in ten requests (10% sampling), a technical log with the path requested, the result and the time, to detect failures. It is not analytics: it is not used to measure or profile you and is not shared with anyone.

When you share your route live

Only if you turn it on (with a return time it is free, it is “Warn if I don't arrive”; without a return time it is an Embarca Pro feature):

• What is sent: your position, speed, heading, the chart depth under the boat and the time of each point, plus the name you have entered and, if you provide them, your destination and your estimated return time. If you also choose to alert a contact, their name, phone number and, if you provide it, their email, for 24 hours at most (see “Warn if I don't arrive” below).
• To whom: to our server (Cloudflare, with the data stored in the European Union) and, from there, to whoever opens the link you share; if we alert your contacts, the SMS goes through Telnyx and the email through our own mail server. Nobody else; we do not use it for anything. The link is long and random and cannot be guessed.
• How long: everything is deleted automatically 24 hours after the last data point. A single session does not accept points for more than 72 hours.
• How to delete it sooner: with “Stop sharing and delete the route”, which removes it immediately.

The link page has no accounts, no cookies and no analytics, and the map is served without third-party trackers (the tiles are from OpenStreetMap).

“Warn if I don't arrive”

It is free for everyone, because it is about safety. Only if you turn it on when sharing your route with a return time:

• What is sent to our server: the same as when sharing your route (position, speed, heading, GPS accuracy, whether you are on the water or ashore and the time of each point), your name, your return time, the grace period you choose and, for each contact you pick for the alert (up to three), their name, their mobile number and their email if you give it.
• What is sent and to whom: if your return time plus the grace period passes and you have not tapped “I'm back” or stopped sharing, our server sends those contacts a text message (through Telnyx, to Spanish mobiles only) and an email (from [email protected], through our own mail server) with your name, your return time, your last position with its time and accuracy, your heading and speed, the link to the live map and what to do (call Salvamento Marítimo or 112). If you also choose the lost-signal alert and, while at sea, the server stops receiving your position for the time you choose, it sends them a calmer alert with the last position, and tells them if it comes back. If you tap “I'm back” or extend the time after an alert, it tells them too. The server decides this: it works even if your phone runs out of battery, gets wet or breaks.
• How long: the alert contacts and what was sent are kept only for that session: at most 24 hours after your last update or after the alert time, whichever is later. Then everything is deleted automatically. On your phone the list lives in your profile; on Android, also in your Embarca account.
• Against abuse: there are caps on alerts per session, per device, per IP address and per recipient, with counters that delete themselves within a day.
• First message to your contact: the first time you choose someone as an alert contact, we send them an SMS (or an email if they have no Spanish mobile number) telling them you chose them and what it means. To avoid repeating it we keep, for two years, an irreversible fingerprint (hash) of your installation identifier and of that person's phone number or email, never the phone number or email in clear.

Embarca does not replace 112 or Salvamento Marítimo.

Route community

Viewing and exploring other boaters' routes needs no account and sends nothing of yours except the area of the map you are looking at, the installation identifier and your IP address (section “Installation identifier and IP address”).

• Account: to publish you sign in with Apple. We do not ask for your name or your email. We store only a fingerprint (hash) of the identifier Apple provides so we can recognise you next time, the alias you choose and the sign-up date. We do not store any Apple token.
• What is published: the track of the trip you choose, the title, the description, the type of outing, the difficulty, the sea state, the distance, the duration, the month and year, the photos you choose and your alias. It is public: anyone with the app can see it.
• What does not leave your phone: the first and last 300 metres of the track are trimmed on the phone before it is sent, so the place where you moor or live never reaches the server. The times and the point-by-point speed are not sent either, nor is the name of your boat.
• Photos: they are downsized and re-encoded on the phone, and the server strips any metadata again (camera, time, GPS). Their position on the map is only published if you leave it enabled; if the photo was taken near the departure or arrival, it is published without a position. You choose them, from the ones you saved on that trip or from your photo library, and there are at most 6 per route. Do not upload other people's faces without their permission or readable registration numbers. You can delete each photo separately whenever you like and it is removed from the server immediately.
• Where: on our server (Cloudflare), with the database and the photos stored in the European Union. Photos are only served while the route is visible.
• Route web page: each published route has a page at embarca.app/en/route/… with the same as in the app (track, data, photos and alias), so it can be shared with a link. It is not indexed by search engines and is withdrawn as soon as the route is deleted or hidden.
• Photo review: every photo you upload to the community (of a route, a point or a sighting) is reviewed by us before anyone else sees it; you see it straight away. Once several of your photos have been approved and none rejected, the next ones are published without waiting, and we can withdraw them later.
• Reports and moderation: anyone can report a route or a specific photo, with or without an account. With three reports from different people it is hidden (the whole route or just that photo) until we review it. For a report we store the reason, the text if you write one and a fingerprint of your account or your IP address so it does not count twice; they are deleted along with the route. We may hide or delete content that breaks the rules and block the account that published it. Blocking an author from the app only affects your phone.
• Photos shared on a map point: if you share one of your saved photos, the photo is published (downsized, without metadata, and cleaned again on the server), together with the position you chose for it, the note, the month and year, and your alias. It is public: anyone with the app can see it on the map. It has the same reports, hiding after three reports, blocking and moderation as routes. “Stop sharing” or deleting the photo removes it from the server immediately, and “Delete my account and my routes” also deletes all your shared photos.
• Deletion: each of your routes is deleted immediately from the app, with its photos. “Delete my account and my routes” removes the account, the alias, all your routes and photos and your sessions. A draft that was never published deletes itself after 24 hours.

SOS and emergency contacts

The SOS is free for everyone. If life is in danger, call 112 first (or your country's emergency number), in Spain Salvamento Marítimo (Spanish Maritime Rescue, 900 202 202), or use VHF channel 16: Embarca alerts your contacts, not the emergency services.

• When you add a contact: our server sends them an SMS, through Telnyx, to let them know they are your emergency contact. For that, their number and your name are sent. The contact list lives on your phone; when you use the SOS or share with a contact, a temporary copy (name and number) goes to the server, as explained below.
• If you trigger an SOS: each contact receives an SMS with your name, your position, the link to follow you live and your route plan if there is one; if you choose what has happened, a second short SMS with the reason.
• What the server stores: the name and phone number of your emergency contacts, and your name, remain on the server only while the SOS or contact-sharing session lasts: 24 hours at most after the last data point. After that they delete themselves.
• Without mobile data: the SMS is sent by your own phone and does not go through us.
• Against abuse: for one day we keep counters associated with the IP address, a random installation identifier and a fingerprint (hash) of the destination number. They delete themselves.

Who is the controller and on what legal basis

The controller is Codelabs Studio S.L. (CIF B88708797), registered at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain; contact: [email protected]. The legal basis is the performance of the service you request (sharing your route, alerting your contacts) and, in the case of the SOS, vital interests. In the route community, the basis is your consent when publishing, which you withdraw by deleting the route or the account. The processors involved are Cloudflare (server) and Telnyx (SMS delivery); the “Warn if I don't arrive” emails leave from our own mail server, in the European Union; sign-in is handled by Apple. On Android, the Embarca account and its backup live on our own server in the European Union; Google is involved if you sign in with Google, for notifications (Firebase Cloud Messaging) and for charging Pro (Google Play).

Your rights

The General Data Protection Regulation (GDPR) gives you the right to access your data, correct it, delete it and object to its processing. What is on your phone you control yourself; live-tracking data deletes itself within 24 hours or immediately from the app, and what is published in the community you can delete from the app whenever you like. For any request, write to us and, if you are not satisfied, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

Cookies and the Meta pixel

The iOS app does not use cookies. This website does store two things, and only the second needs your permission:

• Cookie preference (technical). It is stored in your browser's local storage (localStorage, key embarca-consent-v1) to remember whether you accepted or rejected. It is not sent to any server or used to identify you. It lasts until you delete it or change your choice.
• Meta pixel (marketing). Provider: Meta Platforms Ireland Ltd. It is used to measure how many visits come from our ads on Facebook and Instagram and to improve them. It installs the first-party _fbp cookie, which lasts 90 days, and sends Meta the address of the page visited and technical browser data. It only loads if you press “Accept” in the notice; if you press “Reject” or ignore it, nothing from Meta is loaded and that cookie is not written.

You can change your mind at any time with “Cookie settings”, at the bottom of any page of embarca.app. When you withdraw permission we stop sending data to Meta and delete the _fbp cookie; you can also delete it from your browser settings. The legal basis is your consent. The controller is Codelabs Studio S.L., Málaga. To exercise your rights write to [email protected].

Minors

The app is not aimed at children under 13.

Changes

If this policy changes, the date above will change with it. If the app were to collect any additional data, you would be asked for permission first.

Contact

Any questions: [email protected]