← All legal documents

PRIVACY POLICY

Application: Seaworthy (za.co.digitalfreedom.seaworthy)

Global Data Protection and Privacy Notice

Effective Date: 5 October 2026

Service operated by: DigitalFreedom — a brand of DigitalFreedom Global LLC

Data Controller (legal entity):
DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Contact (general): mailto:hello@digitalfreedom.co.za
Contact (data protection): mailto:data-protection@digitalfreedom.co.za
Data protection request form: https://data-protection.digitalfreedom.co.za
Website: https://digitalfreedom.co.za

1. INTRODUCTION

This Privacy Policy explains how DigitalFreedom (a brand of DigitalFreedom Global LLC, collectively “we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use Seaworthy and its related support services (“the Services”).

1.1 Global scope

Seaworthy is distributed through the Apple App Store and TestFlight in the markets where it is offered. This Privacy Policy applies globally to all users of the Services, regardless of the country in which the Service is downloaded, accessed or used.

1.2 GDPR as the global baseline

We adopt the European Union General Data Protection Regulation (GDPR) and related EU data-protection law as the baseline and apply it as a global floor — every user, in every country, benefits from at least the GDPR-level protections set out in this Policy. We additionally respect and comply with any applicable local data-protection law of the user’s jurisdiction, and where that local law is more protective for the user, the more protective standard applies.

We are committed to protecting your privacy and complying with applicable data-protection laws, including but not limited to:

• EU General Data Protection Regulation (GDPR) — applied as the global baseline
• German Federal Data Protection Act (BDSG)
• UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018
• Swiss Federal Act on Data Protection (FADP)
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and other US state privacy laws
• Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)
• Australian Privacy Act 1988
• Brazilian General Data Protection Law (LGPD)
• Japanese Act on the Protection of Personal Information (APPI)
• South Korean Personal Information Protection Act (PIPA)
• Indian Digital Personal Data Protection Act (DPDP Act) and IT Act
• South African Protection of Personal Information Act (POPIA)
• All other applicable national data-protection regimes in jurisdictions in which the Services are made available through the Apple App Store or TestFlight

2. DATA CONTROLLER

The Services are offered under the DigitalFreedom brand. The legal entity responsible for processing your personal data (the “data controller” under Art. 4(7) GDPR) is:

DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

For data protection inquiries (GDPR Art. 13/14, access, rectification, erasure, portability, objection requests): Request form: https://data-protection.digitalfreedom.co.za Email: mailto:data-protection@digitalfreedom.co.za

You may use either route, and you are free to reach us by any other channel — we act on your request however it arrives.

For general inquiries:
Email: mailto:hello@digitalfreedom.co.za

Website: https://digitalfreedom.co.za

3. DATA WE COLLECT

3.1 Data You Provide

Seaworthy stores the boats, equipment, maintenance records, notes, photos and documents you enter on your device. If iCloud is available and enabled for the app, your structured records sync through your private CloudKit database and files through iCloud Documents. Apple provides iCloud. The Provider does not receive your logbook content through that sync.

There is no Seaworthy account, sign-in, password or server-side user profile. If you contact support or data protection, we receive the contact details, message and attachments you choose to send.

3.2 Network and Diagnostic Data

Seaworthy includes no analytics, crash-reporting, advertising, tracking or attribution SDK and does not collect behavioural advertising identifiers. Diagnostic logging in the app uses the operating system’s local logging facilities.

If you select the optional Pro recognition model, the app downloads its model files once, with retries or replacement downloads when needed, from the Publisher’s Civo object storage at objectstore.lon1.civo.com. The download exposes ordinary network-request information such as your IP address, requested file, request time and client information to the host. Photos, prompts, OCR results and logbook content are not sent with those requests.

Opening the support portal at https://support.apps.digitalfreedom.co.za uses an embedded web view. The portal receives normal web-request information and anything you submit there. Support correspondence is not part of the private logbook store.

3.3 Platform Data

Apple processes App Store purchases and provides StoreKit transaction and entitlement information used on the device to unlock Seaworthy Pro. It is a one-time, non-consumable purchase; there is no subscription and the Provider does not receive payment-card details or your Apple account password. Apple may provide store reports, diagnostics or TestFlight feedback under its own platform terms and your applicable platform settings.

3.4 Camera, Photos and Documents

Camera use requires the operating system’s permission. Photos and documents that you choose through the system pickers are processed for the feature you requested. Text recognition, image classification and suggestions run on the device; no inference service receives that content. Saved photos, results and documents remain in your logbook and may sync to your private iCloud if enabled.

3.5 Data NOT Collected

Seaworthy has no health or fitness integration, device-location permission, contact-book access, advertising identifiers, account credentials or cross-app tracking. A home marina or other location you type yourself is part of your private logbook content. It does not upload your content to perform recognition or suggestions.

4. LEGAL BASIS FOR PROCESSING (GDPR)

Apple processes its platform and iCloud data under its own terms and legal bases. No analytics or marketing consent is requested by Seaworthy because those features are absent.

5. HOW WE USE YOUR DATA

Seaworthy uses your logbook data to show and organise boat maintenance, save files, generate local recognition results and suggestions, schedule local reminders and, if enabled, sync through your private iCloud. You review suggestions before relying on them.

The Provider uses data it actually receives to handle support and privacy requests, operate secure model downloads, administer purchases and meet legal obligations. Your logbook is not used for advertising, telemetry or model training.

6. DATA SHARING AND DISCLOSURE

We may share your data with:

6.1 Service Providers

Only the services needed for downloads, support and correspondence are engaged for Seaworthy. On-device recognition has no external inference processor.

6.1.1 Named Sub-processors

Civo’s signed Data Processing Agreement with DigitalFreedom Global LLC covers its infrastructure service. Migadu’s published terms, privacy policy and documented assurance form the recorded contractual basis. Neither service performs recognition on your photos. Civo’s model-download host receives network-request data, not your inference inputs.

6.1.2 Platform and Distribution Channels

Apple provides the App Store, StoreKit, TestFlight and optional private iCloud (CloudKit and iCloud Documents). It processes the associated platform data under its own terms and acts as an independent controller for that processing, not as the Provider’s external inference processor. Its privacy policy is at https://www.apple.com/legal/privacy/.

Your purchase contract follows Apple’s commissionaire or agency arrangement, as explained in the Legal Framework Overview. Seaworthy uses StoreKit directly, with no separate entitlement-management service. Notifications are scheduled locally; the app registers no push token.

6.2 Legal Requirements

We may disclose data when required by law, legal process, or government request.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred.

6.4 No Sale of Personal Data

We do not sell your personal data to third parties.

7. INTERNATIONAL DATA TRANSFERS

Local recognition and suggestions do not transfer your content to an inference provider. Optional private iCloud sync is provided by Apple and may involve processing in the locations covered by Apple’s iCloud terms and privacy policy.

For information the Provider receives through downloads, support or correspondence:

• Civo fra1 (Frankfurt am Main, Germany) — within the EU/EEA.
• Civo lon1 (London, United Kingdom) — the processor record relies on the UK adequacy decision under Art. 45 GDPR.
• Migadu (Switzerland) — the processor record relies on the Swiss adequacy decision under Art. 45 GDPR.
• Apple — platform and iCloud processing is governed by Apple’s own privacy policy and applicable transfer safeguards.

The Controller is established outside the EEA. Where the Controller itself receives and processes personal data, it applies the GDPR standard as a global baseline. For onward transfers without an adequacy decision, applicable contractual safeguards, a transfer assessment and supplementary measures are used as required by GDPR Chapter V. Applicable cross-border requirements of other jurisdictions also remain in force.

8. DATA RETENTION

Logbook records, photos, documents and saved recognition results remain on your device and, if enabled, in your private iCloud until you delete them. Use the app’s deletion controls for records or all logbook data. Deleting the app alone does not necessarily remove iCloud copies, device backups or exports; Apple’s iCloud storage and backup controls govern those copies. Downloaded model files are cached on the device and excluded from backup.

For records held by the Provider, the retention schedule is: support tickets — 3 years from closure; operational logs — 30 days hot and 90 days cold; billing records subject to the Controller’s applicable US retention duties — 7 years, with any specific mandatory duty applied to the record it covers. Data is deleted or anonymised when the applicable period expires, unless continued retention is legally required. Seaworthy operates no account database or marketing subscriber list. Apple determines retention of its own platform records.

8a. SPECIAL CATEGORIES — HEALTH AND FITNESS DATA

Seaworthy has no HealthKit, health or fitness feature and does not request health data. Do not include sensitive personal information in a support request unless it is needed to address that request. No health-data consent or separate health-data policy applies to the app’s features.

8b. ACCESS TO INFORMATION ON YOUR DEVICE (APPS)

Independently of data protection law, § 25(1) TDDDG and Art. 5(3) of Directive 2002/58/EC concern storing information on your device or reading information already stored there.

No analytics identifier, crash-reporting installation identifier, install-attribution token or advertising identifier is read by Seaworthy.

9. DATA SECURITY

Seaworthy uses the operating system’s application storage protections and Apple’s private iCloud services when enabled. Network downloads and the support portal use HTTPS. The optional model’s downloaded weights are checked against a pinned SHA-256 digest before a new download is accepted. Local recognition avoids uploading your inputs to an inference service.

The Provider restricts access to support correspondence and follows its documented incident-response process. Keep your device and the app updated, secure your device and Apple account, and maintain appropriate backups. No system is completely secure; absolute data security is not guaranteed.

9.1 Breach Notification to You

In the event of a personal data breach likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), we notify affected people without undue delay using available contact details or an appropriate in-app or public notice. The notice describes the nature of the breach, categories and approximate scope, likely consequences, mitigation and contact details. If individual notification would involve disproportionate effort, a public communication is made at https://digitalfreedom.co.za/.

10. YOUR RIGHTS

10.1 The GDPR catalogue, as the global floor

Wherever you live, you can exercise at least:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”) (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent at any time, as easily as it was given (Art. 7(3))
• A complaint to a supervisory authority

10.2 What your jurisdiction adds

Several jurisdictions grant rights beyond this floor or attach different deadlines and procedures — appeal routes, shorter response periods, named officers. § 17 is the single place where those are stated, per jurisdiction. Nothing in § 17 reduces the floor above.

10.3 How to exercise any of them

Email mailto:data-protection@digitalfreedom.co.za or use the request form at https://data-protection.digitalfreedom.co.za. We respond within one month (Art. 12(3) GDPR) — or within the shorter period your jurisdiction prescribes, as stated in § 17.

11. CHILDREN’S PRIVACY

Our Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction).

We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. COOKIES AND TRACKING

Seaworthy has no analytics, advertising, tracking or cookie-based profiling. The optional support portal runs as a website inside a web view and may use necessary web-session storage. Information you enter in that portal is sent to the support service; your private logbook is not automatically attached. Websites opened through external links have their own notices and controls.

13. AUTOMATED DECISION-MAKING AND AI

13.1 Automated decisions with legal or similarly significant effect

Seaworthy does not use recognition or suggestions to make decisions with legal or similarly significant effects. You remain responsible for reviewing suggested titles, classifications and maintenance intervals.

13.2 On-device features

Vision reads text and classifies images. SigLIP 2 (Google’s open model, licensed under Apache-2.0) compares images against a maritime vocabulary. On supported devices, Apple Foundation Models (Apple Intelligence) suggest titles and maintenance intervals. Pro users may select the additional Qwen2-VL-2B-Instruct 4-bit vision-language model, downloaded from the Provider’s Civo object storage (about 1.2 GB). All inference runs on the device; no photos, prompts or other inference content leave the device for that processing. Saved logbook content can still sync to your private iCloud if enabled. See the Transparency Notice.

13.3 Product limits

The free tier allows one boat and five maintenance items in total. These limits are checked on the device. There is no operational telemetry, remote fair-use enforcement or shared inference quota.

13.4 Communications and reminders

The app schedules maintenance notifications locally, with the operating system’s permission. It sends no marketing push notifications and operates no marketing subscription. Support replies are sent in response to your request.

13.5 Deletion

There is no Seaworthy account to delete. Delete individual records or all logbook data using the app’s controls, and manage any remaining iCloud backups or exports separately. For information you sent to the Provider, contact mailto:data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za. The Provider cannot remotely erase your private device or iCloud logbook.

14. THIRD-PARTY LINKS AND SERVICES

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

• Material changes will be communicated via the Services or by email
• Where a change to the processing requires your consent under applicable law, we will obtain that consent before the change applies to you; we do not rely on continued use alone as consent
• The “Effective Date” at the top reflects the latest revision

16. CONTACT

For privacy-related inquiries or to exercise your rights:

DigitalFreedom
A brand of DigitalFreedom Global LLC
30 N Gould St, Ste N
Sheridan, WY 82801
United States

Data protection: mailto:data-protection@digitalfreedom.co.za
Data protection request form: https://data-protection.digitalfreedom.co.za
General inquiries: mailto:hello@digitalfreedom.co.za
Website: https://digitalfreedom.co.za

For EU residents, you may also contact the competent supervisory authority in your member state.

17. REGIONAL PROVISIONS

What each jurisdiction adds to the global baseline of this Policy. § 10.1 states the floor that applies everywhere; nothing below reduces it. Requests for any of the rights in this section: mailto:data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

17.1 European Union and EEA

• Processing complies with the GDPR, which also applies in Norway, Iceland and Liechtenstein through the EEA Agreement.
• No lead supervisory authority applies: the Controller is not established in the Union, so the one-stop-shop under Art. 56 GDPR does not apply.
• You may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR) — in the EEA states that is Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).
• Data Protection Impact Assessments are conducted where required.
• Member States set the age of digital consent between 13 and 16. Seaworthy has no registration and is intended for an audience aged 16 and over; local rules for any voluntary submission still apply.

17.2 United Kingdom

• Processing complies with the UK GDPR and the Data Protection Act 2018.
• The supervisory authority is the Information Commissioner’s Office (ICO).

17.3 Switzerland

• The revised Federal Act on Data Protection (revFADP) applies to circumstances that have an effect in Switzerland regardless of where the Controller sits. The GDPR baseline of this Policy covers its substance.
• Right to information (Art. 25 revFADP): substantially the access right of Art. 15 GDPR; we respond within 30 days.
• Breach notification (Art. 24 revFADP): owed to the FDPIC “as soon as possible”. Our internal plan runs on the shorter of the applicable periods, so the GDPR’s 72-hour clock governs in practice.
• Switzerland is recognised as adequate by the EU and recognises the EEA; transfers between them need no additional safeguard.
• The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

17.4 United States

The state-law common core. The comprehensive state statutes (Virginia, Colorado, Connecticut, Texas, Oregon and the wider family) grant substantially the rights in § 10.1, and add two things:

• Appeal. If we deny your request, you may appeal to us; our appeal response tells you how to complain to your State Attorney General. Exception: Utah (Utah Code § 13-61-203 provides no appeal process).
• Deadlines. We respond within 45 days, extendable once by a further 45 with notice. Exception: Iowa, where the statute allows 90 days plus a 45-day extension (Iowa Code § 715D.3(3)) — in practice we apply the shorter period.

Biometrics (Illinois BIPA). Seaworthy has no biometric-authentication feature and collects no biometric identifier. If a feature ever collects a biometric identifier, BIPA’s written-release, retention-schedule and destruction duties apply before the first collection.

Consumer health data (Washington, Nevada). Seaworthy has no health or fitness feature and requests no health data; a separate consumer-health-data policy does not apply to its current features.

“Do Not Sell or Share” link. Not required here: no personal information is sold or shared for cross-context behavioural advertising — Seaworthy has no advertising, install attribution or advertising identifier. If that changes, the link becomes mandatory.

California — Notice at Collection (CCPA/CPRA)

Provided to California residents at or before the point of collection, as required by Cal. Civ. Code §§ 1798.100(a) and 1798.130(a)(5)(A). Read the full Seaworthy Privacy Policy in the app. Website: https://digitalfreedom.co.za.

Categories collected in the past 12 months:

We have not sold or shared personal information of California residents in the past 12 months and do not intend to. The opt-out of sale or sharing therefore has no operative effect — but is available on request.

Retention per category: local logbook content and saved inferences (H, K and any voluntarily included content) — until you delete them; private iCloud copies and backups are subject to your Apple storage controls. Support records and submitted attachments (A, B, H and any voluntarily supplied L) — 3 years from closure; operational logs (A, F) — 30 days hot and 90 days cold; applicable billing records (D) — 7 years under the Controller’s applicable retention duties. Uncollected categories have no retention period. Apple sets retention for its platform records. See Privacy Policy § 8 for deletion and legally required extensions.

Sensitive personal information — limit of use (§ 1798.121). We use sensitive personal information only for the purposes permitted under CPRA Regs § 7027(m) — performing the services, security, fraud prevention, service quality. Not for inferring characteristics, not for targeted advertising. The opt-out therefore has no operative effect — but is available on request.

Your CCPA/CPRA rights:

We verify requests proportionate to sensitivity and risk (CCPA Regs §§ 7060–7063) and respond within 45 days, extendable once by 45 with notice.

Shine the Light (§ 1798.83): we disclose no personal information to third parties for their direct-marketing purposes; the annual response is “none disclosed”.

Global Privacy Control: Seaworthy does not sell or share personal information or perform cross-context behavioural advertising, regardless of browser signals. The native app has no browser-signal detection control; you can also send any privacy preference to the contact above.

Complaints: California Privacy Protection Agency, 2101 Arena Boulevard, Sacramento, CA 95834 — https://cppa.ca.gov/webapplications/complaint — or the California Attorney General.

17.5 Canada

• Consent (PIPEDA Principle 3): express consent where information is sensitive or the purpose not obvious; implied consent where it is obvious and not sensitive. Withdrawal at any time, subject to legal or contractual restrictions and reasonable notice.
• Your PIPEDA rights: access and a copy, accuracy challenge and correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca). Response generally within 30 days (PIPEDA § 8(4)).
• Quebec (Law 25):
  • Person responsible for the protection of personal information: Marcel R. G. Berger, mailto:data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.
  • Before personal information of Quebec residents is transferred outside Quebec, a privacy impact assessment (EFVP) is conducted (Law 25 § 17). Destinations: EEA, UK and Switzerland (adequate), and the US under EU SCCs, the UK Addendum and, where applicable, the EU-US DPF.
  • You may request your data in a structured, commonly used technological format (§ 27), request cessation of dissemination or de-indexing where dissemination seriously injures your reputation or privacy, and are informed of any decision based exclusively on automated processing with the right to human review — no such decisions are currently made.
  • Confidentiality incidents presenting a risk of serious injury are notified to the Commission d’accès à l’information and to you without delay.
  • A French version of any document is available on request; for Quebec residents the French version governs where Quebec law so requires.
• CASL: commercial electronic messages only with express opt-in, sender identification and a working unsubscribe processed within 10 business days.
• Provincial laws (BC PIPA, Alberta PIPA) apply where more protective. Complaints also to the OIPC BC and OIPC Alberta.

17.6 Australia and New Zealand

• Australia: the Privacy Act 1988 and the Australian Privacy Principles apply to an overseas entity carrying on business in Australia. APP 12 sets a 30-day response period for access. APP 8 makes us accountable for an overseas recipient’s handling of your data — stricter than a transfer analysis, and part of why recipients are named in § 6. Complaints: Office of the Australian Information Commissioner (OAIC).
• New Zealand: the Privacy Act 2020 applies to an overseas agency carrying on business in New Zealand. IPP 12 restricts disclosure outside New Zealand; access requests are answered within 20 working days. Complaints: Office of the Privacy Commissioner (NZ).

17.7 Brazil (LGPD)

• Encarregado (Art. 41 LGPD): Marcel R. G. Berger, mailto:data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. ANPD Resolution CD/ANPD No. 18/2024 permits the role to be performed for a foreign controller through the channels above; this Policy is the public publication of the Encarregado’s contact details it requires.
• Legal bases (Art. 7 and 11): consent (I) where required for voluntary processing; contract performance (V) for support, purchases, on-device features and service delivery; legal obligation (II) for the retention duties that bind the Controller under the law applicable to it; legitimate interest (IX) for security and fraud prevention. Sensitive data only on explicit consent or another Art. 11 ground.
• Your Art. 18 rights: confirmation, access, correction, anonymisation/blocking/deletion of unnecessary or non-compliant data, portability, deletion of consent-based data, information about sharing and about the consequences of refusing consent, and revocation of consent. Response within 15 days (Art. 19 § 3).
• Transfers (Chapter V, Art. 33): adequacy (EEA, UK, Switzerland), contractual safeguards for the US legs, or your consent given with prior information about the international character — Seaworthy’s on-device recognition has no overseas inference recipient.
• Children (Art. 14): processing of a child’s data (under 12) requires specific and prominent parental consent; no such mechanism is operated — consent-based processing is withheld instead. Seaworthy has no registration and is not directed at children.
• Incidents (Art. 48): the ANPD and affected data subjects are notified; our target is 72 hours, aligned with Art. 33 GDPR.
• Complaints: Autoridade Nacional de Proteção de Dados — https://www.gov.br/anpd. A Portuguese version of this section is available on request.

17.8 India (DPDP Act, 2023)

• DigitalFreedom Global LLC is the Data Fiduciary; it is not designated a Significant Data Fiduciary.
• Consent (§ 6): free, specific, informed, unconditional and unambiguous, by clear affirmative action, limited to what the purpose needs, withdrawable as easily as given. Service is not conditioned on consent the purpose does not need.
• Your rights (§§ 11–14): access to what is processed and with whom it is shared; correction, completion and erasure; grievance redressal; and nomination of another person to exercise your rights in case of death or incapacity.
• Grievance Officer (§ 8(10), IT Rules 2021): Marcel R. G. Berger, mailto:data-protection@digitalfreedom.co.za. Acknowledgement within 24 hours; resolution within 15 days, extended to 30 for complex grievances with explanation. Escalation: the Data Protection Board of India, once constituted.
• Children (§ 9): data of a person under 18 is processed only with verifiable parental or guardian consent; no tracking, behavioural monitoring or targeted advertising directed at children.
• Transfers (§ 16): permitted save to destinations notified as restricted; none of the destinations used (EEA, UK, Switzerland, US) is currently restricted.
• Notices are available in English; a Hindi or other Eighth-Schedule-language version can be requested at mailto:hello@digitalfreedom.co.za.

17.9 Japan (APPI)

• The APPI applies to a foreign operator that acquires personal information in connection with supplying goods or services to persons in Japan; this Service is therefore covered.
• Purpose specification: the purpose of use is specified as narrowly as possible and notified or published at acquisition. A change of purpose is limited to what remains relevantly connected to the original purpose; a larger change requires fresh consent.
• Third-party provision, and provision to third parties in a foreign country: provision to a third party requires your consent as a rule. For a third party in a foreign country, consent is obtained only after providing you with (1) the name of the country, (2) information on that country’s personal-information protection system, and (3) the measures the recipient takes to protect personal information. Seaworthy’s local recognition transfers no information to an inference provider. Optional iCloud is provided by Apple; any support submission is limited to the recipients and purposes in §§ 3 and 6.
• Publicly available matters (Art. 32): the operator’s name and address and its representative’s name, the purposes of use, the procedures for disclosure requests and the complaint contact are kept in your reach — through this Policy and the EULA § 19.8. Representative: Marcel R. G. Berger.
• Breach reporting: for the reportable categories, a preliminary report to the Personal Information Protection Commission within roughly 3–5 days and a final report within 30 days (60 for breaches caused by wrongful access); you are notified. Our internal plan runs on the shortest applicable deadline.
• No advertising email is sent (特定電子メール法 — opt-in, sender identification, unsubscribe — would otherwise apply).

17.10 Korea (PIPA)

• PIPA applies to a foreign operator processing personal information in the course of offering goods or services to data subjects in Korea; this Service is therefore covered.
• Itemised, separated consent: consent is obtained separately per item, with required and optional items distinguished; refusing an optional item never blocks the service; each request states the items collected, the purpose, the retention period, your right to refuse and the consequence of refusal. Seaworthy does not operate telemetry-consent toggles or a remote-inference consent flow; it has no such collection.
• Cross-border transfer: transferring personal information abroad requires notice of the recipient, the destination country, the date and method of transfer, the items transferred, the recipient’s purpose and retention period, and your separate consent. On-device recognition makes no such transfer. Any applicable notice for a support submission must identify the recipients in § 6 and these items; Apple’s own platform processing is governed by Apple’s notice.
• Under 14: processing a child’s data requires the legal representative’s consent, with only the minimum information collected to verify it. Seaworthy is not directed at children and does not offer registration or a parental-consent mechanism.
• Response period: access, correction/deletion and suspension requests are acted on within 10 days, or you are told the reason and schedule. That is shorter than the GDPR month, and the shorter period governs.
• Breach: you are notified without delay; above the statutory scale, the Personal Information Protection Commission or the designated agency is notified within 72 hours.

17.11 Türkiye (KVKK)

• The KVKK (Law No. 6698) resembles the GDPR in concept but leans harder on explicit consent as the general basis; each processing activity is assessed against Turkish law separately rather than assumed to carry over from an Art. 6(1)(f) analysis.
• Transfers abroad: Seaworthy performs no foreign transfer for inference. Applicable Turkish transfer requirements remain in force for any support data sent abroad and for Apple’s separate processing.
• Response period: requests are answered within 30 days. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first — within 30 days of our response or 60 days of your application.
• The Turkish version of the published documents governs for consumers resident in Türkiye.

17.12 South Africa (POPIA)

POPIA § 3(1) applies to a responsible party domiciled in the Republic, or processing by means located there. Neither is the case — the Controller is domiciled in Wyoming and processes on servers in Frankfurt and London, and a .co.za domain name is a name, not a processing means. The Act therefore does not apply on the present facts. Every POPIA-style enquiry is nonetheless answered through the same channels and on the same clock as everywhere else — a service commitment, not an admission that the Act applies. Two points where POPIA would differ from the GDPR floor, stated rather than papered over: POPIA treats everyone under 18 as a child, and § 22(1) requires breach notification without the GDPR’s high-risk threshold — the breach plan operates on the GDPR standard. The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — https://inforegulator.org.za.

17.13 All other countries

Everywhere the stores distribute and no section above applies: the GDPR baseline of this Policy is your floor (§ 1.2), any more protective mandatory local law prevails over it, and every request goes through mailto:data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

(c) 2025-2026 DigitalFreedom Global LLC. All rights reserved.

WEBSITE TRYSEAWORTHY.APP

This section covers the website tryseaworthy.app, meaning what happens when you load its pages in your browser. Controller, contact and your rights are the same as set out above for the app.

Hosting

The website is a static site hosted on GitHub Pages (GitHub, Inc., USA). When you load a page, GitHub processes your IP address, the browser user-agent, the requested URL, the time of the request and, where sent, the referrer, to deliver the page and to protect the service against abuse. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in operating a secure website. Retention follows GitHub’s privacy statement. Transfers to the United States rely on the EU-US Data Privacy Framework (Art. 45 GDPR).

Storage in your browser

Without your consent the website sets no cookies. It uses the browser’s own storage for these functions:

None of these values is sent to us or to anyone else. Legal basis: § 25(2) No. 2 TDDDG, storage strictly necessary for a function you requested, and Art. 6(1)(f) GDPR.

Google Analytics, only with your consent

If you click Accept in the cookie banner, the website loads Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before that click, nothing from Google is loaded and no request reaches Google.

• What is measured: pages viewed, scrolling, clicks on outbound links such as the App Store button, the referring page, approximate location derived from the IP address, browser, device type and screen size. Google Analytics 4 does not store or log IP addresses.
• Cookies: _ga and _ga_SGEZ58Y742 on this domain, to tell visits apart. They expire after at most 2 years; you can delete them in your browser at any time.
• Retention: event and user data are deleted after 14 months.
• Not active: Google Signals is switched off, and the property is not linked to any Google advertising account.
• Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You withdraw it with Decline, which you reach through “Cookie settings” in the footer; the GA cookies are then removed. Withdrawal does not affect processing before it.
• Transfer to the United States: Google LLC may process the data in the USA. The transfer relies on the EU-US Data Privacy Framework (Art. 45 GDPR) and on the EU Standard Contractual Clauses.

Details: Google’s privacy policy and how Google uses information from sites that use its services.

Links to the App Store

The download buttons link to Apple’s App Store. When you click one, Apple processes your visit under its own privacy policy. The link may carry a campaign identifier that tells Apple which campaign led to the download; it identifies the campaign, not you.

What the website does not do

• no analytics without your consent, no tracking pixels, no advertising
• no third-party fonts: the typeface is served from this domain
• no contact form, no newsletter, no account and no payment on the website
• apart from Google Analytics after your consent, no content is loaded from third-party servers; the App Store rating shown on the page is fetched once when the site is built, not from your browser