Privacy Policy

Effective date: 17 July 2026

This policy describes how DeepRegatta ("we", "us") collects and processes personal data in connection with the DeepRegatta website (deepregatta.com), the OSCAR application (oscar.deepregatta.com), the Retrace application (retrace.deepregatta.com) and the Passage application (passage.deepregatta.com). It is written to satisfy Articles 13 and 14 of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").

Commercial features such as paid subscriptions are not currently live. We do not currently process payment-card or recurring-billing data for end users. If paid plans are introduced in the future, this policy will be updated before launch to describe the relevant billing and payment processing.

1. Data controller

The data controller responsible for processing personal data is:

Davi Silva de Vasconcellos, operating DeepRegatta.
Address: Paris, France. Full postal address available upon legitimate request by email.
Contact for privacy matters: [email protected].

We have not appointed a Data Protection Officer because our processing activities do not meet the thresholds in GDPR Article 37(1). You may still contact us at the address above for any question relating to your personal data.

2. Categories of personal data we process

2.1. Account data (users of OSCAR)

When you create an OSCAR account, we process:

• Email address, display name, profile picture URL (if provided by Google Sign-In);
• The authentication provider you chose (Google or email + password);
• A unique account identifier issued by Firebase Authentication;
• Your IP address at sign-in time, processed by Firebase for abuse prevention.

Legal basis: performance of a contract under GDPR Article 6(1)(b), so we can provide the OSCAR service you signed up for.

2.2. Boat, upload and routing data

If you add a boat to your account or upload a polar file, instrument log, route or sail plan, we process:

• Boat name, sail number, MMSI, boat type and rig configuration you entered;
• The file contents you uploaded (may contain GPS tracks, timestamps, instrument readings);
• Processing-job metadata (timings, status, error messages);
• An optional "share with fleet" flag you set when uploading.

Legal basis: performance of a contract, GDPR Article 6(1)(b).

2.3. Passage browser-local and request data

Passage currently requires no account and performs per-user route analysis in your browser. Planner drafts, route geometry, boat settings, personal limits and saved briefings are stored in your browser's local storage or IndexedDB. DeepRegatta does not receive the contents of that browser-local data merely because you enter, compute or save it.

To display maps and obtain forecast data, your browser requests forecast and map tiles from DeepRegatta and third-party providers. Those requests disclose ordinary network metadata to the relevant provider, such as your IP address, browser and device information, request time, referrer where supplied, and the requested tile URL or coordinates. A requested tile can indicate the approximate map or forecast area being viewed, but DeepRegatta does not send your complete route, personal limits or saved briefing to the third-party map providers.

Legal basis: performance of a contract, GDPR Article 6(1)(b), for delivering requested forecast resources; and our legitimate interests in delivering the Service securely and reliably, GDPR Article 6(1)(f), for ordinary access and security logs.

2.4. Retrace visitors

Retrace requires no account and collects no user-entered data. It is a static research-results site: after the page loads, it makes no requests to third-party services and sets no cookies. It stores your display preferences (theme and language) and the first-party usage-measurement identifiers described in §2.7 in your browser; see §8. Visiting Retrace discloses ordinary network metadata (IP address, browser and device information, request time, requested URL) to our hosting provider Cloudflare for delivery, security and access logging, and sends the first-party usage events described in §2.7 to DeepRegatta.

Legal basis: our legitimate interests in delivering the site securely and reliably and in measuring aggregate usage, GDPR Article 6(1)(f).

2.5. Contact data

If you contact us by email, we process your email address, the contents of your message, and any related follow-up correspondence.

Legal basis: our legitimate interest in responding to enquiries and handling support, or taking steps at your request before entering into a contract, GDPR Articles 6(1)(f) and 6(1)(b).

2.6. Third-party sailors in public race data

OSCAR analyzes public offshore sailing races. To do so, we ingest race tracker feeds published by race organisers (see §3 below). Those feeds contain personal data about sailors who are not OSCAR users, typically their name, the boat they sailed on, their class, their GPS positions during the race, and their finish time. This information is already made public by the race organiser before we process it. Retrace publishes research findings derived from the same public race data, mostly in aggregated and statistical form; some Retrace pages reference individual races, boat names and campaign histories drawn from that public data.

Legal basis: our legitimate interest in publishing post-race sports analytics and sports research, GDPR Article 6(1)(f). The balancing test weighs our interest (and that of the sailing community) in analysing public sporting events against the minor privacy impact of redisplaying race data that is already public. Sailors who object to their data being processed by OSCAR or Retrace can request erasure or anonymisation at any time. See §7 below.

2.7. First-party usage measurement

To understand which parts of the Service are used and whether visitors find what they came for, the DeepRegatta website, OSCAR, Retrace and Passage send a small number of first-party usage events (for example "opened a race", "viewed a playbook", "generated a briefing") to DeepRegatta's own event endpoint. Each event carries a random visitor identifier and a random session identifier generated in your browser, the event name, the product, and — where you arrived from a campaign link — the campaign parameters (utm_*) of that link. These identifiers are random values with no connection to your name, email address or any advertising ecosystem; they are scoped to each subdomain and are not shared with, or read by, any third party. We use no third-party analytics trackers, no advertising cookies and no cross-site tracking. Events are stored in our application database (Supabase, see §4) and used only in aggregate to measure visits, activation and return usage.

Legal basis: our legitimate interest in measuring and improving our own Service with privacy-preserving, first-party means, GDPR Article 6(1)(f). You can clear the identifiers at any time by clearing your browser storage for the relevant site.

3. Where the data comes from

Account, boat, upload and contact data comes directly from you. Passage settings and routes come directly from you but remain browser-local as described in §2.3. Passage forecast resources are built from public or licensed meteorological and oceanographic datasets identified inside the application. Retrace datasets are derived offline from the same public race data described below, combined with modelled meteorological reanalysis products. Third-party race data is ingested from the following public race-tracker services operated by race organisers:

• YB Tracking (United Kingdom)
• Ocean Tracking (France)
• Suiviregate (Switzerland)
• Geovoile (France)
• TracTrac (Denmark)

We do not buy personal data from data brokers.

4. Service providers and recipients

We use the following providers to operate the Service. When Passage loads third-party map tiles, your browser connects directly to those independent providers:

We do not sell personal data. We do not share personal data with advertising networks. We do not currently use Google Analytics, Meta Pixel, or similar advertising trackers.

5. International transfers

Some of our service providers process personal data in the United States or in other countries outside the European Economic Area. Where data is transferred outside the EEA, we rely on the provider's applicable transfer mechanisms, which may include an adequacy decision, certification under the EU-US Data Privacy Framework, and/or the European Commission's Standard Contractual Clauses, as appropriate to the provider and transfer path. You may request more information about the safeguards relevant to your data by emailing [email protected].

6. Retention

• Account data is retained for as long as your account is active. If you ask us to close or delete your account, we aim to erase account data within 30 days, except where we are legally required to keep records.
• Uploads and processing-job records are retained while your account is active and are removed when the associated upload or account is deleted, subject to backup and legal-retention constraints.
• Passage planner data and saved briefings remain in your browser until you delete them, clear browser storage, or the browser evicts them. DeepRegatta cannot retrieve or delete data that never left your device.
• Passage forecast-tile cache is maintained in your browser and automatically replaces older forecast runs, subject to browser storage behavior.
• Contact emails are retained for as long as needed to handle your enquiry and keep necessary business records.
• Public race data (including third-party sailors' names and positions) is retained indefinitely as part of the OSCAR public archive and the derived Retrace research datasets, because it documents historical sporting events. Individual sailors may request erasure; see §7.
• Service and security logs containing IP addresses and request metadata are retained according to the relevant provider, product and configuration, and only for as long as needed for delivery, security, abuse prevention and troubleshooting.

7. Your rights under the GDPR

You have the following rights regarding your personal data:

• Right of access (Article 15): obtain a copy of the personal data we hold about you;
• Right to rectification (Article 16): correct inaccurate data;
• Right to erasure / "right to be forgotten" (Article 17);
• Right to restriction of processing (Article 18);
• Right to data portability (Article 20): receive your data in a machine-readable format;
• Right to object (Article 21): in particular, object to processing based on our legitimate interest;
• Right to withdraw consent at any time (where processing is based on consent);
• Right to lodge a complaint with a supervisory authority (Article 77), including the authority in the EU/EEA country where you live, work, or believe an infringement occurred.

To exercise any of these rights, email [email protected]. We will respond without undue delay and normally within one month, as required by GDPR Article 12(3). OSCAR users can also delete their account directly from the account menu inside the application; this removes profile, boat, upload and routing data from our systems. Passage users can delete saved briefings inside Passage and can remove all remaining Passage data through their browser's site-data settings. Because browser-local data is not held by DeepRegatta, we cannot access, export, correct or erase it on your behalf.

If you are a sailor whose name or boat appears in OSCAR race analysis or Retrace research findings and you are not a user, you have the same rights. Write to the same address; we may ask for information reasonably necessary to confirm your identity before acting on the request.

8. Cookies and local storage

OSCAR, Retrace and Passage do not use advertising cookies. They use browser storage for the following strictly necessary or functional purposes:

The DeepRegatta landing page also currently uses Cloudflare Web Analytics in its cookie-free mode to count aggregate visits. Based on Cloudflare's product documentation, this analytics mode does not rely on cookies or local storage for measurement. Beyond the first-party measurement described in §2.7, no site in the product line ships an analytics beacon, and no third-party analytics trackers are used. Cloudflare may still process ordinary access and security logs when serving any of the sites. If we later add cookies or similar tracking technologies that require consent, we will update this notice and request consent where required.

9. Security

We protect personal data with industry-standard measures: TLS in transit, database encryption at rest, row-level security on user data in Supabase, OAuth/PKCE for authentication, and access controls on administrative interfaces. Passage's local data is protected by your device, browser profile and operating-system controls; anyone with access to that browser profile may be able to read it. In case of a personal-data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours (GDPR Article 33) and you personally if the risk is high (Article 34).

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.

11. Automated decision-making

DeepRegatta does not perform automated decision-making with legal or similarly significant effects on you within the meaning of GDPR Article 22. OSCAR analytics, Retrace research findings and Passage assessments, briefings and computed routes are informational and advisory only.

12. Changes to this policy

We may update this policy as the Service evolves. The "Effective date" at the top reflects the most recent revision. For material changes, we may also provide an additional notice on the website or inside an affected application where reasonably practical.

13. Contact

Questions, requests or complaints: [email protected].