Privacy policy

This page says what Tonnr keeps about you, why, who else receives it, and how to have it corrected or deleted. Téo Goulois runs this instance and is responsible for this data. Write to this address about any of it:

hello@tonnr.app

Reading the map takes no account. Cloudflare serves the web app, so it receives your IP address and the pages you open, as any host does. To draw the map, your browser loads its tiles from OpenFreeMap and the colours of the sea from Copernicus Marine: both see your IP address and the part of the map you look at.

Umami, which Téo Goulois runs, counts the pages read here, the landing's too: the page, the site you came from, your browser, your system, the kind and size of your screen, your language and your country. It sets no cookie and keeps neither your IP address nor the page's query, and it tells two visits of one browser apart by a code that changes every month.

Your browser keeps your settings for the app: your language in a cookie, and in its own storage the map's last position, its layers, your units, your shortcuts and the places you looked at last. Without an account they stay there, and none of them tracks you.

An account keeps your email address, your username, which others can read, and your password, stored hashed and never in clear. A cookie keeps your session open. At sign-up, a mail with a link checks your address, and the link works for a day. If you forget your password, a mail with a link lets you choose another: the link works once, for an hour, and choosing signs your account out everywhere. If you sign in with Google, Google gives us your name, your email address and your profile picture, and the tokens of that sign-in are kept with your account. Google tells us nothing else.

Each sign-in is kept with the IP address and the browser it came from, for the security of your account. Nothing in the app shows them, and they are kept as long as the account exists.

The app keeps what you make in it: your spots and lists, your alerts and what they told you, your log of sessions with its notes and what the sea did, the places you looked at last, your units and your shortcuts. Your spots and sessions are yours alone. Others read something of yours only in these cases:

• A list you share by a link is read by whoever has the link, with the private spots in it.
• A spot you ask to make public is read by the operator who decides. Once accepted, it joins the catalogue without your name.
• What you write in a guide is read by everyone, under your username, once it is confirmed.
• Your friends read your username, your rank and your confirmed contributions.
• The operator of the instance reads each account's email address and username, whether the address is checked and whether the account is suspended. Téo Goulois runs the server and can read the database, but reads it only to keep the service running or to answer a request.

Unosend sends the mail that checks your address, the one that lets you choose a new password and, if you choose alerts by mail, the mails of your alerts. It receives your address, the names of the alert and of its spots, and what the alert found. You may leave the names out of the subject. Each alert mail has a link that stops them, and no mail carries a tracker.

If you turn on push in a browser, we keep the address its push service gave it, its keys and the name of the browser. Each push goes through that service, run by Google, Mozilla, Apple or Microsoft depending on your browser, encrypted so that the service cannot read it. A browser is forgotten when you sign out of it or remove it.

When you search for a place by its name, our server asks Photon, a service of komoot, in Germany. It sends what you typed, your language and the centre of the map, rounded to about ten kilometres, and nothing about your account. The search is neither kept nor logged.

If you sign an AI assistant in to your account, we keep its registration, your agreement and its tokens. It can then read your spots, your alerts, what they told you and your sessions, and change nothing. Its access lasts an hour and renews itself for up to 30 days after it was last used. You disconnect it from your account's panel. What the assistant does with what it read is up to whoever provides it.

The forms of this site that write to Téo Goulois send your first name, your address and your message by mail to hello@tonnr.app. Nothing of them is kept in the database: the mail is all there is.

The API counts its calls by hour, by kind of caller and by outcome, never by account. What you ask of the forecasts is counted apart, by the hour, to your account, or to a hash of your IP address when you have none, so that one caller cannot spend the day's forecasts of everyone: these counts are kept two days. Its log notes each request's method, path and status, without your IP address. What an operator does, such as suspending an account, is recorded with that account's identifier. The database is backed up by its host. When the API itself fails, it sends PostHog a report of the fault: what failed and where in its code, with nothing of the request, the account or the person who made it.

• Your account, what you save, mails and push, place search and assistants: providing the service you asked for (GDPR, article 6(1)(b)).
• Usage analytics and the app's error reports: your consent (article 6(1)(a)), which you withdraw at any time in the account's panel.
• Audience counts, sign-in records, call counts, the log, the API's fault reports, backups and moderation: our legitimate interest in keeping the service secure and running (article 6(1)(f)).
• Messages you send us: our legitimate interest in answering them (article 6(1)(f)).

• Cloudflare (United States): hosts the web app
• Scaleway (France): hosts the server of the API and its database
• Unosend (United States): sends the mails
• PostHog (European Union): usage analytics and error reports, if you agree to them, and the API's fault reports
• Umami: audience counts, without a cookie
• Google (United States): sign-in, if you choose it
• komoot (Photon) (Germany): place search
• OpenFreeMap: the map's tiles, which your browser loads
• Copernicus Marine (European Union): the maps of the sea, which your browser loads
• Your browser's push service: carries the pushes, encrypted

Cloudflare, Google and Unosend are in the United States. Cloudflare and Google take part in the EU-U.S. Data Privacy Framework, under which the European Commission holds that data sent to them is adequately protected. Unosend receives it under the standard contractual clauses of the European Commission, which its data processing agreement includes.

Nobody else receives your data. It is never sold, and the app shows no advertising.

• Your account and what you save in it: until the account is deleted.
• Call counts and the record of what operators did: 13 months.
• The count of mails sent to an account, which limits them: 2 days.
• Your choice about analytics and error reports: 6 months, in your browser.
• The database's backups keep a copy until newer backups replace them.
• A spot that was made public, and what you wrote in guides, stay after your account is deleted, naming nobody.

You may ask for a copy of what we keep about you, in a format a program can read, and ask that it be corrected or deleted, that its use be limited, or object to it. Write to hello@tonnr.app from your account's address: you get an answer within a month.

The app has no button to delete an account yet. Ask hello@tonnr.app, and your account is deleted, with everything it holds, within a month.

If you think your data is mishandled, you may complain to the CNIL, the French data protection authority: cnil.fr

When this page changes, the date at its top changes too.