Privacy Policy

skipper.id is a document vault for yacht skippers. You upload your own certificates and identity documents, we keep them safe, and you decide which charter company sees what — through a link you create and can revoke.

What we store

• Your account: name, email address, and whether that address has been confirmed. If you sign in with Google, we receive your name and email address from Google — nothing else.
• Your profile: display name, country, languages, and the sailing CV you write yourself.
• Your documents: the files you upload, plus their type, title and expiry dates.
• Identity records: passport and national ID numbers, if you choose to add them. These are encrypted before they are written down, kept apart from everything else, and never included in a share link or shown to a charter company.
• Access records: who opened which document and when. Your IP address is stored as a one-way hash, never as the address itself.

Where it lives

On our own servers in Estonia — the files in our own storage, the database on the same machine. We do not put your documents in an external cloud.

Text recognition runs on our own hardware. When you upload a document we read the dates and numbers off it to fill the form for you. That happens in a process on the same machine: the file is not sent to any AI service or outside company. The result is only a suggestion — you confirm or correct every field before it is saved.

Who else is involved

• Google — only if you choose to sign in with Google. Google tells us your name and email address so we can create your account.
• The charter company you share with — sees only what your share link exposes, and only until you revoke it or it expires.

We do not sell your data, we do not use it for advertising, and we do not send your documents to anyone you have not shared them with.

How long we keep it

• While your account exists: your profile, documents and identity records stay until you delete them.
• Deleted documents: hidden immediately, then permanently erased — file and record — after 30 days. That window exists so an accidental deletion can be undone.
• Expired share links: removed automatically.
• Backups: kept 14 days, then deleted. A document you erase may survive in a backup until that window passes.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, or have it erased. Two of those are buttons rather than requests:

• Export — download everything we hold about you, including your files.
• Delete your account — removes your profile, documents, identity records and share links.

You can also object to how we handle your data, or complain to the Estonian Data Protection Inspectorate.

Contact

skipper.id is run from Estonia. During the pilot, reach the founder directly — the operating entity, its registered address and a data-protection contact will be named here before public launch.