Donkey Analytics
Privacy notice
In short
- We keep your email address, your password (as a hash nobody can read back) and what you put in your library: tracks, boats, polars and courses.
- Your tracks are location data: they show where and when you sailed. Only your account can see them, and we never sell them or share them with other users.
- Stripe takes the payments. Your card details go to Stripe and never reach us.
- You can download everything from Your account at any time, and ask us by email to delete your account.
- When your account is deleted, we keep an anonymised copy of your tracks to improve the analysis: without your name or your boat's (the boat becomes a code), without dates, and with the start and end of each track cut off.
Who we are
Donkey Analytics runs Donkey Analytics and is the controller of your personal data: we decide how it is used.
For anything about your data, email privacy@mail.donkeyanalytics.co.uk.
What we hold, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address and password hash | To create your account, sign you in, and send password-reset and account email | Contract |
| While a new account waits for its address to be confirmed: the address and the password hash | To create the account once you open the link we mail you | Contract |
| If you turn on two-step sign-in: the secret your authenticator app shares with us, and a fingerprint of each unused recovery code | To ask for a code as well as your password when you sign in | Contract |
| Your library: GPS tracks (the position and time of each point), instrument data, boats, polars, courses, races, calibration and settings | To analyse your sailing, which is the service itself | Contract |
| Billing: your Stripe customer and subscription IDs, the subscription's status, when your trial ends, and the boats you pay for | To bill you, and to know what you have paid for | Contract |
| Which version of the terms you accepted and when, and your request to start a subscription straight away | To show what you agreed to | Contract, and our legitimate interest in being able to show it |
| When you signed in and were last seen, and the sessions you signed out of | To keep your account secure | Legitimate interests (security) |
| How many requests and uploads your account makes each day | To keep the service running fairly and plan its capacity | Legitimate interests (running the service) |
| Server logs: your IP address, and the time and address of each request | To stop attacks on sign-in and to find faults | Legitimate interests (security) |
| Once your account is deleted: an anonymised copy of your tracks, without your name or your boat's (the boat becomes a code), without dates, and with the start and end of each track cut off | To improve Donkey Analytics' analysis | Legitimate interests (improving the service) |
| A record of what the people who run the service do to your account: each change, each look at your library and each copy, with who did it, when and from where | So that what an administrator did can always be checked | Legitimate interests (security and accountability) |
You give us your email address and password when you sign up, and everything in your library when you import it. Without an email address and password we cannot give you an account.
Your tracks are location data
A track records where your boat was and when, often to within a few metres. Over time tracks can show where you keep your boat and when you are away from home. So:
- Only your account can open your library. The people who run the service can see account details, and the names and sizes of tracks, to support you. They open a track only when you ask them to.
- A track or polar is copied from one account to another only when its owner agrees, for example for a coach or a crew mate. Every copy is logged, and the copy does not say whose account it came from.
- We do not sell tracks, show them to other users, or use them for advertising or profiling.
- When your account is deleted, its tracks are copied into an anonymised archive first: every name goes, your boat becomes a random code, each track starts on the same made-up date, and every point within one to two kilometres of where a track starts or ends is removed, so your mooring does not show. Nothing in the archive says which account a track came from, so we could not find yours in it later.
Who else handles your data
These companies process data for us under contract:
| Who | What for | What they handle | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: runs the server and stores every library and account | Everything described above | Germany or Finland (EU) |
| Stripe | Payments, invoices and the subscription | Email address, billing address, card details (never seen by us), what you pay for | UK, Ireland and the USA |
| The mail provider (smtp.resend.com) | Sends password-reset and account mail | Email address and the mail's text | See the provider |
Some pages load maps and charting code straight into your browser from these services. Your browser sends them its IP address and the map area you look at, and nothing from your account:
| Who | What for | What they see | Where |
|---|---|---|---|
| OpenStreetMap Foundation (tile.openstreetmap.org) | The base map under your tracks | IP address and the map area you view | See the provider |
| OpenSeaMap | The seamarks drawn over the maps | IP address and the map area you view | Germany |
We share your data with nobody else, unless the law requires it (a court order, for example).
Data sent outside the UK
Our hosting provider, Hetzner, keeps everything in the EU, which UK law treats as protecting personal data adequately. Stripe is a company in the USA, and a map tile provider may serve from wherever is nearest to you. Where your data leaves the UK for one of them, it is protected by the UK's International Data Transfer Addendum to the EU standard contractual clauses, or by the UK extension to the EU–US Data Privacy Framework, whichever the provider offers.
How long we keep it
| What | How long |
|---|---|
| Your account and library | Until you ask us to delete your account. |
| The anonymised copy of your tracks, once your account is deleted | Kept, to improve the analysis. Nothing in it says whose it was. |
| A new account's details before its address is confirmed | 24 hours |
| Files you upload | Deleted as soon as they are imported |
| Maps, reports and exports the app makes for you | 3 days |
| Daily usage counts | 13 months |
| Sessions you signed out of | Until the session would have run out anyway: at most 90 days |
| Server logs | 30 days |
| The record of what administrators did | Kept, including after the account it names is deleted, so that what was done to an account can still be checked |
| Backups | 30 days, encrypted |
| Payments and invoices | Stripe keeps these as long as tax and anti-money-laundering law requires, usually six years. Our copy of your Stripe IDs goes with your account. |
Your rights
- See your data and take a copy. Download my data on Your account gives you everything in one zip file: your tracks as GPX and CSV, your polars, your boats, your account record and a copy of your whole library database.
- Correct it. Change your email address on the account page, and edit or delete anything in your library in the app.
- Delete it. Email us at privacy@mail.donkeyanalytics.co.uk from the address on your account, and we delete it within a month, usually within a few days. Your library, your account and your customer record at Stripe go, and leave our backups within 30 days. We keep an anonymised copy of your tracks (see How long we keep it).
- Object, or ask us to pause. Write to us and we stop, unless we have a compelling reason to carry on, such as a legal claim.
To use any of these rights, or to ask about them, email privacy@mail.donkeyanalytics.co.uk. We answer within one month.
If you are unhappy with how we handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.
How we keep it safe
- Passwords are stored as scrypt hashes, never as the password itself.
- Everything travels over HTTPS, and the sign-in cookie is sent over HTTPS only.
- Each account's library is a database of its own.
- Backups are encrypted.
- Card details are entered on Stripe's own page and never reach our servers.
Cookies
We use one cookie, to keep you signed in, and no advertising or analytics cookies. The cookie notice lists everything the app keeps in your browser.
Automated decisions
Nothing about you is decided by a computer alone in a way that has legal or similarly serious effects on you.
Changes to this notice
When this notice changes, the version at the top changes with it. If a change affects how we use data you have already given us, we email you before it applies.