Privacy

We hold your sailings, what you paid, what you wrote, and who you travel with. We do not run advertising, and there are no analytics or third-party trackers in this app.

We do not track where you are. There is one place the app asks your phone where it is: when you mark the gangway in a port, so you can find your way back. That answer is written to your phone and nowhere else.

Photographs have their location data stripped before they are stored. Share links show a ship, never a person's whereabouts.

We publish and may sell statistics about cruises: what they cost and what they are like. Never about you. That is how this app stays free, and it is set out in full below.

Your account. An email address and password, held by our authentication provider and never by us directly. A username, display name, picture, bio and home country, which you choose. Whether you have ticked “let other people find me”, which is off until you turn it on.

Your travel. Which sailings you are on, your cabin number if you enter it, who is in your party, and any children you list: a first name, birth year and cabin, nothing more. Your watching list, and the prices you record on it while you are still deciding.

Money. What you paid for a sailing, prices you record, costs shared with your party, slot pull stakes. Your own fare is private to you. The one shared figure is a median across at least ten people, and never attributed.

What you write. Roll call posts, questions and answers, port tips, reports you file. Bug reports carry the page you were on, your browser, and a screenshot if you attach one.

Other people, as you see them. Who you follow, your private notes about the people you follow, and your block list. The notes are yours alone, and nobody is told they are on a block list.

Friends you invite. If you invite someone, we keep their email address, the code we sent, and that it was you who sent it. They see your name on the email. You can send five a month. The address is used for that one email and nothing else, and it stays on the invite record so the code works; if you want it gone before then, ask.

One cookie. It keeps you signed in. It is set by our authentication provider, it holds no tracking identifier, and it is the only cookie we set. There are no advertising or analytics cookies, so there is nothing to ask your consent for.

On your device. The app keeps a copy of your itinerary, planner, costs, queued entries, the map tiles along your route, the before-you-sail checklist, your drink package figure, and whether you dismissed the early-testing notice. They live in your browser so the app works with no signal. Anything you record with no signal waits there until there is a connection.

What signing out removes. Signing out sweeps the queued entries, the cached reads, the daily sheet photographs and the gangway position. The checklist and the drink figure are plain browser storage and stay until the browser clears them. Say so to anyone who borrows your phone.

Photographs of the daily sheet. If you photograph the ship's daily, that picture is kept on your phone and nowhere else. It is never uploaded, never shared with your party, and it goes when you sign out. The times and event names you import from it are shared with the sailing; the sheet is not.

Some of what we hold is about people who never agreed to anything, and that deserves saying plainly.

Children in a party have a first name, a birth year and a cabin. They have no login, no profile, no photograph, and they never appear on a roll call, a share link or anywhere else. That was a deliberate decision, not an oversight.

People who follow a share link give an email address to be told when the ship reaches a port. Nothing is sent until they confirm, every message has a one-click unsubscribe, and the person who made the link sees a count, never an address.

Guests in a party may be listed by name so a cost or a slot pull can be split. A name and an amount, held by that party.

People in photographs. A photo may show other people, staff or children. If you are in one and want it removed, ask us here. You do not need an account.

People who try the chart on the front page paste a booking confirmation and see it drawn as a route. The text they paste is read and not stored: not the name on it, not the booking reference, not the cabin or the fare. What we keep is the sailing it described: the ship, the dates, and the ports as the cruise line wrote them, including the ones we could not place on our chart, so the next person's chart is a little better. That record has no name, no address, no account and no time finer than the day, so it cannot be traced to whoever pasted it. It describes a cruise, not a person.

People asking for an invite give an email address and, if they want to, one line about the cruising they do. We also keep which page the form was on, and a count of asks per address per day so the form cannot be hammered. It is used to send one invite and nothing else. No newsletter, no reminders, no passing it on. Ask us to delete it and it goes; you do not need an account to ask.

People a member invites have an email address, the code that was sent, and the name of the member who sent it. The address is used for that one email and nothing else. It stays on the invite record so the code works; if you were invited and want it gone before then, ask, and you do not need an account to ask.

You must be 18 or over to have an account. We do not knowingly collect anything from a child under 13 directly, and if we learn a child has made an account we delete it.

This app is free, and this is how. We publish statistics about cruises, and we sell them to people who want to understand the cruise market: lines, agencies, researchers, investors. It is worth saying that plainly rather than burying it, because it is the business, not a footnote to it.

There are three kinds, and they are kept apart from one another.

What cruises cost. What a cabin type typically goes for on a route, by ship and party size. Drawn from fares people recorded after booking.

What cruises are quoted at. Prices people saw while still deciding on a sailing, whether or not they ever booked it. That is what shows how a fare moves as a sailing fills. Held separately from fares actually paid, because a figure mixing the two would describe neither.

What cruises are like. How long ships stay in a port, which routes are busy in which month, when a ship's activities typically run. Counts and medians about sailings.

Today we publish prices, and the plain facts of cruises: which ships call where, how often, and which routes they run. Those facts come from itineraries with nobody attached, so no threshold is needed to keep a person out of them. Any figure drawn from what people paid, saw or did follows the ten-person rule below. The switch in account settings leaves you out of all of those, not just the prices.

These describe cruises, not people. A published figure never contains your name, email, username, photos, messages, party, cabin number, who you sailed with, where you went ashore, or your own recorded fare. It is a median or a count across a group.

We do not sell a record of what any one person did. Not aggregated, not pseudonymized, not bundled with others. There is no version of this where a buyer receives rows about individuals, and the fare table has no column that could say whose a figure was.

No figure is published unless at least ten different people are behind it, and it is withheld if any single one of them makes up most of the group. Anything narrower is discarded rather than published, because a small enough group can describe one person even without naming them.

We will never try to re-identify anybody from these figures, and anyone we sell them to agrees in writing not to try either.

You benefit from this too. It is the same pooling that tells you when your own fare has dropped.

If you would rather not be included at all, there is a switch in account settings: “Leave my figures out of the statistics we publish.” It takes effect immediately and removes you from every future figure.

No location tracking. A ship's position on the map is worked out from its published itinerary. No phone is tracked, and nothing about where you are is ever sent to us.

One exception, and it stays on your phone. If you tap “I'm at the gangway” in a port, the app asks your phone where it is so it can tell you how far away your ship is later. That position is written to this device's own storage. It is not sent to us, not stored on our servers, not visible to anybody else, not part of any export, and not part of the de-identified statistics described above. It is deleted when you sign out, and you can clear it at any time from the same screen. Your phone will ask your permission the first time, and the feature simply does not work if you say no.

Other things worked out on your phone. Setting an all aboard alarm hands the time and port name to your phone's clock app, or saves a calendar file. Nothing is sent to us. Sunrise, money and dock-or-tender notes are worked out on your phone from the port's position.

Sharing into the app. On Android you can share a photographed daily sheet or a booking confirmation straight into Sea Manifest. The text is read on your phone and waits there until you paste it; it is not sent to us.

No location in photographs. Every uploaded image has its embedded data, including GPS coordinates, removed before it is stored.

No advertising, analytics or trackers. There is no tag manager, no pixel and no session recorder in this app, and no cookie for any of them.

No booking references. When you paste a booking confirmation we read the fare and the itinerary. Booking references and loyalty numbers are discarded.

Your roll call is limited to people on that sailing. Your party is limited to its members. Your own fare is yours alone.

Messages are between the two of you. Nobody else reads them in the ordinary course of anything. They are not end-to-end encrypted, though, so honesty requires saying that we could, and describing what actually stops it, which is built rather than promised.

Nothing is looked at without a report. If one of you reports a message, the person reviewing it sees counts first and no words at all: how many messages, how often, whether you replied, whether anything arrived after you blocked them, and whether other people have reported that account before. Most reports can be settled there, and reading that is not recorded because there is nothing in it to record.

Reading the words is a second step. It shows five messages either side of the one reported, not the conversation, and it is written into a log that cannot be edited or deleted by anyone, including us. Opening the whole conversation is a third step, needs a reason written out in a sentence, and is recorded with that reason attached. Both stop working the moment the report is resolved.

Nothing you write in a message is ever part of the data we sell, and reporting somebody does not tell them you did.

One exception, and it is a narrow one. If somebody reports a message, that message is kept with the report including if the person who sent it later deletes their account. Otherwise somebody could erase what they said by leaving. It is removed when the report is, under the retention periods below. Nothing else you have written is kept that way.

Photographs are unlisted rather than private. Reading a roll call requires being on that sailing, but the image file itself can be opened by anyone who is sent its address. Treat a photo here as you would one you sent in a group chat.

Share links. Anyone holding the link can see the ship, its itinerary, and anything you have chosen to share to it. They stop working after six months unless you keep one, you can turn one off at any time, and search engines are asked not to index them. They show the vessel. Never where you personally are.

The chart you can share. If you share the chart, the link itself carries the ship, the dates and the ports. We store nothing when it is opened, and the picture shown in a message preview is drawn from the same link.

Supabase stores the database and the files, and sets the sign-in cookie. Vercel hosts the site and logs requests, including IP addresses. Resend sends email, and Resend sends it through Amazon Web Services. OpenFreeMap serves the map tiles. Mapbox receives the name of a port you type so we can place it; nothing about you.

Each of those companies uses its own providers. We do not control those choices, and every one of them publishes its current list. We name the ones whose systems your data actually passes through, and we would rather name one too many than describe a shorter path than the real one.

The map. Map tiles are served by OpenFreeMap, a non-profit map host. When a map loads, OpenFreeMap receives your IP address and the map area being drawn, as any image host would. It receives nothing else: no account, no link token (the browser sends only our domain as the referrer), and no position of yours.

Where it is held. The companies above hold your data in the United States. If you use Sea Manifest from somewhere else, that is where it goes.

Get a copy. Account settings has a download button. It contains your profile, sailings, fares and price checks, posts, questions and answers, tips, costs, slot pull stakes, follows, reports, bug reports and share links. It does not yet include messages or settings; ask and we will add them.

Correct it. Your profile, fares, posts and tips are all editable.

Delete your account. Your name, picture, email and login are removed. Your private notes about people, your block list and your follows are deleted. Posts other people replied to stay with your name taken off, labeled “Former traveler”, so their conversations still read. Costs already recorded with a party stay, and so does a slot pull entry, under the same label. Removing them would change what other people are owed. Invites you sent keep the friend's address, so their code still works.

Stop the emails. There are five kinds. Arrival notices go to people following a share link. Final payment reminders go to you, before a date you entered on your own booking. One email per answer to a question you asked, until you close it. One email confirming a follow. One email carrying an invite you sent. Every reminder has a stop link; once stopped they stay stopped.

Ask us anything about it. We answer any request about your data within 30 days, and sooner if we can. You do not need to prove who you are beyond writing from the address on the account.

If something goes wrong. If we discover that your data was exposed, we will email the address on your account as soon as we understand what happened and never later than the law allows, and we will say what was taken.

While your account exists: your sailings, posts, costs and everything else you have added.

90 days after you remove something: deleted posts, tips and costs are held briefly so a mistake can be undone or a report finished, then permanently deleted.

24 months: reports, removal requests and bug reports, once they have been resolved. Anything still open is kept until it is dealt with.

30 days after you unsubscribe: the email address of anyone following a share link.

Until the code is used or you ask: the email address on an invite you sent.

Indefinitely, with nobody attached: itineraries, ports, ships and fare observations that carry no identifier. Once a record cannot be traced to a person it is no longer about anybody, and we keep it to make the app work for everyone else.

Deleting your account removes you completely. It leaves an anonymous record with no name, picture or email, so conversations other people took part in still read.

Sea Manifest LLC, Texas, United States. For anything about your data, email privacy@seamanifest.com.

If you appear in a photograph here, or your work has been posted here, and you want it removed, the removal request form reaches a person and does not require an account.