Effective Date: 10 May 2026
Controller: SourceFlow AI d.o.o. za računalne i srodne djelatnosti, Zagreb, Croatia — OIB 71094352026, MBS 081318743, registered with the Commercial Court in Zagreb (Trgovački sud u Zagrebu)
Contact: info@sourceflow.ai
This Privacy Policy explains how SourceFlow AI d.o.o. ("we", "us", "our") collects and processes personal data when you use our mobile application Sailor Croatia on iOS and Android (the "App") and when you visit our website at sailor-croatia.app (the "Website").
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Croatian data-protection law. We are the data controller for the processing described here.
No Data Protection Officer (DPO) is appointed, as our processing does not meet the thresholds in GDPR Art. 37(1). For any privacy question you can reach us at info@sourceflow.ai.
We aim to keep data collection minimal. The App does not require an account; we do not collect your name, email address, phone number, or social profile.
Payments themselves are processed by Apple (App Store) or Google (Google Play). We do not receive or store your payment card or bank details.
While you use the App we send analytics events to our backend so we can understand usage, detect bugs, plan improvements, and identify popular places to consider featuring in future App versions.
Each event carries: a timestamp, your RevenueCat user ID, device and app fingerprint (platform, operating-system version, device model, app version, build type), whether you have an active Pro subscription, and your approximate location rounded to one decimal place of latitude and longitude (about 11 km of resolution) when available. Beyond those base fields, individual events include technical metadata describing what just happened — which feature you used, route distance, error type, and so on.
A few things worth knowing:
The App uses your device's GPS to compute your position, distance to coast, speed, and heading. Continuous, high-frequency precise location is processed on your device only and is never streamed to our servers in real time. The exceptions are the rounded base location described in §B and the events highlighted there.
If you enable background tracking, the App runs a foreground service (Android) or background-location task (iOS) so it can continue to update the on-screen tracking display while the screen is off. This is local processing.
If you choose to share a route or saved place, the App uploads the route or place data to our backend and returns a short share code. The payload may include place names, precise coordinates, route geometry, waypoints, and any notes you added. Anyone holding the share code can retrieve the payload — treat share codes as effectively public. Shared payloads are deleted automatically 365 days after creation.
Settings such as map style, units, cruise speed, fuel-cost defaults, downloaded area packs, saved routes and places, and the share-code cache are stored on your device only (Android Jetpack DataStore or iOS UserDefaults / file storage). They are not transmitted to our servers, except where you explicitly share them or where the analytics events described in §B reference them.
The App may send aggregate diagnostic information (e.g. crashes, ANRs, performance signals) to platform services provided by Apple or Google. These reports are subject to the platform providers' own privacy policies. We do not receive your name, email, or your precise physical location in these reports.
If you use the in-App feedback feature, the message you write, any images you attach, and (only if you opt in) your approximate location are sent to our backend so we can investigate the issue and respond. Feedback content is retained as described in §6.
When you visit the Website, your browser automatically sends standard request data (IP address, user-agent, referring page) to our content-delivery network. We additionally use these processors on the Website:
static.cloudflareinsights.com.tile.openstreetmap.org (United Kingdom). The OpenStreetMap Foundation receives standard request data including your IP address. See the OSMF Tile Usage Policy.The Website does not set any cookies of its own and does not load advertising, retargeting, or social-media tracking scripts. Cloudflare Web Analytics is cookie-free by design.
For each purpose, the legal basis under GDPR Art. 6 is shown below.
| Purpose | Categories of data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide core App functionality (navigation, distance to coast, tracking) | On-device GPS, on-device preferences | Art. 6(1)(b) — performance of contract with you |
| Manage Pro subscriptions and verify entitlement | RevenueCat user ID, subscription status | Art. 6(1)(b) — performance of contract with you |
| Operate the share-by-link feature for routes and places | Shared payload (route or place data) | Art. 6(1)(b) — performance of contract with you |
| Understand how the App is used; detect bugs and performance regressions; plan improvements | Analytics events (see §2.B) | Art. 6(1)(f) — legitimate interests in maintaining and improving the App. We have assessed that our minimised, anonymised analytics do not override your rights or freedoms. |
| Respond to support requests, refund-support claims, and exercise of your rights | Information you provide in the request, plus any minimum data needed to identify your subscription | Art. 6(1)(f) — legitimate interests; or Art. 6(1)(c) where required by law |
| Comply with legal obligations (tax, accounting, lawful requests by authorities) | Subscription records held by Apple, Google, or RevenueCat as applicable | Art. 6(1)(c) — legal obligation |
You may object to processing based on legitimate interests at any time by emailing info@sourceflow.ai. If you object, we will stop the relevant processing unless we have compelling legitimate grounds that override your interests.
We do not sell your personal data. We do not share your personal data for advertising. We share data only with the service providers below, who act as our data processors under written agreements (GDPR Art. 28):
The App also relies on third-party data sources that do not receive personal data from you:
We may also disclose data where required by law, by court order, or to protect our legal rights.
Some of our processors are based outside the European Economic Area (EEA), primarily in the United States. Our primary backend infrastructure (AWS) is located in EU-Central-1 (Frankfurt, Germany), so the personal data we control directly stays inside the EEA. For transfers to processors outside the EEA, the legal mechanisms are:
If you are in the EEA you have the following rights under GDPR Articles 15–22 in respect of your personal data:
To exercise any of these rights, email us at info@sourceflow.ai. Because we hold very little identifying data, we may need a small amount of additional information to locate your records.
As an alternative, you can submit a message via the in-App feedback feature. Feedback submissions reach our backend with your RevenueCat user ID attached, which is enough for us to find your data. The feedback form has no reply channel, so if you want a written response include a reply email address inside the feedback message itself; otherwise we can act on your request but cannot write back.
We aim to respond within one month, as required by GDPR Art. 12(3).
The App is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us at info@sourceflow.ai and we will delete it.
We do not carry out automated decision-making that produces legal effects concerning you or significantly affects you in a similar way (GDPR Art. 22).
All personal data we process is collected directly from you through your use of the App. We do not buy, rent, or otherwise obtain personal data about you from third parties.
We apply appropriate technical and organisational measures to protect personal data, including TLS/HTTPS for data in transit, restricted backend access, and processor agreements with our service providers. No system is perfectly secure.
If we become aware of a personal data breach we will notify the Croatian supervisory authority (AZOP) within 72 hours where required by GDPR Art. 33. Where the breach is likely to result in a high risk to your rights and freedoms (GDPR Art. 34), we will inform affected users by means of a prominent in-App banner on next launch and a notice published at sailor-croatia.app. Because we hold no email address or other direct contact for most users, this constitutes the public communication permitted by GDPR Art. 34(3)(c) where individual notification would require disproportionate effort.
We may update this Privacy Policy from time to time. When we do, we will update the Effective Date at the top of this page. If a change is material we will notify you within the App or by another appropriate means before it takes effect. Your continued use of the App after the change takes effect constitutes acknowledgement of the updated Policy.
SourceFlow AI d.o.o. za računalne i srodne djelatnosti
Zagreb, Croatia
OIB 71094352026 · MBS 081318743 · registered with the Commercial Court in Zagreb (Trgovački sud u Zagrebu)
Email: info@sourceflow.ai
Web: sailor-croatia.app
Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP) — azop.hr.