Who we are

SailStarter teaches sailing fundamentals through short lessons and quizzes. This policy covers the marketing site at sailstarter.com and the learning app at sailstarter.com/app, and it describes what actually happens today — not what a template says usually happens.

SailStarter is operated by Ihor Tykhonenko. Our business address is 91-1037 Cleveland Ave, Riverview, NB E1B 0T9.

Every privacy request — a copy of your data, a correction, or a deletion — goes to one email address, which you will find under Deleting your account and your data.

What we collect

Your account

Lessons need an account. Signing in works by magic link: you give us an email address, we email you a one-time link, and you follow it. There is no password, so there is no password for us to store. Your email address is held by Supabase Auth, the service that runs our sign-in.

Signing in with Google or Apple

You can also sign in with Google or Apple instead of email. Choosing one sends us the name, email address, and profile picture that the provider releases to us, and we use them exactly as we use the email address above — to identify your account and to sign you in. We ask those providers for nothing else. Apple lets you hide your real address and share a private relay address instead; if you do that, the relay address is all we receive, and it works the same way for signing in.

We do not offer sign-in with Facebook, and we hold no Facebook data.

What you do in the course

Your progress is stored against your account so it follows you between devices. In full, that is:

  • which lessons you have completed, your best score on each, when you first passed them, and which kind of device you completed them on (web, iOS, or Android);
  • every quiz attempt — the score, whether it passed, and which answer options you chose;
  • your nautical-miles ledger: each award, what earned it, and your running total;
  • which days you were active, your current streak, your longest streak, and any streak protection you have banked;
  • which achievements you have unlocked;
  • a display name, the timezone your day is counted in, and your daily goal.

Course-update emails

If you type your email address into a sign-up box on the marketing site, we store that address along with a short tag saying which page or button it came from. That list is a separate record from your account, which matters when you come to delete your account and your data.

Payments and billing

If you buy a paid plan, we store a record of it: the Dodo Payments customer id linked to your account, which plan you are on, its status (active, on hold, cancelled, and so on), when your current billing period ends, and whether you have cancelled future renewals. A one-time Lifetime purchase gets the same shape of record, without a renewal date.

Dodo Payments, who processes our payments, sends us the full webhook message for every billing event, and we keep that message as sent. It includes the billing address and email address Dodo collected from you at checkout, alongside the plan and status fields above. We never receive, see, or store your card number — Dodo holds that itself, as merchant of record for the purchase. See Dodo’s privacy policy for what Dodo collects and how Dodo uses it.

How we use it

  • To sign you in and keep you signed in.
  • To save your place in the course and show your progress, streak, and miles back to you.
  • To work out what a finished lesson or quiz earns.
  • To unlock the modules a paid plan covers, and to let you manage or cancel it.
  • To send course updates to the people who asked for them.
  • To keep the sites online and secure.

We do not sell your personal information, we do not share it with advertisers, and we do not build advertising profiles.

Who else handles your data

Four companies process data on our behalf.

  • Supabase runs our database, our sign-in, and the server function that works out what a completion earns. Everything described above — your email address, your profile, your course progress, the course-update list, and the billing records described under Payments and billing — is stored there.
  • Netlify hosts and serves both sites. Like any web host, Netlify’s servers see the ordinary details of each request — IP address, browser user-agent, and the page asked for — and record them in access logs. We do not configure those logs, we do not read them for analytics, and how long Netlify keeps them is Netlify’s own platform default rather than a setting of ours.
  • Dodo Payments is the merchant of record for every paid plan: the seller you are actually buying from, not us. Dodo processes your payment details directly — we never see or store your card number — and handles any tax that applies to your purchase. See Dodo’s privacy policy for what it collects on its own behalf.
  • Google runs the analytics on both sites (Google Analytics). See Analytics and advertising below for what that sends them.

Nothing else is in the loop. The site’s fonts are built into the site and served from our own host, so opening a page does not call out to a font provider.

Cookies and on-device storage

Signing in uses a token, not a cookie. The only cookies SailStarter sets are Google Analytics’ own (_ga and _ga_<container-id>) — see Analytics and advertising below.

The learning app also keeps a few things in your browser’s local storage, or the equivalent app storage on a phone:

  • your sign-in session, so you are not asked to sign in again every visit;
  • anything you finish while offline, held in a small queue on the device until it can be sent, then removed;
  • the last streak number the app showed you, so it can tell when it has ended.

None of it is shared with advertisers or any other third party. Signing out clears the session; clearing your browser or app storage clears all of it.

Analytics and advertising

Both sites run Google Analytics. It sees the pages you visit, roughly where you are (city/country, worked out from your IP address, which Google does not pass on to us), your device and browser type, and how you arrived at the page. We use it only to see which pages and lessons get used. On blog articles, it also records when a reader has spent at least ten seconds and reached 60% of the page, when an article link into a lesson is clicked, and when a quick-check answer is revealed. Those events carry the article handle, the linked lesson reference, and where the link appeared; they do not carry the answer text or anything you type.

We do not enable Google Signals, ad personalization, or any other advertiser-facing feature of Google Analytics, and we run no advertising pixel of any kind. No PostHog, no Plausible, no Fathom, no session recorder runs on either site. Apart from Google Analytics, the only other scripts on our pages are inline blocks of structured data that describe the page to search engines, and they collect nothing.

If we change what our analytics setup does or add another tool, we will update this section and the date at the top of this page before the change goes live.

How long we keep it

  • Your account and everything in the course stay until the account is deleted. Nothing expires on a timer.
  • Quiz attempts are a permanent record for the life of the account. The app can add attempts but cannot edit or remove them individually — deleting the account is what removes them.
  • An address on the course-update list stays until you ask us to remove it.
  • Billing and subscription records stay for as long as the account they belong to. Dodo Payments separately keeps its own transaction records under its own privacy policy, for its own accounting and tax obligations, even after we delete ours.
  • Access logs are kept by our host under its own retention policy, described above.

Your rights

Wherever you live, you can ask us to:

  • tell you what we hold about you, and why;
  • correct it if it is wrong;
  • send you a copy in a portable form;
  • delete it — see the next section.

Some of it you can handle yourself: your timezone and your daily goal are editable in the app, and your progress, miles, streak, and achievements are all visible there.

We will not charge you for making a request and we will not treat you differently for having made one. If we cannot do what you ask, we will tell you why. Depending on where you live you may also have the right to complain to a data-protection regulator — we would much rather you came to us first.

Deleting your account and your data

How to delete your SailStarter account

  1. Email us at tikhonenkoigor@gmail.com — send it from the address on your account and ask us to delete the account.
  2. We confirm it is you, and delete it.
  3. Deleting the account removes your active sign-in record, and with it your profile, your lesson progress, your quiz attempts, your miles ledger, your activity days and streaks, your achievement unlocks, your billing and subscription records, and the internal bookkeeping rows that go with them. Those records are tied to your sign-in record in the database, so they are removed with it automatically. Secure backup copies may retain the same data for a limited period before they expire.
  4. If you have an active subscription, cancel it first from the You tab under “Manage subscription” — deleting the account does not itself cancel a subscription or refund a purchase.
  5. If you also signed up for course updates, say so in the same message. That address sits on a separate list that is not attached to your account, so deleting the account does not remove it and we have to take it off separately.

There is no delete button in the app yet, so deletion is done by us, by hand, when you ask.

Why the course-update list is separate. Addresses collected by the sign-up boxes on the marketing site are stored on their own, with no link to any account. That is why deleting an account cannot reach them — and equally why you can ask to come off that list whether or not you ever had an account.

We do not send course-update emails today. Before we begin, every course-update email will include a clear, one-click unsubscribe link. You can also email us at tikhonenkoigor@gmail.com to ask to come off the list.

Children

You must be at least 16 to create a SailStarter account. That is our own rule. SailStarter is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe someone under 16 has an account, email us at the address above and we will delete it.

Changes to this policy

When this policy changes we update the date at the top of the page. If the change matters — new information collected, a new company processing it, or a new reason for using it — we will say what changed rather than quietly swapping the text. Launching social sign-in and adding any analytics tool would both count as that kind of change.