Privacy Policy

We collect and process personal data in accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

All personal data we collect about users of the app and website will be:

• Processed lawfully, fairly, and in a transparent manner in relation to the data subject
• Processed in a manner that ensures appropriate security of the personal data
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed

Bova is operated by Reactor Studio d.o.o., Zadarska ulica 80, 10000 Zagreb, Croatia, registered with the Commercial Court in Zagreb under MBS 04416635, OIB 21850851425, which is the data controller. If you have any requests concerning your personal data, you can contact us at support@bova.live.

When you create an account

• Name and email address
• Your role (skipper or crew)

When you add a boat

• Boat name, model, dimensions (draft, length, width), year of construction, registration number, MMSI, capacity, and photos you upload

When you use the app

• Location data. With your permission, the app collects your device’s precise location, including in the background while you sail. We use it to show nearby destinations, detect when you arrive at or leave a destination (geofencing), prompt you to report occupancy, deliver weather alerts for your position, and record your route during a trip. Location tracking is visible in the app while active, and you can disable it at any time in your device settings — the app remains usable without it, with reduced functionality.
• Occupancy reports. The availability counts, comments, and photos you submit. Your first name, profile photo, and the time of your report are shown to other users alongside the report — this attribution is core to how the community verifies information.
• Contribution data. Points awarded for your reports and a reliability score derived from how your reports compare with other reports. Your name and points may appear on the community leaderboard visible to other users.
• Adventures. Adventure names, dates, boat, crew membership, destinations, and votes, visible to the members of your adventure.
• Device data. Push notification token, device and operating system information, and app diagnostics.
• Usage data and session recordings. How you move through the app — which screens you open, which features you use, and which actions you tap — together with a replay of those sessions that reconstructs what the screen looked like as you used it. This data is pseudonymous: it is linked to a randomly generated identifier stored on your device, not to your account, and that identifier is reset when you sign out. Everything you type is masked before it leaves your device, as are the system photo and contact pickers. Content already visible in the app is not masked, so a recording can show destination and occupancy report photos and your position on the map.

When you use our website

• Name and email address, if you submit an inquiry or sign up for updates
• IP address and web browser information

We use the collected data exclusively for the following purposes:

• Providing the service: showing real-time occupancy, weather alerts, trip planning, and crew features (performance of contract)
• Detecting arrival at destinations and prompting occupancy reports; recording your sailing route (consent — location permissions)
• Sending push notifications: weather alerts, occupancy requests and responses, adventure invitations and votes (consent — notification permission)
• Displaying your contributions (reports, points, leaderboard) to other users (performance of contract)
• Maintaining data quality and preventing abuse, including reliability scoring and rate limiting (legitimate interest)
• Understanding how the app and website are used, to improve them — including usage analytics and recordings of app sessions, with the masking described above (legitimate interest; you can object at any time, see “Access to Your Information” below)
• Responding to your inquiries (legitimate interest)
• Complying with legal obligations

We do not sell your personal data. We do not share your personal data with third-party services and companies except as described in this policy.

Bova uses a small number of service providers that act as data processors, processing data at our request and under our instructions. We have appropriate agreements in place with these providers to secure and protect your right to data privacy.

Vercel hosts our website, and Vercel Analytics helps us understand how visitors interact with it, allowing us to improve its content and user experience. It collects anonymous data such as page views, session duration, and user interactions without storing personally identifiable information. Vercel Analytics is privacy-focused and does not use cookies.

PostHog provides the product analytics and session recording used in the mobile app, processing usage events and recordings on our behalf so we can see how the app is actually used and fix what does not work. We use PostHog’s EU cloud, so this data is processed within the European Union, and we configure it to mask everything you type and the system photo and contact pickers before anything leaves your device.

Expo provides the platform our mobile app is built on. Push notifications (weather alerts, occupancy requests and responses, adventure invitations) are delivered through Expo’s notification service, which processes your device push token on our behalf.

We ensure that all personal data processed by these tools is handled in accordance with applicable data protection laws.

• Other users see your first name, profile photo, occupancy reports (with time of report), leaderboard position, and — within an adventure you join — your crew membership and votes.
• Service providers listed above process data on our behalf.
• We do not share your personal data with charter companies or any other commercial partners.
• We may disclose personal data where required by law.

Where a processor transfers data outside the European Economic Area (e.g., Vercel and Expo in the United States), the transfer is safeguarded by an adequacy decision or standard contractual clauses. PostHog processes usage data and session recordings on its EU cloud, within the European Union.

• Account, boat, and adventure data are kept for as long as you have an account, and deleted when you delete your account.
• Route (location) history is kept until you delete it — you can delete your recorded routes in the app at any time.
• Occupancy reports contribute to aggregated, non-identifiable occupancy statistics; the attribution linking a report to you is removed when your account is deleted.
• Usage data and session recordings are kept in PostHog for the retention period configured there — currently 30 days for recordings — and are then deleted automatically.
• Inquiry emails are kept for as long as needed to handle your request.

We want to make sure your personal data is accurate and up to date. As a data subject, you have the right to access the personal data we collect about you, and the right to know the purpose of the processing, the recipients of the data, and the period for which it is processed. You also have the right to:

• Request correction or deletion of your personal data
• Restrict or object to the processing of your personal data
• Receive your data in a portable format
• Withdraw consent at any time (e.g., by disabling location or notification permissions in your device settings)
• Lodge a complaint with a supervisory authority — in Croatia, the Personal Data Protection Agency (AZOP, www.azop.hr)

You can delete your account and associated data directly in the app (Settings), or contact us at support@bova.live. We will use all reasonable measures to verify the identity of the person requesting access.

Bova is not directed at children. The app is intended for users aged 16 and over. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

Our website at bova.live does not use advertising or tracking cookies. Web analytics is provided by Vercel Analytics, which works without cookies and does not store personally identifiable information. The Bova mobile app likewise does not use cookies or third-party advertising trackers. Our product analytics and session recording identify your device with a randomly generated identifier rather than a cookie, and that identifier is reset when you sign out. If we introduce cookies in the future, we will update this policy and publish a cookie policy with the details before doing so.

We may update this privacy policy from time to time. The current version will always be available in the app and on our website, with the effective date shown at the top. If we make material changes, we will notify you in the app.

For any further questions or requests, contact us at support@bova.live.