Privacy policy
This page describes what Passage (passage.deepregatta.com) does with personal data. It is read together with the full DeepRegatta privacy policy, which covers all our products.
Last updated: 10 November 2026
In short
- Passage has no accounts and no advertising, and it uses no third-party analytics or tracking services.
- Your routes, limits, boat settings and saved briefings are worked out and kept in your browser. DeepRegatta does not receive them, except the route name and briefing identifier that go with a feedback message if you send one.
- Passage counts visits with first-party usage events, described below.
Who is responsible
The data controller is Davi Silva de Vasconcellos, operating DeepRegatta.
Address: Paris, France. Full postal address available upon legitimate request by email.
Contact for privacy matters: contact@deepregatta.com
What your browser sends when you use Passage
- Hosting: Passage is served by Cloudflare. Like any web host, Cloudflare receives ordinary request data (your IP address, browser and device information, the time and the address requested) to deliver the pages and keep the service secure.
- Forecast data: forecast tiles come from forecast.deepregatta.com, our storage on Cloudflare. A request can show roughly which area you are viewing, but not your route, limits or briefings.
- Map tiles: the base map comes from OpenStreetMap’s tile servers (tile.openstreetmap.org) and the sea marks from OpenSeaMap (tiles.openseamap.org). These independent services receive your IP address, browser information and the tiles you view, with the Passage site address as the referrer. We do not control their logs.
- Boat polars: when you open the boat search or compute a route, your browser asks Passage’s own server function (/api/polars) for the boat list or one boat’s data, so your IP address and the boat you chose reach that function. To prevent bulk copying, it counts requests per IP address (per /64 network for IPv6) over a sliding minute in a short-lived counter that is deleted after a quiet minute. Passage’s code does not write your address to its logs.
- Fonts and scripts load from passage.deepregatta.com itself; no font or script provider is contacted.
Usage measurement
While you use Passage it sends a few usage events to DeepRegatta’s own event endpoint (on oscar.deepregatta.com), which stores them in our database (Supabase). Each event carries:
- a random visitor identifier and a random session identifier, created in your browser and unrelated to your name, email address or any advertising network;
- the event name and product, with a few details of that action: the Passage page viewed, a check started, a briefing or the example opened (with its verdict state), an analysis link shared, a GRIB file prepared (which datasets, time window and size band) or a GRIB next step chosen;
- whether you are a new visitor, the campaign tags (utm_) of the link that brought you, if any, and the domain, not the full address, of the page you came from.
Events never contain your route, coordinates, limits, boat or briefing content, and no IP address is stored with them. To limit abuse, the endpoint uses a keyed hash (HMAC) of your IP address, not the address itself, to cap how many events one source can send.
Legal basis: our legitimate interest in measuring and improving Passage by first-party means (GDPR Article 6(1)(f)). You can object at any time by email, and you can reset the identifiers by clearing this site’s data in your browser.
Feedback form
If you send feedback, we receive your message, the category you chose, your language, the address of the page you were on, whether your device is mobile or desktop, your browser’s user-agent string and, if a briefing is open, its identifier and route name. The form has no email field, so we can reply only if you put contact details in your message.
Messages are stored in our database (Supabase), and the same IP-hash limit as above applies. Legal basis: our legitimate interest in handling feedback and fixing data issues (GDPR Article 6(1)(f)).
What stays in your browser
Passage sets no cookies. It uses your browser’s local storage, session storage and IndexedDB for the items below. This data stays on your device until you delete it or clear this site’s data.
- Language choice, saved only if you use the language switcher.
- Planner draft: route, boat, speeds and departure time.
- Your personal limits.
- GRIB files page choices: last area, period, time step and models.
- The demo briefings you have hidden.
- Briefings you save in this browser (IndexedDB).
- A cache of forecast tiles so they load faster (IndexedDB).
- The usage-measurement identifiers and campaign tags described above: the visitor identifier and first campaign tags stay in local storage; the session identifier, current campaign tags and a few session flags are in session storage and clear when the tab closes.
Who receives data
Cloudflare (hosting, forecast storage and server functions), Supabase (usage events and feedback) and the OpenStreetMap and OpenSeaMap tile services. We do not sell personal data and do not share it with advertising networks. Some of these providers process data outside the EEA; the safeguards are described in the full policy.
Your rights
You can ask us for a copy of your personal data, or to correct, erase or restrict it, or to hand it over in a portable format, and you can object to processing based on our legitimate interests. You can also complain to your data protection authority, for example the CNIL in France.
Because Passage keeps your routes and briefings only in your browser, we cannot see or erase them for you; delete them in Passage or through your browser’s site-data settings.
To exercise these rights, email contact@deepregatta.com