Privacy Policy
Effective date and last updated: September 2, 2026
Policy version 1.0
BlueWater Marlin is published by Red Oak Media House, LLC, a Virginia limited liability company ("BlueWater Marlin," "we," "us," or "our"). This policy explains how the BlueWater Marlin iOS application, website, support service, and supporting cloud services handle personal information.
Privacy at a glance
- No account, advertising, cross-app tracking, or in-app behavioral analytics.
- Your precise GPS fix, saved spots, trip records, outcomes, and notes stay on your device. They are not uploaded to our learning service.
- Connected features transmit a coarse map area, tile address, station, or chosen forecast coordinate, together with ordinary connection and diagnostic information.
- Limited operational records are used to deliver, secure, and troubleshoot the service—not for advertising, profiling, sale, or model training.
- We do not sell personal information or share it for cross-context behavioral advertising.
- The App Store privacy label conservatively identifies Coarse Location, Product Interaction, and Other Diagnostic Data as Data Linked to You and used only for App Functionality; none is used for tracking.
How to read this page: This entire page is the official BlueWater Marlin Privacy Policy. “Privacy at a glance” is a plain-language overview; the numbered sections below provide the complete details and control if an overview is incomplete.
1. Scope, controller, and important definitions
This policy covers the BlueWater Marlin iOS application, our website, support communications, and the cloud systems we control for the service. It does not replace the privacy notices of Apple or independent public-data services that receive a request directly.
Red Oak Media House, LLC is the controller of personal information it decides to collect and use. Microsoft processes public-website request information and certain cloud information for us as a service provider. Apple and public-data providers may act independently under their own privacy notices when the app contacts them directly.
In this policy, personal information includes information that identifies, relates to, describes, or can reasonably be linked with a person, device, or household. It may include an IP address, coarse location, request history, support email, or diagnostic record even when it does not contain a name.
2. Information that stays on your device
If you allow location access, the app uses your precise GPS fix on your device to place your boat on the chart and calculate distance and bearing. The app does not automatically upload that GPS fix.
Your Spot Book entries, spot names, Trip Log, catch outcomes, notes, and app preferences are stored locally. We cannot view them through our service. The local copy is removed when you delete it or delete the app. Copies may remain in a personal iCloud or encrypted device backup that you control under Apple's policies.
Information processed only on your device is not collected by Red Oak Media House. If you choose to send a diagnostic report or support attachment, the copy you send is handled as described below.
3. Information used for connected features
The app has no account or advertising identifier. Connected features nevertheless create network requests. Depending on the feature and which available source answers first, the following services may receive the information shown below.
| Recipient or feature | Information | Purpose | First-party retention |
|---|---|---|---|
| BlueWater Marlin relay on Microsoft Azure | Coarse map area, requested layer or dataset, request URL, time, result, response size, and ordinary connection information. Our Application Insights configuration masks client IP addresses in stored telemetry. | Return ocean data; secure, operate, and troubleshoot the service. | Our Log Analytics workspace is configured for 30-day retention and records may be deleted sooner. A specific incident, legal obligation, or documented legal hold may require a limited copy to be kept longer. |
| BlueWater Marlin tile storage on Microsoft Azure | Requested tile or manifest path and ordinary connection information needed to return the file. If platform read diagnostics are enabled, a diagnostic record may also include time, operation, result, user agent, caller IP address, and port. | Return tiles; prevent abuse; investigate failures; measure reliability. | Any first-party diagnostic copy we enable is routed to the 30-day workspace and may be deleted sooner. Microsoft may process service and security information under its applicable cloud-service terms. |
| NOAA, NASA, GEBCO, and related public ocean-data services | Requested map area, dataset, layer, or depth region, plus ordinary connection information. | Return public ocean information when a direct route is available or faster. | Controlled by the independent provider under its policy. |
| NOAA National Weather Service and MET Norway | A forecast coordinate chosen in the app and rounded to two decimal places—approximately one kilometre—plus ordinary connection information. | Return wind and pressure forecasts. | Controlled by the independent provider under its policy. |
| NOAA CO-OPS | Tide-station identifier and date range, plus ordinary connection information. | Return tide predictions. | Controlled by NOAA under its policy. |
| Apple Maps | Requests needed to display the Apple base map. | Display the base map. | Controlled by Apple under Apple's Privacy Policy. |
The moon phase is calculated entirely on your device and requires no network request. A requested map area or tile may reflect where you are looking, but the app does not attach your name, account, saved spot, Trip Log, or advertising identifier to these requests.
Where an organization processes personal information on our behalf, it must provide the same or equivalent privacy protection required by this policy and applicable law through appropriate confidentiality, security, and data-protection terms. Independent public-data and Apple services receive only the request needed for the feature and apply their own terms and privacy practices. We do not authorize any recipient to use BlueWater Marlin request information for advertising, unrelated profiling, sale, or model training.
App Store privacy disclosure
Apple’s standardized App Store privacy label is separate from, and does not replace, this policy. Out of caution, the label classifies Coarse Location, Product Interaction, and Other Diagnostic Data as Data Linked to You, used only for App Functionality, and not used for tracking. This conservative classification accounts for ordinary connection metadata that can accompany retained service requests before masking. It does not mean that your precise GPS fix, saved spots, Trip Log, outcomes, or notes are uploaded; those records remain on your device.
4. Other information we collect
| Category and source | What it includes | Purpose | Retention |
|---|---|---|---|
| Website and security records, collected automatically | IP address, requested URL, time, user agent, response status, and strictly necessary security or session information. | Deliver and secure the site, prevent abuse, and investigate faults. | Microsoft processes hosting records under its applicable privacy notice and retention practices. Any separate first-party diagnostic copy we control is ordinarily kept no more than 30 days; longer only for a specific incident, legal obligation, or documented legal hold. |
| Support information, provided by you | Email address and any text, files, screenshots, or other attachments you choose to send. | Respond, troubleshoot, prevent abuse, keep appropriate business records, and resolve disputes. | Ordinarily up to 24 months after the matter closes; longer only if needed for an ongoing dispute, legal obligation, or legal hold. |
| On-device system diagnostics | The production app’s readable diagnostic tape is memory-only and is not mirrored by the app into Apple’s unified system log. iOS may create its own crash or system diagnostics under your Apple settings. | Operate and diagnose the device and app. | Controlled by iOS. We receive no system diagnostic unless you or Apple choose to provide it to us. |
| Optional diagnostic report, created by you | App state and technical events you can review before sharing. Positions in the report are rounded to approximately six nautical miles. | Troubleshoot the problem you report. | Only received if you affirmatively choose a recipient and send it; then retained with the related support matter. |
| Purchase and entitlement status, supplied through StoreKit | Product, transaction, and entitlement status needed to unlock paid features. Apple processes payment-card information and Apple Account credentials. | Provide subscriptions and verify entitlement on your device. | The app caches entitlement state locally as needed to provide the purchase. Our service does not receive a server copy of your StoreKit transaction or payment details. |
| Privacy-request records, provided by you | Contact details, request, our response, and limited verification information if reasonably necessary. | Authenticate and fulfill rights requests; demonstrate compliance. | Ordinarily 24 months after closure, or longer where law requires. |
Our website does not use advertising trackers or behavioral analytics. Hosting or security services may use strictly necessary technologies to deliver a requested page, balance traffic, remember a security choice, or prevent abuse. We do not use those technologies to follow you across unrelated services.
5. Learning and model data
Customer fishing records are not part of our learning system. The current release configuration disables the customer-learning upload path, provides no sharing switch, and does not use saved spots, trips, outcomes, or notes to train a model. Public ocean observations may be used to develop and evaluate ocean-analysis features without customer records.
If we introduce optional customer-contributed learning in the future, we will update this policy and the applicable App Store privacy information before collection begins, provide a just-in-time explanation in the app, and keep the feature off until the user affirmatively opts in. Withdrawing will be as easy as opting in and will stop future contributions. The feature will be designed around coarse region and structured environmental conditions and outcomes—not exact fishing spots, raw tracks, spot names, free-text notes, identity, or IP addresses as model features.
6. Purposes and legal bases
Where the GDPR, UK GDPR, or a similar law requires a legal basis, we rely on the bases below. The exact basis may vary by context and location.
| Purpose | Information | Legal basis where required |
|---|---|---|
| Provide charts, tiles, weather, tides, subscriptions, and related features | Coarse request/location data, request metadata, and entitlement status | Performance of our agreement with you and steps taken at your request; legitimate interests in providing the service where contract is not the appropriate basis. |
| Security, abuse prevention, troubleshooting, reliability, and cost control | Network, diagnostic, website, and request records | Our legitimate interests in protecting users, the service, and our systems. We minimize fields, restrict access, and limit retention to reduce the effect on users. |
| Support and privacy requests | Information you provide and relevant diagnostic or request records | Performance of our agreement, legitimate interests in responding and keeping appropriate records, and legal obligations. |
| Legal compliance, disputes, and protection of rights | Only information reasonably necessary for the matter | Legal obligation and legitimate interests in establishing, exercising, or defending legal claims. |
| Future optional customer learning | Only fields described in a future just-in-time notice | Consent. This processing is not active in the released app and no consent is requested for it today. |
Your precise GPS fix is processed locally by the app and is not collected by Red Oak Media House. The iOS location permission controls this on-device use; you can revoke permission in Settings and continue using features that do not require your position.
We do not sell personal information, share it for cross-context behavioral advertising, use it to serve ads, or track activity across other companies' apps and websites.
7. Service providers and other disclosures
Microsoft Azure hosts our public website, relay, public tiles, and operational monitoring. The app also contacts the public data providers identified above and Apple services used by the app. Those organizations process network requests under their own terms and privacy practices, including Microsoft's Privacy Statement.
We may disclose information when reasonably necessary to comply with law, protect users or the service, investigate abuse, or respond to a valid legal process. If the business is reorganized, financed, sold, or transferred, relevant information may be transferred subject to this policy and applicable law.
We do not permit a service provider acting on our behalf to use personal information for its own advertising or unrelated profiling. We review material providers and limit access according to role and need.
For the website report reader, including destination choices used to retrieve a report and ordinary hosting records, see Report data & privacy. The report reader has no email signup or account creation. Its notice does not change the app's on-device privacy practices.
8. Purchases and subscriptions
Apple processes purchases through StoreKit and your Apple Account. The app receives product and entitlement status needed to unlock paid features, but we do not receive or store your payment-card number, Apple Account password, or complete billing details. Subscription management, cancellation, and refund requests are handled through Apple.
9. Retention and deletion
The tables above state our ordinary periods. We retain personal information only as long as reasonably necessary for the stated purpose, taking account of volume, sensitivity, risk, technical constraints, legal requirements, and dispute needs. We then delete or de-identify it unless law permits or requires continued retention.
- On-device information remains until you delete the relevant record or the app, subject to backups you control.
- First-party operational and website diagnostic copies we control are ordinarily kept for no more than 30 days; hosting providers apply their own disclosed retention practices.
- Support and privacy-request records are ordinarily kept for up to 24 months after closure.
- A documented security incident, dispute, legal obligation, or legal hold may require a longer period limited to that need.
- Public data providers and Apple apply their own retention practices to requests they receive directly.
10. Your choices and privacy rights
You can deny or revoke location access in iOS Settings and continue using features that do not require your position. You can delete saved information in the app or remove the app and its local data. You can manage subscriptions in your Apple Account settings. You may ask us to delete support correspondence or other personal information we control, subject to security, legal, accounting, and dispute-preservation exceptions.
Depending on where you live, you may have rights to:
- confirm whether we process your personal information and access it;
- correct inaccurate information;
- delete information, subject to legal exceptions;
- receive portable information you provided in an appropriate format;
- restrict or object to certain processing;
- withdraw consent for future processing where consent is the basis;
- opt out of sale, targeted advertising, or qualifying profiling—activities we do not perform;
- appeal a refusal where applicable; and
- receive equal service and pricing when exercising privacy rights.
Submit a request by emailing support@bluewatermarlin.com with the subject “Privacy Request.” Describe the right you wish to exercise and the service or communication involved. We will acknowledge and respond within the period required by law—normally within 30 days under GDPR/UK GDPR and 45 days under many U.S. state laws, subject to permitted extensions.
We will request only information reasonably necessary to verify a request. Because the app has no account and operational records are not indexed by name or email, we may be unable to link a particular network record to you. We will explain a denial. Where state law provides an appeal right, reply with “Privacy Appeal” within 60 days of the denial; a different period controls if local law requires it. Authorized agents may submit requests where law permits, subject to verification of authority.
11. United States disclosures
California and similar state notices
The following table describes categories we may have collected and disclosed for a business purpose during the preceding 12 months. We have not sold or shared these categories for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about a person.
| Category | Examples | Sources | Purposes and recipient categories |
|---|---|---|---|
| Identifiers | IP address, support email, and limited transaction or request identifiers | You, your device/network, Apple, and service providers | Functionality, support, security, and legal compliance; cloud, support, payment-platform, and public-data providers as described above. |
| Internet or electronic network activity | Requested URL, tile, layer, dataset, date/time, user agent, result, and response size | Your device and our systems | Functionality, security, troubleshooting, and reliability; cloud and public-data providers. |
| Geolocation | Coarse map area or forecast coordinate; precise GPS remains on-device unless you deliberately include a rounded position in a diagnostic report | Your feature selection and device | Charts, forecasts, support, and security; cloud and public-data providers. |
| Commercial information | Product and entitlement status | Apple StoreKit | Provide and support purchases; Apple and cloud systems where applicable. |
| User content and communications | Support email, message, attachments, and an optional diagnostic report | You | Support, security, disputes, and legal compliance; support and cloud providers. |
We do not knowingly sell or share personal information of consumers under 16. We do not offer a financial incentive for personal information. Because we do not sell, share for behavioral advertising, or track people over time across unrelated services, Global Privacy Control, browser Do Not Track, and similar signals do not change the service's behavior. Other parties are not permitted to use our app or website to track your activity across unrelated services.
If a comprehensive U.S. state privacy law applies to us and you, the rights and request process in Section 10 apply. California residents can learn more from the California Attorney General.
12. Australia
If the Australian Privacy Act 1988 applies, you may request access to or correction of personal information we hold. You may also complain that we have breached the Australian Privacy Principles. Email support@bluewatermarlin.com with the subject “Australian Privacy Complaint” and describe the issue. We will acknowledge the complaint, investigate it fairly, and ordinarily respond within 30 days.
If you are not satisfied after giving us a reasonable opportunity to respond, you may complain to the Office of the Australian Information Commissioner. Information used for connected features is likely to be processed in the United States and, for MET Norway, Norway. Apple or another independent provider may process a request in additional countries identified in its notice.
13. EEA, United Kingdom, and Switzerland
BlueWater Marlin is operated from the United States and is currently offered primarily to users in the United States and Australia. If GDPR, UK GDPR, or Swiss data-protection law applies, Sections 6 and 10 describe our purposes, legal bases, and your rights. We do not make decisions based solely on personal information that produce legal or similarly significant effects, and our ocean-analysis features do not profile individuals.
Information may be transferred to the United States and other provider locations. For a provider acting as our processor, we use an adequacy decision or appropriate contractual safeguards made available by that provider, such as the European Commission's Standard Contractual Clauses and, where applicable, the UK transfer addendum. Contact us to request information about the safeguard relevant to your data.
You may complain to the data-protection authority where you live or work or where an alleged infringement occurred. UK users may contact the Information Commissioner's Office. EEA users can find their authority through the European Data Protection Board. We have not appointed an EEA or UK representative because we do not currently direct regular data-processing activities toward those markets. We will appoint and identify a representative before conducting processing that makes one legally required.
14. Security and incident response
We use measures intended to protect information, including TLS for network connections, data minimization, restricted cloud access, provider IP masking where configured, short operational retention, and review of material service providers. We maintain procedures to investigate suspected incidents and will notify affected people and regulators when law requires. No storage or transmission method is completely secure, so we cannot guarantee absolute security.
15. Children
BlueWater Marlin is a boating and fishing planning tool for a general audience and is not directed to children under 13 or intentionally marketed to minors. It has no account, social feed, advertising, or customer-learning upload feature. We do not knowingly collect personal information from a child under 13 through support. If you believe a child has provided personal information, contact us; we will investigate and delete it when required. A parent or guardian may make the request.
16. International processing outside the specific regions above
Our public website, relay, tile storage, and operational monitoring use Microsoft Azure. Microsoft may process information in the United States and other locations described in its notices. Direct requests may also be processed by providers in other countries, including MET Norway in Norway. If local law grants additional privacy rights, contact us using Section 10. We will apply those rights and required transfer protections where the law applies.
17. Changes to this policy
We may update this policy as the app, providers, or legal requirements change. We will update the effective date and provide additional notice in the app when a material change requires it. We will not use previously collected personal information for a materially incompatible new purpose without notice and any consent required by law. We will update the policy and applicable App Store privacy information before enabling any customer-learning collection. Prior versions are available on request.
18. Contact
Privacy controller and contact:
Red Oak Media House, LLC
Mechanicsville, Virginia, United States
Email: support@bluewatermarlin.com
Support: www.bluewatermarlin.com/support/