Skip to content

Leebow

Privacy

This policy covers Offwind (the weather-routing website and the Offwind iOS app), RegattaPages event hosting, and Saildex. They are run by Leebow, share one account system, and are hosted together. The sections say what each one uses, because a race entry, a routing request and a live position are different things.

Last updated 23 October 2026

In short

  • Sign-in is by an emailed link. There are no passwords to store.
  • The app sends your position to us only when you share it, upload a finished track (on by default while you are signed in, and you can turn it off), raise a man overboard alarm, or ask for weather or a route for an area.
  • There is no advertising, no tracking across other companies’ apps or sites, and no third-party analytics. We do not sell personal information.
  • Deleting your account in the app removes your devices, positions, passages and uploads at once. A few records need an operator to finish; see below.

Offwind app and account

Account and sign-in

An account is your email address and an account ID. You sign in by opening a link or code we email you. Each signed-in device is recorded with a random install ID that the app creates and keeps in the iOS Keychain, the device label “iPhone” (not the name you gave your phone), the platform, the app version, and when it was last seen. To limit abuse of sign-in, each request for a link records the email address, IP address and browser or app identifier. Sign in with Apple and passkeys are built but not offered yet; this policy will say what they store before they are.

If you allow notifications, the app gives us its Apple push token, which is stored with the device record. Nothing sends push notifications yet. When Apple App Attest is turned on, the app also registers an App Attest key so the server can check requests come from the genuine app; the key identifies the app installation, not you.

Location

The app uses precise location, including in the background while you record a passage. It stays on your phone except in these cases:

  • Live sharing is off by default and turned on per passage, with an end time. While it is on, the app sends about one position a minute (position, speed and course, and wind, boat speed and battery where available). Members of the project the passage belongs to can see it; it is hidden during a race unless you choose otherwise. You can also make a public link, offwind.org/live/…: anyone holding it sees the passage name, the latest position and up to seven days of track. A link lasts at most 30 days and can be revoked at any time.
  • Track uploads. A finished track (positions, accuracy, speed, course and name) is uploaded to your account and, if you attached it to one, the project, only while you are signed in and the setting “Upload finished tracks to my Offwind account” is on. It is on by default once you sign in, and you can turn it off in Settings. Turning it off cancels uploads that have not been sent; recordings made while it is off, or while you are signed out, stay on your phone and are not uploaded later.
  • Man overboard. Raising the alarm sends a position flagged as man overboard. When shore alerts are enabled, the project’s shore team is emailed.
  • Weather and routing. A request for weather carries the area it covers (a corridor or a bounding box). A request for a route carries the start, finish, marks and departure time.
  • Race committee mark setting. If you join a mark-setting session, the mark positions you report (with accuracy, method and any note), wind observations and task reports are recorded with the display name and boat label you give, and are visible to the race committee and the other people in that session.

Satellite links

If you register a RockBLOCK modem or Garmin inReach, we store its Iridium IMEI and any label you give it, and the messages and positions it relays through the gateway. If you link Garmin MapShare, we store the feed address and its password, the password encrypted (AES-256-GCM), and our server fetches your positions from Garmin. A weather request sent by satellite email goes from your own mail account and carries your device’s ID, a signature, the area and the forecast you want; we keep the request, a hash of the sender’s address and the reply-to address, and email the reply only to the sender.

What you create

Polars you save to your account (name and table), passage names and share-link labels, race committee display names, boat labels and notes, and messages sent to a project’s shore team. These are visible only to you and to the people you share a project or session with.

Diagnostics

The app collects no analytics, crash reports or diagnostics today and contains no third-party SDKs. If it ever offers to send a diagnostic report, it will ask first, and reports are kept for 90 days. Requests the app makes to our servers are measured like any web request; see traffic measurement.

On the boat network the app talks directly to your instruments, a Starlink dish, and other devices running Offwind. That traffic stays on the boat’s network and does not reach us.

Offwind on the web

Your polar and routes

A pasted polar is normalised for its request, returned to your browser in a no-store response, and held in session memory. It is not logged or stored by default; routes keep only its digest. A polar you deliberately save, on the web or from the app, stores its table and name under your account so you can reuse it. It is not shared or used for analytics, aggregation, or training, and deleting it removes the stored table immediately.

Offwind stores the course, forecast model, departure window, and computed track so share links can reopen a route and accounts can list and rerun routes. These are deleted when the applicable plan retention period ends. Share links are unguessable tokens, not passwords: anyone holding one can see its course, forecast, and track, but not the polar.

Account, logs, and cookies

Offwind stores operational request counts, timings, error traces, job-queue depth, and rate-limit records keyed by account or hashed IP address. These records operate and protect the service; they do not build a profile. Offwind, RegattaPages, and Saildex use one Leebow account, and sign-in sets one HttpOnly, Secure, host-only session cookie on the site you sign in to; permissions still control private and administrative features.

External services

GRIB files are fetched server-side, so NOAA and ECMWF do not receive your browser visit. Map tiles and bathymetry are served from infrastructure run for the site. Payments on the web are taken by Stripe: card details are entered on Stripe’s pages and never reach this site.

RegattaPages event data

Information collected

When you create an account or enter a regatta, we collect the information you enter: name, email address, sail number, boat name, class, rating-certificate details, and the contact details needed by a race committee.

Use and publication

The data runs scoring, results, and tracking, supports account and regatta email, helps find service problems, and protects against fraud and unauthorized access. We do not send marketing email. Entry lists, crew lists, and results may be public for a regatta, including names, boats, and finishing positions.

Cookies

After sign-in, RegattaPages sets one HttpOnly, SameSite=Strict, Secure, host-only session cookie. There are no advertising cookies. Theme preference remains in browser local storage and is not sent to us.

Saildex

Saildex publishes regatta results gathered from public scoring sites and events it hosts: event, boat, sail number, skipper, crew and finishing positions, and the sailor records built from them. Events hosted on Saildex keep entrant contact details and registration answers private to the event’s organizers. The Saildex Regattas privacy notice has the detail for hosted events. To correct or remove how your name appears, email support@saildex.com.

Traffic measurement and logs

Our own traffic collector, on our own server, records each request to these sites and to the app’s API: the page path and query, referring site, browser or app identifier, device type, language, response status and time, whether the visitor was signed in, and, from browsers, screen size and standard performance timings. It sets no cookies and stores nothing on your device. It never stores your IP address: the address and browser string are combined with a random daily salt and only the hash is kept, and each salt is discarded after two days, after which the hash cannot be linked back to an address. Links that carry a secret, such as live share links, invitations and sign-in links, are recorded with the secret removed. These records are not linked to your account and are kept indefinitely for traffic statistics. No third-party analytics service receives them. The collector privacy page has more detail.

Separately, our servers keep operational logs and metrics (errors, timings and job progress) to find and fix faults.

Who processes data for us

  • Fly.io: hosting for the websites, the app’s API, background workers and the traffic collector.
  • Vultr: the server that runs the database.
  • Tigris: object storage for uploaded tracks, weather files and encrypted database backups.
  • Cloudflare: DNS, and delivery of sign-in, alert and weather-reply email.
  • Stripe: payments on the web.
  • Apple: the App Store and TestFlight, push notifications when they are used, and App Attest when it is turned on.
  • Garmin and Iridium satellite services, only if you link a device of theirs.

We may disclose information where law requires it or to protect rights, property, safety, or the service. Traffic is encrypted with TLS, connections to the database travel over encrypted tunnels, and database backups are encrypted before they are stored. Payment card details are handled on Stripe’s own pages.

How long data is kept

  • Live-sharing positions and beacons, diagnostic reports and satellite gateway records: 90 days.
  • Public live-share links: removed 30 days after they expire or are revoked.
  • Sign-in links and their request details: 2 days.
  • Sign-in send records: 30 days for a link that was sent, 7 days for a request that was refused.
  • Satellite email weather requests: 30 days.
  • Traffic measurement: kept indefinitely, without IP addresses (above).
  • Your account, devices, uploaded tracks, passages, saved polars, routes and messages: while your account exists, unless you delete them sooner. Saved routes follow your plan’s retention period.
  • Published regatta results: kept as the record of the competition; removal is considered case by case.

Deleting your account and your choices

In the app, open Settings › Account › Delete account and hold to confirm. This immediately deletes your devices and their sign-in tokens, positions, passages and their share links, uploads (the stored files are removed from storage shortly after), preferences, satellite and MapShare links, man-overboard alerts, diagnostic reports and App Attest keys, and signs the app out everywhere.

Some records are not deleted by the app and wait for an operator to finish: your user and person record (email address and name), web sign-in sessions, payment records at Stripe, projects, boats and polars you own, shore messages, satellite gateway messages, race-committee records, tracks uploaded into a project, and your entries in regattas. The deletion request is recorded for us to complete. To have all of it erased, or to delete an account you use only on the web, email support@wxnavigator.com from the address on the account and we will confirm when it is done.

You may also ask to access or correct personal information. For RegattaPages events, email contact@regattapages.com; published results from a regatta you sailed are considered case by case. For Offwind and the app, email support@wxnavigator.com or see Offwind support.

We may update this policy when practices or legal obligations change. A material change for an account holder will be sent by email before it takes effect.