Privacy policy

Effective 12 November 2026

VMG watch records sailing sessions, counts down to race starts and helps you look back at what you sailed. Live sharing and regatta tracking are optional. There is no account or sign-up. The apps have no advertising or third-party analytics, and they do not track you across other companies' apps or websites.

This policy covers the Apple Watch, iPhone, Android phone and Garmin watch apps, whether they come from the App Store, Google Play or Garmin's Connect IQ Store, or as TestFlight and Google Play testing builds; our server, api.vmg.watch; and our websites. Some features are available only in testing builds.

Who we are

The apps and websites are made by Orkestraator OÜ, registry code 12474370, Heldri tee 18, Haabneeme, Viimsi Parish, Harju County 74001, Estonia. Contact: info@orkestraator.ee. We are the controller of the personal data we process under the EU General Data Protection Regulation (GDPR). Other providers are responsible for their own services, as described below.

What stays on your devices

In Apple Health

The Apple Watch app saves each session as a Sailing workout: the GPS route, the race starts, the wind and the forecast the session started from, the regatta's name if you sailed in one, and a summary. Apple Watch also measures heart rate and energy burned. The iPhone reads these workouts. When the iPhone records a session itself, it saves that session and its route to Health too. Apple's Health privacy terms apply, and you control access in the Health settings.

On your Apple Watch

• A track log of GPS positions with time, accuracy, speed and course: about the last four hours of sailing. Older positions are removed when a new session starts.
• The latest forecast, with the position it was fetched for. The next forecast replaces it. If the network fails, it can be reused on the same water.
• A size-limited diagnostic log of speeds, wind, battery and errors, with no positions.
• Settings, the rider profile and the regatta you joined, with its entry details. When sharing is on, also the write-only sharing credential, kept in the watch's Keychain on this device only. Regatta positions not yet sent wait on the watch until they are delivered or handed to the iPhone; these queues are excluded from backups.

Other watch files can be included in the iPhone's backup of the watch. What the apps send over the network is described further below.

On your iPhone

• A processed copy of each session: legs, winds and route points. These copies are excluded from iCloud and computer backups and encrypted while the iPhone is locked. A copy is removed when its session is removed from Health or deleted from the app's list. When the iPhone records a session, it also keeps what it needs to recover the session if it is interrupted.
• Settings, the rider profile, favorites, notes and the sessions you hid, place names, named spots with the position of their center, and the saved sailing area and its forecast. These can be backed up. Notes never go to Health or the watch.
• Regatta and sharing records: the regattas you joined, past and present, their entry details, your invitations and followers, and copies of legs shared with you. The regatta secret, the install secret and the write-only sharing credential are kept in the Keychain on this device only and are not restored onto another device. Regatta positions waiting to be sent are excluded from backups.
• A size-limited diagnostic log of Health reads, with counts and errors and no positions. It is excluded from backups.
• Imported FIT sessions: the original file and the rider profile it was imported under. The app reads times, positions, speeds and, where present, heart rate from it. These files are excluded from backups. Deleting an imported session hides it. Deleting the app removes its files.

Live Activities and notifications are created on the iPhone. We use no push notification service.

On your Android phone

The app keeps recorded and imported sessions, tracks, processed legs, settings, the rider profile, notes, named spots, forecasts, regatta records and sharing records in its own storage. While a session records, a foreground location service with a visible notification keeps recording, also with the screen off. The app does not ask for Android's background location permission.

Android backup and device transfer leave out session files and tracks, recording files, named spots, the encrypted install secret, the regatta records, secret and position queue, sharing and following records, and the saved Garmin watch link. They can include settings with your name, sail number and nationality; the rider profile and regatta preferences; the forecast with the exact position of its area; the event name used for the reminder that you are leaving a regatta; and the latest saved session result, with its place name and the position of its center. Whether backup runs follows your Android settings.

Deleting a session hides it from the list; its files stay on the phone so that it can be restored. Clearing the app's storage or uninstalling removes the app's files from the phone; the count of free analyses used stays on our server, as described under "Free analyses on Android". Copies already in a backup follow the backup provider's rules.

Live sharing and following

If you switch sharing on, the iPhone, Android phone or Apple Watch sends the following directly to our server, api.vmg.watch:

• Your name and sail number from Settings › You; whether sharing is on; and the end time of the regatta you joined, but not its name.
• Invitations: a random identifier, the label you give each invitation, when it was created and expires, and which installation accepted it and when.
• Your newest session: a random session identifier and sequential leg numbers; which kind of device recorded it (Apple Watch, iPhone or Android phone); when it started, ended and was last updated, with format version and revision numbers; race start times, boat class, time zone and whether you are in a regatta.
• Finished legs: start and end times, whether the leg was upwind or downwind, true wind angle and direction, tack, VMG, speed and distance.

No GPS positions, route, heart rate, energy or other Health data go to our server.

Who can see it. Only followers who accept one of your invitations can see your shared session. Each unused invitation link can be claimed by one follower, so give it only to the person it is meant for. Followers see your name, your sail number, whether you are sailing, and your newest session if it started after the invitation was created. During a regatta, they see that you are in a regatta and when it is scheduled to end; its legs reach them only after you end the session. They cannot see earlier sessions.

If you follow someone, your name and sail number go to our server and that rider can see them. The app keeps a copy of the shared legs on your device. It removes them at the deadline set by our server, even offline, and as soon as it learns that your access has ended. What someone has already seen or copied cannot be recalled.

No account. The app creates a random 32-byte install secret, kept in the iPhone's Keychain or, on Android, encrypted with the Android Keystore. Our server stores only a hash of it, a random install identifier, and when the installation was created and last seen. Sharing also uses technical identifiers and credentials, including a write-only credential that lets the Apple Watch send legs.

How long our server keeps it

• Your shared session: 90 days after you end it, or 90 days after its last update if it is never ended. Your next session replaces it. Discarding the session deletes it once our server confirms the request.
• Invitations and access: an unused invitation expires after seven days. A follower keeps access until the rider removes them, they unfollow, or the rider switches sharing off. Removing access deletes that invitation's record. Switching sharing off also deletes the shared session and all of the rider's invitations.
• Name and sail number: while you share or follow. They are deleted when you neither share nor follow any more. If you saved them before you started sharing or following, they are kept for at most seven days after your last change.
• Technical records: identifiers of discarded, replaced or expired sessions, so that they cannot come back, for 48 hours; results of requests, for seven days; counts of recent writes, for one hour; and the newest session's start time and identifier, while sharing stays on, so that an older session cannot replace it. The installation record and its sharing data are deleted after 365 days without contact. Purchase and prize records follow the separate retention rules below.
• Database recovery history: Cloudflare D1's point-in-time recovery can keep deleted data for up to 30 days after it is deleted. Followers cannot access it.

Cloudflare hosts our server and acts as our processor. The server's data is stored in the EU jurisdiction, but requests can be processed elsewhere on Cloudflare's global network. Cloudflare's Data Processing Addendum covers international transfers, relying on the EU–US Data Privacy Framework and standard contractual clauses where they apply.

Cloudflare processes IP addresses and request details to deliver and protect the service. To limit how often new installations can register, our database keeps a SHA-256 hash of the request's IP address for one hour. Our server's error logs contain technical identifiers and status codes, not routes or the contents of requests.

Optional pricing survey

In preview and testing builds, you may be offered an optional survey about Premium pricing and features. We may also invite testers to answer the same survey on our website, through a private link we send them. Only submitting the completed survey sends answers to api.vmg.watch. We keep your four price choices, selected missing features, whether you mainly race, train or sail for fun, your app platform and build number (for the website, "web" and the page's version), the date we received your response (not the time of day), and a random UUID created for that response. The website version also asks roughly how many sessions you have sailed with VMG watch, and we keep the range you choose: it is your own estimate, not read from the app, your sessions or Health. The app saves the response and UUID before sending and reuses them on retries, so a lost confirmation does not count twice; the website does the same while its page stays open. The UUID identifies one response, not a person or installation. These are anonymous responses, not verified unique respondents.

The survey sends no account, device or install identifier, name, contact details, session dates, coordinates, route or Health data, and the apps send no session count. We do not link its answers to sharing profiles, purchases or prize claims. We use the answers to choose pricing and plan features, and delete them from the live database after 180 days, or earlier after analysis. Database recovery history may retain deleted rows for up to 30 more days. In the apps, if you retained your response UUID, you can include it in a deletion request; without it we cannot identify your response. The website never shows the UUID, and a response sent there carries nothing that identifies you, so it cannot be looked up; it is deleted automatically after 180 days.

As with any internet request, Cloudflare receives your IP address. For this survey, its rate limiter processes that address transiently to limit bursts. Our application does not store the survey IP address or an IP hash in the database or logs. This is separate from the one-hour hashed-IP limit for installation registration described above. You can skip the survey without losing access to features.

Purchases, prize codes and reminders

Premium is sold through the App Store on the iPhone and through Google Play on Android. The store handles payment under its own terms; we do not receive your card or bank details.

On the iPhone, the app verifies purchase status with Apple to provide and restore Premium access. The iPhone app sends nothing about purchases to our server. A local purchase-status cache is stored in UserDefaults under premium.status.v1; it is used for at most 3 days after verification, and an expired cache is removed the next time the app runs. An App Store code is redeemed in Apple's own sheet, and the app sees only the purchase that results. The iPhone app itself takes no prize codes from VMG watch flyers: where prizes are offered, such a code is claimed on our web page, which keeps the records described below and passes you to Apple to redeem it.

On Android, our server verifies purchase tokens with Google Play before granting access. It keeps encrypted tokens, token hashes, product and subscription status, expiry and verification times, linked to the app installation and, for a prize, its claim. When you buy, the app gives Google Play an identifier that our server derives from your installation and, for a prize, one for its claim, so that the purchase can be matched to the installation that made it; neither contains your name or contact details. The app keeps purchase tokens and the verified status on the phone, in storage that backups and device transfer leave out; prize codes you entered stay there, with their claims, until you clear the app's storage or uninstall it.

Prize redemption records include the flyer code's hash, platform, claim and redemption state, offer and expiry information. Apple redemption URLs contain usable vouchers and are encrypted on our server. Android claims use the same random install identifier as sharing: it can be linked to the name and sail number in a sharing profile. These records are pseudonymous personal data, not anonymous data. Encryption and hashing do not remove that linkage. We use them to deliver prizes, restore verified access, reconcile purchases and prevent a code or purchase from granting a second prize.

Claim installation and account/profile links are removed 400 days after the later of the claim and redemption, once associated billing or reconciliation no longer needs them. Encrypted Play tokens and their installation and account/profile links are removed 400 days after the latest of confirmed terminal billing status, stored subscription expiry and completion of outstanding acknowledgement, revocation or prize-extension work. Verification retries do not restart this period. Active subscriptions, pending or on-hold purchases and active Founder (Premium for life) purchases retain verification records while needed to provide and restore access.

Request-ID installation links are removed with their claim links; request IDs whose claim is no longer present are removed 400 days after creation. Unclaimed expired flyers, including expired reservations that never launched, are removed 400 days after their batch expires. Encrypted Apple voucher URLs are erased 400 days after voucher expiry, retaining the voucher hash and assignment. Minimal spent flyer, voucher and token hashes, claim/grant bindings and redemption state remain while a voucher or replay can still be presented, independently of installation deletion. We have not established a safe automatic end to this replay lifetime. Hashing these records does not make them anonymous.

To request deletion of personal links, contact us as described under Delete your data. After verifying the request, we record the request and remove unnecessary links and encrypted Play tokens on the next scheduled cleanup, which runs every ten minutes, without waiting 400 days. Billing must have ended, stored expiry must have passed and outstanding work must be resolved; we explain any records still required for those purposes. A request never resets a spent prize. Database recovery history may retain deleted data for up to 30 more days.

Promotional reminders are not enabled on the iPhone or on Android. When they are, optional follow-up cards and reminders are planned on your phone using local regatta history, viewed-session markers and reminder preferences. Notification permission can be withdrawn in system settings. No push service receives these records. We do not use HealthKit-derived counts, dates or identities to target pricing surveys or promotional reminders. Promotional paths whose data source has not been cleared remain off; keeping a calculation on the phone does not by itself permit marketing use of Health data.

What else leaves your devices

Forecasts before you sail

The iPhone and Android apps fetch a forecast for your watch before you sail, because most watches have no network on the water. The iPhone does this whether or not a watch is linked; Android only while a Garmin watch is linked. The place is a point on the water of your latest session, or the sailing area the app saved. If the phone has neither yet, it uses the phone's current location: when a watch is linked, the app asks for location access, and with access given it takes the phone's position, rounded to two decimal places, while the app is open. Otherwise it uses where it last fetched a forecast. A forecast less than three hours old for the same water is reused, and after a failed request the app waits five minutes before the next. The phones fetch these forecasts only while VMG watch is open on them, never in the background; a session's own request, on a watch or a phone, is made only from its first GPS fix, as above. The iPhone hands up to three days of the forecast to the Apple Watch through Apple's watch connection, and both phones send it to a linked Garmin watch. These requests use the same rounding and identification as above.

SAP Sailing Analytics

Only while you have joined a regatta, and only during sessions, the Apple Watch or phone that records sends the GPS positions it accepts to the organizer's SAP Sailing Analytics event over HTTPS: latitude and longitude at full precision, time, speed and course, with a random device identifier that the event links to your entry. Positions not yet sent wait on the device and are delivered later.

Registering in an open regatta sends your name, sail number, boat class, nationality and, if the regatta asks for it, a handicap factor. These fields, the device identifier and the invitation secret are sent as URL query parameters. Linking the device to your entry also sends your entry identifiers and the invitation secret. While you remain joined, the app fetches the event's details from it.

The organizer's event is usually public, so anyone may see your entry and track on sapsailing.com. New tracking for the regatta stops when you leave it or when it ends by itself. The organizer and SAP SE are responsible for how they use, publish and keep the data, under their own terms; to delete what they have already received, ask them. See SAP Sailing Analytics.

Between your Apple devices

Apple's watch connection carries your rider profile, settings, the regatta you joined with its entry details, the forecast and, when sharing is on, the sharing credential to the Apple Watch. Once both apps are up to date and the watch has given the iPhone its key, the sharing credential travels between iPhone and watch only encrypted to that key. The regatta secret is not sent to the watch. Status, settings and records for sharing can come back to the iPhone, and regatta positions not yet sent can move to the iPhone to be sent from there. While the Apple Watch records, HealthKit mirroring carries its live numbers, legs and countdown to the iPhone, without positions. Saved Apple Watch workouts and their routes reach the iPhone through Health's own sync.

The Garmin watch app

When you link a Garmin watch, the iPhone or Android app sends it your settings, your boat class and sailing thresholds, whether you are in a regatta with its name, end, the numbers it hides and why, and a wind forecast with times, wind directions and its location rounded to 0.01°. This passes through Garmin's Connect IQ SDK and the Garmin Connect app on the phone. It does not include your name, sail number or nationality.

The watch app stores these settings and forecasts, what it needs to recover an interrupted session, and the last wind direction with its time and position, which it can reuse for a session nearby within six hours. It records an ordinary Garmin Sailing activity, with the positions and heart rate the watch records and our own speed, VMG and wind fields. Garmin Connect syncs that activity under Garmin's own terms and your Garmin settings. The watch app makes no internet requests of its own: it uses the watch's own weather data, where the watch has it, as a starting wind estimate, and sends the phone only a message that it is ready. While it is open it reads the watch's GPS to show your speed, course and VMG; positions are recorded only in an activity you start, apart from the last wind's position kept as described above. What you give our phone apps stays on your phone or reaches our server only as this policy describes; we handle it under this policy, not Garmin, which has no responsibility or liability for it. The recorded activity itself is saved to Garmin Connect, as said above. See Garmin Connect's privacy policy.

Free analyses on Android

To count the free analyses you have used, the Android app sends our server a one-way hash of the identifier Android gives the app on your phone. Our server keeps only a keyed hash of it, and for each free analysis used a random identifier and the time, plus when the phone was first and last in contact. This keeps the count when you reinstall the app or clear its storage. Nothing about your sessions is sent, and the count is not linked to your installation, name, sharing profile or any account. The app sends it when it starts, when you open your sessions and when you use a free analysis, except while you have Premium, when it sends no free-analysis requests. These records are deleted 24 months after the phone was last in contact, or when you ask us to delete them (see Delete your data). Deletion or expiry resets only the server count; the app keeps its local remaining count until you clear its storage or reinstall it. On the iPhone the count stays in the iPhone's Keychain and is not sent.

Exports and links you share

A GPX export hands a file to your phone's share sheet. It contains the route with times, elevation where available, speeds and courses, the session's name, date and place, and your name if you have entered it. Invitation links can also be shared, or shown as QR codes. These go only to the apps or people you choose, under their own terms.

Why, and on what legal basis

We process session, location, profile and sharing data to provide the features you ask for (GDPR Article 6(1)(b)). When you switch sharing on, follow a rider or join a regatta, you ask for the data exchange that comes with it. Health data is processed with your explicit consent, given in the Health permission sheet (Article 9(2)(a)). You can withdraw it at any time; this does not affect what was lawfully processed before.

We process limited technical and security data to keep the server and websites working and to prevent abuse, and we use your emails to answer you. Both are based on our legitimate interests (Article 6(1)(f)). Other providers describe their own processing, including SDK diagnostics, in their privacy terms linked above.

The survey is voluntary product and pricing research and does not identify you. Where purchase and prize features are enabled, their personal data is processed to provide what you request (Article 6(1)(b)); minimal fraud-prevention and replay records are kept for our legitimate interest in protecting prizes and billing (Article 6(1)(f)). The Android free-analysis count is kept for our legitimate interest in stopping the free allowance from being reset (Article 6(1)(f)). Optional promotional reminders require your opt-in, which you can withdraw (Article 6(1)(a)).

Your choices

• Health access: on the iPhone, in the Health settings for VMG watch.
• Location access: in Location Services on the Apple Watch and the iPhone, or in Apps › VMG watch › Permissions on Android. Recording needs location. So does the forecast the phones prepare for a watch before your first session. The Apple Watch and the iPhone share one permission for VMG watch. The iPhone uses background location, if you allow it, only during its own recording; Android uses the visible foreground service.
• Sharing: remove followers or switch sharing off in Live › Followers, or in Settings › Sharing on the iPhone and Settings › Your profile › Sharing on Android. Unfollow to stop following. Changes take effect when our server confirms them; uninstalling the app alone does not delete server records straight away.
• Regattas: leave a regatta in the app to stop new tracking. For data already delivered, contact the organizer or SAP SE.
• Camera, notifications, Live Activities and backups: in the device's settings. The countdown is spoken by the device's own speech engine.
• Deleting a session from the iPhone's list does not delete its Health workout; use Fitness or Health for that. On Android, and for imported sessions, deleting a session hides it and keeps its files. Removing the app removes its files from the device. Backups, Keychain items, Health, Garmin Connect and server records each have their own controls and retention, as described in this policy.

Delete your data

There is no account to close. What you can delete yourself, and how:

• On your devices: on the iPhone, deleting a session removes the app's processed copy of it; its workout and route stay in Health until you delete them in Fitness or Health. On Android, and for imported sessions, deleting a session only hides it: its files, with the GPS track, stay on the phone so that it can be restored. To remove the app's files from a device, remove the app; on Android you can also clear its storage in Apps › VMG watch › Storage & cache › Clear storage.
• Live sharing: switch sharing off in Settings › Sharing on the iPhone, Settings › Your profile › Sharing on Android, or Live › Followers on either. Our server then deletes your shared session and all of your invitations; your name and sail number are deleted once you neither share nor follow. Unfollow to end following.
• Regattas: leave the regatta in the app to stop tracking. Tracks already delivered are held by the regatta organizer's SAP Sailing Analytics server; ask the organizer or SAP SE to delete them.
• Free analyses on Android: in the app, open Settings › About › Delete my data. It writes a mail to info@orkestraator.ee with the subject "Delete my data" and a reference made from the phone's hash, which is how we find the count. Deleting it resets only the server count; the app keeps its local remaining count until you clear its storage or reinstall it.
• Everything else on our server (your installation record, purchase and prize links): write to info@orkestraator.ee with the subject "Delete my data". There is no account, name or e-mail address on our server to find you by, so include something that leads to your records: a prize code you redeemed, which leads to its claim, the installation that claimed it and the purchase records linked to them; or a follow link (https://vmg.watch/follow/…) you sent or opened, while it is still active, which leads to the installations of the rider and the follower and to the purchase and prize records of those installations. Our server does not store Google Play order numbers or your Google account, so a purchase cannot be found from them. Records that cannot be linked to something you can give us cannot be located, and so cannot be deleted on request; they are deleted on the schedules in this policy, the installation record and its sharing data after 365 days without contact. We answer within 30 days.

Deleted data can stay in database recovery history for up to 30 more days. Minimal purchase and prize records that we must keep, to stop a spent code or purchase being used again, are kept as described under "Purchases, prize codes and reminders"; we tell you which ones when we answer.

Your rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, to data portability, and to withdraw your consent. Much of your data is on your devices or in Health, where you can manage it directly. For the data on our server, write to info@orkestraator.ee; we need something that leads to its records: a prize code, a follow link or, for the free-analysis count on Android, the reference the app writes (see Delete your data). For another provider's data, you can also contact that provider or the regatta organizer.

You have the right to lodge a complaint with a supervisory authority — in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority where you live.

Children

The apps are not directed at children under 13 and do not knowingly collect their data.

This website

This website, orkestraator.ee, is static: no cookies, no scripts, no analytics, and nothing loaded from other sites. It is hosted on Cloudflare, which processes visitors' IP addresses and request details to deliver the site and protect it from attacks, and keeps security logs; see Cloudflare's privacy policy. The apps' own site, vmg.watch, is also hosted on Cloudflare, sets no cookies and has no analytics. Four of its pages run scripts, all served by us: the home page and the Premium page, where a script moves the app pictures sideways when you click an arrow and reads, stores and sends nothing; the invitation page, for Apple's Smart App Banner and the store buttons; and the survey page, which sends completed answers to our server, api.vmg.watch. On Android phones, the Google Play link of an invitation page or a prize page carries the invitation link or the prize code as an install referrer, so that it survives installing the app. If you email us, we use your message only to answer you.

Changes

We update this policy when the apps or services change what they do with data. The date at the top shows the latest version. We send earlier versions on request: write to info@orkestraator.ee.