Legal · Effective 16 July 2026
Privacy Policy
Stingray is built so that as little of your data as possible ever leaves your machine. This page describes, precisely, what is processed, where, and why — and the rights you have over it.
1. Who we are
The data controller for Stingray (stingraynav.com) is Tommaso Laterza, reachable at tommasoltrz@gmail.com.Stingray is developed in collaboration with Kontiki S.R.L. (Genova, Italy), which is not the operator of this service.
2. Two roles: your account data vs. your case data
For the data that makes your account work — your email, your profile, waitlist signups, usage counters, analytics — we are the controller.
For the case data you upload and produce — recordings, decoded vessel tracks, notes, audio clips, chart overlays — you (or your organisation) are the controller, and Stingray acts as a processor: we store it on your instruction, we never read it, analyse it, or share it, and it is technically isolated to your account (row-level security, verified by policy audit). Maritime traffic data can contain personal data (vessel names, MMSIs of small craft, voice recordings) — assessing the lawfulness of analysing it in your case is your responsibility as its controller.
3. What never leaves your machine
Two categories are processed entirely in your browser and are never uploaded, logged, or retained by us:
- Source recordings (NMEA, CSV, VDR files) — parsed locally in a background worker. The file itself is never sent to any server and is not kept after parsing.
- Exports (MP4 videos, Rhino 3DM models, CSV files) — generated locally and saved directly to your disk. Nothing is rendered server-side.
- Local projects. When you save a project as a local file (a
.stingrayfile on your disk), the entire project — tracks, notes, audio, overlays — stays on your machine. Nothing about it is uploaded. (Cloud projects, the default, are stored in your private workspace as described below.)
4. What we process, and why
| Data | When | Purpose / legal basis |
|---|---|---|
| Account identity (email, optional name) | At signup | Operating your account (contract, Art. 6(1)(b)) |
| Project data (decoded tracks, settings, notes, audio clips, image overlays) | Only when you save a project | Storing your work at your instruction (contract; we act as processor — see §2). Hosted in the EU, readable only by your account. |
| Waitlist email | When you request access | Notifying you when Stingray opens — nothing else (consent, Art. 6(1)(a)) |
| Vendor configuration document (AI-assisted decoding) | Only when you explicitly upload one to the optional “draft with AI” feature | Drafting decode rules (consent per use). Sent to Anthropic for processing; never stored or logged — we keep only token counts for rate limiting. |
| Pageview analytics (URL, referrer, device class, country) | Browsing the site | Understanding site traffic (legitimate interest). Cookieless, no cross-site identifier, reported through our own domain. |
| Hosting logs (IP address, requested URL) | Every request | Security and operation of the service (legitimate interest) |
5. Who receives data (processors)
- Supabase (database, storage, authentication) — hosted in the EU (Ireland, eu-west-1). Holds account data and saved project data.
- Vercel (hosting and cookieless web analytics) — processes requests and logs; transfers to the US are covered by its EU–US Data Privacy Framework certification and standard contractual clauses.
- Anthropic (AI-assisted decoding) — receives only the vendor document you explicitly upload to that opt-in feature, US-based. Never used unless you choose to.
- Map tile servers (OpenStreetMap, Carto, ArcGIS, OpenSeaMap) — an unavoidable property of using third-party basemaps: when you pan the map, your browser requests tiles for the viewed area directly from these servers, which therefore see your IP address and the map region you are looking at. No case data is included in those requests.
We do not sell data, and there is no advertising of any kind.
6. Cookies and local storage
Stingray sets no tracking cookies. The only cookies are the strictly-necessary session cookies that keep you signed in. Interface preferences (theme, panel sizes) are kept in your browser's local storage and never transmitted. Analytics is cookieless. This is why you see no cookie banner — there is nothing to consent to.
7. Retention
- Account and project data: until you delete a project or your account (see §8).
- Waitlist emails: until you are notified of launch or ask to be removed, whichever comes first.
- AI-usage counters (never content): as long as needed to enforce usage limits.
8. Your rights
Under the GDPR you can request access, rectification, erasure, portability, or restriction of your personal data, and object to processing based on legitimate interest. To exercise any of these — including full deletion of your account and all stored data — email tommasoltrz@gmail.com. Requests are honoured within 30 days.
You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (garanteprivacy.it), or the authority of your own EU member state.
9. Changes
If this policy changes materially, the effective date above is updated and registered users are notified by email. The current version always lives at this address.