Privacy Policy

This Privacy Policy describes what data Tiller (the iOS app, "we", "us") collects when you use it, why we collect it, and your rights under UK GDPR. Tiller is operated by Zachariah Simons, an individual sole trader based in the United Kingdom.

1. Data stored on your device

Journey records, sensor readings, battery readings and preferences are stored locally on your iPhone. Using an optional sharing, submission or online feature can send selected information off your device, as explained below. Tiller does not automatically upload your complete journey history through these features.

• GPS location — used to record journey logs, show your position on the map, and trigger background recording when you start cruising.
• Sensor readings — heading from the magnetometer, speed from GPS, altitude where available.
• Journey logs — start/end times, route geometry, distance, duration, photos you attach.
• Battery / solar readings — if you connect a JBD BMS, Victron device, or compatible Bluetooth sensor, the readings are stored locally.
• App preferences — units, theme, layer toggles.

2. Data processed off-device

Some features communicate with third-party services or Tiller's own Cloudflare-hosted service.

• Apple — In-App Purchases. When you buy Tiller Pro, Apple processes the transaction. Apple's privacy policy governs this. We receive a transaction receipt — no payment-card details.
• RevenueCat — subscription state. We use RevenueCat (revenuecat.com) to verify your Tiller Pro entitlement across devices. A pseudonymous user ID and your purchase receipts are sent to RevenueCat. See RevenueCat's privacy policy.
• Maps and place searches. Tiller uses Apple MapKit for map and place-search features, OpenFreeMap for online vector maps, and Esri World Imagery for satellite maps. Online requests identify the map area or search you request. Offline map packs can be downloaded or streamed from Tiller's GitHub release; a fully downloaded local pack can be read on your device. Map fonts and icons are bundled with the app.
• Weather. Tiller requests forecasts from Open-Meteo using the location needed for the forecast. Weather radar uses RainViewer. Requests for these online features identify the requested forecast location or map area.
• Facility reviews. When you submit a review, Tiller attempts to send the facility, rating, review text, selected attributes, date and a pseudonymous per-install author identifier to Tiller's Cloudflare-hosted service. Submitted review records can be returned to other users in the facility review feed. A review can remain stored locally if the service is unavailable.
• Photo-derived points of interest. Tiller can identify a proposed point of interest from a location-tagged photo. Only after you confirm submission does Tiller attempt to send its precise coordinates, chosen category, candidate identifier, date and pseudonymous per-install author identifier to Tiller's service. This submission payload does not include the original photo.
• Lifetime membership and roadmap votes. Tiller sends your RevenueCat app user identifier to its service to register a lifetime membership number. If you submit a roadmap vote, the service also receives the quarter and your selected choice. These records are associated with that app user identifier.
• Optional canal presence. If you opt in, Tiller attempts to send a nearby lock or chokepoint identifier, a broad compass heading and a timestamp while you are moving. This feature's payload contains no name, author identifier or exact GPS coordinate. Presence entries are set to expire after 30 minutes. The service returns counts rather than a list of people.
• Sharing and exports. When you use a share or export action, you choose where the selected file or information is sent. The destination service's own privacy terms may also apply.

3. Data we do NOT collect

• No analytics SDKs (no Firebase, no Mixpanel, no Amplitude).
• No advertising trackers.
• No device fingerprinting.
• Photo access is used for photo-related features you choose, including attaching a photo or reviewing a proposed point of interest.

4. Account and authentication

Tiller does not require you to create an account. Subscription state is tied to your Apple ID via Apple's standard in-app purchase mechanism.

5. Children

Tiller is not directed at children. We do not knowingly collect personal data from children.

6. Retention

Local records remain on your device until you remove them using the app's available controls or remove the app. Removing local records does not automatically remove information previously sent to a server or another person. Apple and RevenueCat apply their own retention practices to the data they process.

For records received by Tiller's online service:

• Facility reviews expire 365 days after the service receives them.
• Submitted points of interest expire 90 days after the service receives them.
• Identifiable roadmap votes expire 90 days after the end of the relevant calendar quarter, using UTC.
• Lifetime membership identifiers and allocated numbers are retained only while needed to provide the lifetime entitlement.

Review and point-of-interest retention starts when our service receives the record, rather than the date supplied by your device. Expired reviews are excluded from new service responses. Cleanup of expired records is scheduled daily. Removal from active storage can occur after expiry while scheduled cleanup and Cloudflare processing complete; service interruptions can delay cleanup. A record resubmitted after its earlier copy has been removed can be treated as a new submission.

These periods cover active service records. Expiry or deletion from Tiller's service does not remotely erase copies already downloaded to another device, screenshots or exports. These periods do not set retention periods for provider logs or backups.

7. Your rights under UK GDPR

You have the right to access, correct, delete, or export your personal data. You can manage local records using the controls available in Tiller. Deleting a local record or removing the app does not itself erase records held by Tiller's online service.

For requests concerning information held through Tiller's service, contact zachariahsimons@hotmail.co.uk and describe the feature concerned. Zachariah Simons handles these requests. We may ask for information needed to verify your identity and identify the affected records before providing access or making changes. Tiller has no in-app control that deletes these server records.

Requests concerning data held by Apple or RevenueCat are also subject to their own privacy policies and processes.

8. Contact

For any privacy enquiry, email zachariahsimons@hotmail.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

9. Changes to this policy

If we make material changes we will update the "last updated" date above and, where required, notify you in-app.