This privacy policy applies to the VesselFlow app (hereby referred to as "Application") for mobile devices that was created by Caseadri LLC. (hereby referred to as "Service Provider") as a Freemium service. This service is intended for use "AS IS".

When you use the Application, the Service Provider and the service providers listed below may process your device's Internet Protocol address, app and operating-system version, app launches, screens and features used, interactions such as opening a vessel or paywall, subscription status, and diagnostic information such as crash reports. This information is used to operate, secure, troubleshoot, and improve the Application.

Location Information

The Application may request access to your device's location to center the map on your position when you tap the locate button. Location access is optional, is only used while the Application is in use, and is handled on your device to improve the map experience. The Application does not track or store your location on its servers. You can grant or revoke location access at any time in your device settings.

Information Collection and Use

The Application creates a pseudonymous identifier derived from Apple's identifier for the app vendor and stores it in the device Keychain. The identifier may remain available after the Application is reinstalled. It is used as the Application's user identifier with Firebase Analytics, Firebase Crashlytics, RevenueCat, and customer-support submissions so events, subscription access, diagnostics, and support requests can be associated with the same installation. It does not contain your name or email address, but because records are associated with this persistent identifier, this data is not represented as fully anonymous.

The categories of information the Application may collect are:

• Identifiers: the pseudonymous Application user/device identifier described above;
• Usage information: app launches, feature interactions, vessel and paywall views, and whether the Application reports a free or paid tier;
• Purchase information: subscription products, entitlement status, purchase and restoration results, and related subscription history provided by Apple and processed by RevenueCat;
• Diagnostics: crash reports, app and operating-system version, device characteristics, and related performance or troubleshooting information;
• Photographs and contributed content: any photograph you choose to submit, the credit name you ask to be published under, and any report you file about a photograph, together with the Application identifier described above. This is described in full under "Photographs You Submit" below;
• Customer support information: the message and optional email address you choose to submit, together with the Application identifier, app version, operating-system version, and subscription tier needed to investigate the request; and
• Network information: Internet Protocol address and request metadata that may be processed by the Service Provider's hosting and backend providers when the Application contacts them.

Your saved vessels and places are stored on your device. If iCloud Key-Value Storage is available, those lists and deletion history are also synced through your Apple iCloud account so they can appear on your other devices. The Service Provider does not receive your Apple ID through this feature.

The Service Provider does not sell this information.

Advertising Measurement and Tracking

The Application measures which marketing campaigns lead people to install it. On first launch it asks, through Apple's App Tracking Transparency prompt, for permission to track you across apps and websites owned by other companies. You can refuse, and you can change your answer at any time in the iOS Settings app under Privacy & Security > Tracking.

If you allow it, the Application reads Apple's advertising identifier (IDFA) and shares it, together with install and subscription events, with AppsFlyer, which performs attribution measurement on the Service Provider's behalf. Because the advertising identifier is shared with a third party for advertising measurement, this constitutes tracking as Apple defines it. The advertising identifier and purchase history are the only information used this way.

If you refuse, the advertising identifier is not read and is not shared. Attribution measurement then relies only on aggregated and privacy-preserving signals provided by Apple, and nothing that identifies your device for advertising leaves it. Refusing does not limit any feature of the Application.

The Service Provider does not use this information to show you advertisements inside the Application, and does not sell it.

Photographs You Submit

The Application lets you contribute a photograph of a vessel, and lets you report a photograph you believe is wrong or inappropriate. Both are entirely optional. If you never use them, nothing in this section applies to you.

What is sent. When you submit a photograph, the Application sends the image itself, the credit name you typed, the vessel it relates to, and the pseudonymous Application identifier described above. The Application re-encodes the image on your device before it is sent, which removes the metadata a camera writes into a photo file, including GPS coordinates, the date and time, and the camera or phone model. The Service Provider therefore does not receive the location where the photograph was taken. When you report a photograph, the Application sends the photograph's identifier, the reason you chose, any note you wrote, and the same Application identifier.

What is published. Nothing is published automatically. Every submitted photograph is held privately and reviewed by a person first. If it is published, the photograph and the credit name you provided appear publicly in the Application and may appear on the Service Provider's website, and they can be seen and saved by anyone. Do not use a credit name you are not willing to have published, and do not submit a photograph you would not want to be public. Nothing else about you is published, and the Application identifier is never shown.

Who sees it during review. A submitted photograph and its credit name are placed in a private review queue hosted by GitHub, Inc., where the Service Provider reviews them. A photograph may also be passed to an automated screening service (Replicate, Inc., running Google's Gemini models) which checks whether it is a usable and appropriate photograph of a ship and whether the credit name is publishable. That screening only removes clearly unsuitable submissions from the review queue; it never publishes anything, and a person makes every decision to publish.

How long it is kept. A photograph that is not published is deleted, along with the staged copy, when it is rejected. A published photograph is kept for as long as it remains in the Application; when it is withdrawn, the file is deleted and removed from the content delivery network's cache. The record of a submission or a report, which does not include the image, is retained as described under "Data Retention Policy".

Removal. You may ask for a photograph you submitted to be removed at any time by contacting [email protected], and by reporting it in the Application. A reported photograph is hidden immediately, before anyone reviews it. If you are a rights holder and believe a photograph infringes your copyright, contact the same address, or use the copyright option in the Application's report screen; see the Terms and Conditions for how those notices are handled.

Children. Photographs must be of vessels. Please do not submit photographs in which a person is a significant part of the image, and in particular do not submit photographs of children. Submissions that show identifiable people are rejected in review.

Third Party Access

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

• Google Analytics for Firebase
• Firebase Crashlytics
• Firebase (Firestore, Functions & App Check)
• RevenueCat
• AppsFlyer (advertising attribution measurement)
• Apple (App Store purchases and iCloud sync)
• Cloudflare (image storage and delivery)
• GitHub (the private photograph review queue)
• Replicate (automated screening of submitted photographs)

Cloudflare stores and delivers the vessel photographs the Application displays, and processes the Internet Protocol address of any device that loads one. GitHub hosts the private queue in which submitted photographs and credit names are reviewed. Replicate processes a submitted photograph and its credit name to screen them automatically, and neither Replicate nor Google uses them to train models. These three receive contributed content only; they receive none of the analytics, subscription or support information described above.

Google Firebase and Google Cloud process analytics, diagnostics, application-security tokens, backend requests, and customer-support submissions. RevenueCat processes the pseudonymous Application identifier and subscription information to determine paid-feature access and restore purchases. Apple processes App Store purchases and, when enabled on your device, iCloud synchronization. These providers process information under their own privacy policies and the Service Provider's agreements with them.

The Service Provider may disclose User Provided and Automatically Collected Information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with their trusted services providers who work on their behalf, do not have an independent use of the information we disclose to them, and have agreed to adhere to the rules set forth in this privacy statement.

Opt-Out Rights

You can stop future collection by uninstalling the Application. You can disable location access in device settings and iCloud synchronization through your Apple account settings. Uninstalling does not by itself delete information already held by the Service Provider or its service providers. To request deletion of information associated with your Application identifier or a support email address, contact [email protected]. Some purchase records remain under Apple's control and must be managed through your Apple account.

Data Retention Policy

The Service Provider retains support messages, pseudonymous identifiers, analytics, subscription records, and diagnostics only for as long as reasonably necessary to provide and secure the Application, resolve support requests, understand product usage, comply with legal obligations, and enforce agreements. Retention by Firebase, RevenueCat, Apple, and other processors is also governed by their respective policies and the Service Provider's settings and agreements with them.

You may request access to or deletion of information that the Service Provider can associate with your Application identifier or support email address by contacting [email protected]. The Service Provider may ask for information reasonably necessary to locate and verify the relevant records and will respond as required by applicable law. Information may be retained when required for legal, security, fraud-prevention, or accounting purposes.

Children

The Service Provider does not use the Application to knowingly solicit data from or market to children under the age of 13. The Application does not address anyone under the age of 13. The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. In the case the Service Provider discover that a child under 13 has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact the Service Provider ([email protected]) so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Changes to This Privacy Policy

This Privacy Policy may be updated from time to time for any reason. The Service Provider will notify you of any changes to the Privacy Policy by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly for any changes, as continued use is deemed approval of all changes.

This privacy policy is effective as of Sep 9, 2026

Your Consent

By using the Application, you are consenting to the processing of your information as set forth in this Privacy Policy now and as amended by us.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at [email protected].