Privacy notice
Effective September 9, 2026 · Pilot privacy notice · Version 2026-09-09.v1
Information you provide
Access requests contain your first and last name, email address, self-declared military status and branch when applicable, optional reason for joining, and acceptance of the terms and educational-use notice. Please omit medical, financial and other sensitive details. We do not request military documents or identity-document uploads.
Google or Firebase email-link sign-in verifies your account. An account profile records your identity, sign-in summaries, pilot access and tutorial progress. The team can see request status, review notes, access changes and related administrative records.
How the information is used
The team uses these records to verify email ownership, review eligibility and capacity, administer access, communicate request decisions, provide tutorial progress and investigate service problems. Self-declared veteran or current-service requests may be approved automatically when capacity is available and no review signals require a person’s attention. Other requests receive manual review. You can contact the team about a decision.
Abuse prevention
The access flow uses a random identifier stored in your browser as a soft duplicate and abuse signal. Application-level IP-derived signals are currently disabled because a trustworthy client-IP source has not been verified. They may be added only after that path is verified; if enabled, they will use short-lived keyed hashes rather than treating a network address as identity proof. These signals do not prove who you are, and shared networks or a different device do not by themselves prove misuse. The service also performs a small browser computation to limit automated submissions. It does not use hardware fingerprinting for this purpose.
Activity and technical information
The simulator collects bounded activity and performance summaries, including approximate foreground sailing time, frame-rate summaries, broad browser family, visual-quality setting and coarse error counts. Daily activity summaries are retained for 90 days. The simulator’s application telemetry does not collect your boat positions, routes, headings, replay recordings, passwords, authentication tokens or raw error stacks.
Hosting and authentication providers may process ordinary technical information needed to deliver and secure the service. The application avoids recording sign-in links, tokens or complete sessions in its own logs.
Cookies and browser storage
A secure, HttpOnly session cookie keeps you signed in for up to five days. Local browser storage retains simulator preferences and the random access-flow identifier. During email sign-in, the browser may remember the email you entered so you do not have to type it again on that device; it is cleared when the link is completed. Opening a link elsewhere still requires you to enter the recipient email.
Service providers and access
The pilot uses Google Firebase and Google Cloud for authentication, hosting and account storage. Firebase sends sign-in emails. Resend delivers request and decision notifications and administrator review messages. These providers process information needed for those services. Applicant details and administrator tools are restricted to authorized pilot administration.
Retention and questions
Unverified request drafts expire after 24 hours. If application-level IP-derived signals are enabled later, their retention will be seven days. Inactive browser signals and closed-request details are retained for 90 days. Approved account records and consent are retained while the account is active. Minimal records of owner-imposed access restrictions remain until the owner clears them, so an expired request cannot silently restore access. Daily activity summaries are retained for 90 days.
Contact brian.forristal@vetsailing.org to ask about your information, request a correction or deletion, or question an access decision. Some records may need to be retained to preserve access security and administrative history.